Stay organized with collections
Save and categorize content based on your preferences.
Binary Authorization is a deploy-time security control that ensures only trusted
container images are deployed to your Cloud Run resources. With
Binary Authorization, you can require images to be signed by trusted
authorities during the development process and then enforce signature validation
when deploying. By enforcing validation, you can gain tighter control over your
container environment by ensuring only verified images are integrated into the
build-and-release process.
Exempt Cloud Run functions images from Binary Authorization policy
To deploy functions in Cloud Run, the Binary Authorization policy
administrator must configure a Binary Authorization policy using allowlist patterns to exempt all
images from the specified repository and its subdirectories.
Functions using the Cloud Run Admin API
If you are deploying your function with the
gcloud run deploy...
command, use this allowlist pattern:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[],[],null,["# Use Binary Authorization\n\nBinary Authorization is a deploy-time security control that ensures only trusted\ncontainer images are deployed to your Cloud Run resources. With\nBinary Authorization, you can require images to be signed by trusted\nauthorities during the development process and then enforce signature validation\nwhen deploying. By enforcing validation, you can gain tighter control over your\ncontainer environment by ensuring only verified images are integrated into the\nbuild-and-release process.\n\nLearn how to [set up Binary Authorization for Cloud Run](/binary-authorization/docs/run/overview).\n\nExempt Cloud Run functions images from Binary Authorization policy\n------------------------------------------------------------------\n\nTo deploy functions in Cloud Run, the Binary Authorization policy\nadministrator must configure a Binary Authorization policy using [allowlist patterns](/binary-authorization/docs/key-concepts#allowlist_patterns) to exempt all\nimages from the specified repository and its subdirectories.\n\n### Functions using the Cloud Run Admin API\n\nIf you are deploying your function with the\n[`gcloud run deploy...`](/sdk/gcloud/reference/run/deploy#--binary-authorization)\ncommand, use this allowlist pattern:\n\n\n\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-docker.pkg.dev/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/cloud-run-source-deploy/**`\n\n\u003cbr /\u003e\n\nWith the allowlist enabled, deploy your function with [Binary Authorization enabled\nand set to `default`](/binary-authorization/docs/run/enabling-binauthz-cloud-run#enable-on-new-job): \n\n```sh\n gcloud run deploy YOUR_FUNCTION_NAME \\\n ...\n --binary-authorization default\n```\n\n### Functions using the Cloud Functions v2 API\n\nIf you are deploying your function with the\n[`gcloud functions deploy...`](/sdk/gcloud/reference/functions/deploy#--binary-authorization)\ncommand, use this allowlist pattern:\n\n\n\u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e`-docker.pkg.dev/`\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e`/gcf-artifacts/**`\n\nWith the allowlist enabled, deploy your function with Binary Authorization enabled\nand set to `default`: \n\n```sh\n gcloud functions deploy YOUR_FUNCTION_NAME \\\n ...\n --binary-authorization default\n```\n\nWhat's next\n-----------\n\n- Learn how to [set up Binary Authorization for Cloud Run](/binary-authorization/docs/run/overview)."]]
