Cloud Run "Container image ... not found" in CI

Cloud Run tried to pull the image you passed to --image and it was not present at that path, or the account had no read access. The deploy aborts before any revision is created.

What this error means

gcloud run deploy fails with "Container image '...' not found" or "Image '...' not found" naming an Artifact Registry or GCR path that was never pushed under that exact tag.

ERROR: (gcloud.run.deploy) Image 'us-central1-docker.pkg.dev/my-project/app/api:sha-1a2b3c'
not found. The provided container image does not exist or the account does not have
permission to access it.

Common causes

The image tag was never pushed

The build/push step and the deploy step disagree on the tag (a different SHA, branch, or registry host), so the referenced tag does not exist.

The deploy account cannot read the registry

The image exists but the deploy or runtime service account lacks roles/artifactregistry.reader on the repository, so the pull is denied.

How to fix it

Use one image reference for build and deploy

1. Compute the full image URI once (registry, repo, tag) into a variable.
2. Push with that exact URI, then pass the same variable to --image.
3. Verify the tag exists before deploying.

IMG=us-central1-docker.pkg.dev/my-project/app/api:$GITHUB_SHA
docker push "$IMG"
gcloud run deploy api --image "$IMG" --region us-central1

Grant read access on the repository

Let the deploy and runtime service accounts pull from the Artifact Registry repo.

gcloud artifacts repositories add-iam-policy-binding app \
  --location us-central1 \
  --member="serviceAccount:ci@my-project.iam.gserviceaccount.com" \
  --role="roles/artifactregistry.reader"

How to prevent it

• Derive the image tag from a single source (the commit SHA) for both push and deploy.
• List the tag with gcloud artifacts docker images list before deploying.
• Grant artifactregistry.reader to the runtime service account, not just the pusher.

Related guides