Block 169.254.169.254 from dockerfile on Google CloudRun

Question

I'm exploring any potential solution to prevent my software, which runs on Google Cloud Run and executes untrusted code, from accessing the metadata server.

I considered using iptables for this purpose, but encountered limitations due to the lack of access to the Docker host environment on Cloud Run. Given that iptables operates at the kernel level, which requires access to the host's network stack; a level of control not available in the fully managed Cloud Run environment. I realized this approach is not possible.

I also tried with entrypoint, to apply iptables on start but this is not possible either on Cloud Run.

Am I overlooking anything? Is my understanding accurate? What options do I have?

Answer 1

You can use iptables, but you must use the 2nd generation Cloud Run execution environment, as it provides better Linux compatibility by specifying --execution-environment gen2.

Dockerfile

RUN apt-get update && \
    apt-get install -y iptables && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

Entrypoint.sh (just 80 & 443 so DNS isn't blocked on 53)

iptables -A OUTPUT -d 169.254.169.254 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 169.254.169.254 -p tcp --dport 443 -j DROP

Deployment command

gcloud run deploy ip-filter --image europe-west2-docker.pkg.dev/project-id/dev-images/ip-filter --platform managed --region europe-west2 --allow-unauthenticated --execution-environment gen2

Console Error when requesting http://metadata.google.internal/computeMetadata/v1/

'Connection to metadata.google.internal timed out. (connect timeout=None)'))

Sample Repo: https://github.com/pmgledhill102/cloudrun-firewall-metadata