Recommended GCE service account verification inside a Docker container?

Question

What is the best way to deploy your Google service account credentials inside a CentOS Docker custom container to run in the Google Container Engine or in their vm container? This happens automatically in the google / cloud-sdk container, which launches debian and includes something that I don’t use, for example app-eng / java / php. Ideally, I try to access non-public resources within my project, for example, Google Cloud Storage, without registration and authorization every time a large number of these containers are launched.

For example, on a Centos base container running on GCE with installed code and gcloud / gsutil, at startup:

docker run --rm -ti custom-container gsutil ls 

You will be prompted to run "gsutil config" to get the authorization that I expect.

However, pulling the google / cloud-sdk container into the same GCE and executing the same command, he seems to have skillfully configured credential inheritance (perhaps from host-vm-host credentials?). It seems that he circumvented the launch of "gsutil config" when starting the container in GCE to access private resources.

I want to reproduce this behavior in a minimal Centos container for mass deployment.

Answer 1

Followup

I ended up using the /.config and / .gce directories and the very minimal set of GCE SDK components (without JDK / PHP, etc.). wheezy-cloudtools Dockerfile turned out to be the best example I could find.

Answer 2

Update: as of December 15, 2016, the ability to update areas of an existing virtual machine is now in beta testing; see this SO answer for more details.

---

Old answer:. One approach is to create a virtual machine with the appropriate areas (for example, Google Cloud Storage reads only or read-write), and then all processes on the virtual machine, including containers, will have access to credentials that they can use through OAuth 2.0 ; see docs for Google Cloud Storage and Google Compute Engine .

Please note that as soon as the virtual machine is created with a certain set of areas, they cannot be changed later (neither added nor deleted), so you must set the correct set of areas during the creation of the virtual machine instance.