What Tripped Me Up in the Target Runtime

While porting the AI generation flow, beyond verifying values I also got stuck on the runtime environment itself. These were environment-side problems with no counterpart in the porting source. The value-side story is split off into the most dangerous thing in a port is a plausible value.

Renaming the repository made Workload Identity Federation’s attribute condition reject every OIDC token, and CD authentication stopped working entirely. While auth is broken, CD can’t fix itself, so I updated the actual provider out-of-band and brought the code’s declaration in line afterward.

The worker got OOM killed mid-render. It had been running ffmpeg under the default 512 MiB. Retries were also rejected by the terminal-state guard, so runs stayed stuck in running. Raising memory and CPU resolved it.

The path calling Cloud Run directly from another Cloud Run service got blocked with a Google Frontend 404. The callee had an internal-only ingress, but the caller had no VPC egress, so the call wasn’t considered internal. I settled on controlling access with IAM invoker alone.

Here is the blocked structure as a diagram:

Before:
  Cloud Run A（VPC egress なし）
    -> Google Frontend
    -> Cloud Run B（internal only の ingress）
       => internal と見なせず、呼び出しが遮断される

After:
  Cloud Run A
    -> Cloud Run B（ingress の絞り込みを外す）
       => IAM の invoker 権限だけで呼び出しを制御する

We stopped drawing the boundary by network location and moved it into IAM.

The Studio image didn’t contain the ffmpeg, ffprobe, and fonts that the run configuration required. Another image already shipped them pinned by digest, so I placed the same ones there and made the image contract verify that all three files are executable and readable.

Here is what the contract contains:

ffmpeg   : 実行可能 & 読み取り可能
ffprobe  : 実行可能 & 読み取り可能
フォント  : 実行可能 & 読み取り可能

After swapping the image, check it against the listed contract.

Every one of these happened somewhere you’d never reach, no matter how much of the source code you read. Differences in the environment are differences of the port, too.