Can't make outbound request from Google Cloud Run fully managed

Question

While trying to make an outbound request to an external API from Google Cloud Run fully managed, the http call gets stuck somehow or we are running into the following SSLHandshakeException Remote host terminated the handshake after a little while. The image works well when executed locally so I assume this comes from the sandboxed cloud run environment.

My docker configuration:

FROM maven:3.6.3-jdk-11 as builder

WORKDIR /app
COPY pom.xml .
COPY src ./src

# Build a release artifact.
RUN mvn package -DskipTests

FROM openjdk:11-jdk

COPY --from=builder /app/target/poc-*.jar /poc.jar

# Run the service on container startup.
CMD ["java","-Djava.security.egd=file:/dev/./urandom","-Dserver.port=${PORT}","-jar","/poc.jar"]

The snippet of code getting stuck:

private HttpEntity<String> prepareSecuredRestCallToAJStage() {
    CredentialsDTO credentials = new CredentialsDTO(USERNAME, PASSWORD);
    // Getting stuck here
    TokenDTO response = restTemplate.postForObject(LOGIN_CHECK_URL, credentials, TokenDTO.class);
    // We never get the response
    String token = BEARER_TOKEN_PREFIX + Objects.requireNonNull(response).getToken();
}

For information, this is a Spring Boot application and we are getting this trace at startup:
Container Sandbox: Unsupported syscall setsockopt(0x9,0x6,0x6,0x3e7a3d678e2c,0x4,0xa)

Is there something I'm missing?

Answer 1

This is indeed a limitation of the Cloud Run sandbox. The gVisor project (which Cloud Run uses) only partially supports setsockopt.

Answer 2

After diving into the Google Cloud Run documentation, the computation must be scoped to a request. My process was performing a background activity at startup/deployment phase, outside the scope of a request. It seems in this specific case the egress traffic is not available.

To fix it we expose an API endpoint triggering the process. This way it works.

As a side note, the issue is not related to the log trace Unsupported syscall setsockopt, since the process is only performing a POST request.