Cloud RunからFilestoreにアクセスしてファイルの書き込みと読み出しを試してみた

export PROJECT_ID="YOUR_PROJECT_ID"
export REGION="asia-northeast1"
export ZONE="asia-northeast1-a"
export NETWORK_NAME="filestore-network"
export SUBNET_NAME="filestore-subnet"
export SUBNET_RANGE="10.0.0.0/24"
export FILESTORE_NAME="nfs-server"
export SHARE_NAME="vol1"
export SERVICE_NAME="filestore-demo"

gcloud services enable file.googleapis.com \
  compute.googleapis.com \
  run.googleapis.com \
  artifactregistry.googleapis.com \
  cloudbuild.googleapis.com \
  --project=${PROJECT_ID}

Operation "operations/acf.p2-YOUR_PROJECT_NUMBER-5e26ee30-4db6-484f-a827-a52b1381e0fe" finished successfully.

PROJECT_NUMBER=$(gcloud projects describe ${PROJECT_ID} \
  --format='value(projectNumber)')

gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/storage.objectAdmin"

gcloud projects add-iam-policy-binding ${PROJECT_ID} \
  --member="serviceAccount:${PROJECT_NUMBER}-compute@developer.gserviceaccount.com" \
  --role="roles/artifactregistry.writer"

# カスタムモードで VPC ネットワークを作成
gcloud compute networks create ${NETWORK_NAME} \
  --subnet-mode=custom \
  --project=${PROJECT_ID}

Created [https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/global/networks/filestore-network].
NAME: filestore-network
SUBNET_MODE: CUSTOM
BGP_ROUTING_MODE: REGIONAL
IPV4_RANGE: 
GATEWAY_IPV4: 
INTERNAL_IPV6_RANGE: 

Instances on this network will not be reachable until firewall rules
are created. As an example, you can allow all internal traffic between
instances as well as SSH, RDP, and ICMP by running:

$ gcloud compute firewall-rules create <FIREWALL_NAME> --network filestore-network --allow tcp,udp,icmp --source-ranges <IP_RANGE>
$ gcloud compute firewall-rules create <FIREWALL_NAME> --network filestore-network --allow tcp:22,tcp:3389,icmp

# サブネットを作成
gcloud compute networks subnets create ${SUBNET_NAME} \
  --network=${NETWORK_NAME} \
  --range=${SUBNET_RANGE} \
  --region=${REGION} \
  --project=${PROJECT_ID}

Created [https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/regions/asia-northeast1/subnetworks/filestore-subnet].
NAME: filestore-subnet
REGION: asia-northeast1
NETWORK: filestore-network
RANGE: 10.0.0.0/24
STACK_TYPE: IPV4_ONLY
IPV6_ACCESS_TYPE: 
INTERNAL_IPV6_PREFIX: 
EXTERNAL_IPV6_PREFIX:

cat > nfs-export-options.json << EOF
{
  "--file-share": {
    "capacity": "1024",
    "name": "${SHARE_NAME}",
    "nfs-export-options": [
      {
        "access-mode": "READ_WRITE",
        "ip-ranges": ["${SUBNET_RANGE}"],
        "squash-mode": "NO_ROOT_SQUASH"
      }
    ]
  }
}
EOF

gcloud filestore instances create ${FILESTORE_NAME} \
  --zone=${ZONE} \
  --tier=BASIC_HDD \
  --network=name="${NETWORK_NAME}" \
  --flags-file=nfs-export-options.json \
  --project=${PROJECT_ID}

Waiting for [operation-1787005386693-659459d491ac6-3d01d785-082adc46] to finish...done.

gcloud filestore instances describe ${FILESTORE_NAME} \
  --zone=${ZONE} \
  --project=${PROJECT_ID}

createTime: '2026-08-17T22:23:18.308203565Z'
fileShares:
- capacityGb: '1024'
  name: vol1
  nfsExportOptions:
  - accessMode: READ_WRITE
    ipRanges:
    - 10.0.0.0/24
    squashMode: NO_ROOT_SQUASH
name: projects/YOUR_PROJECT_ID/locations/asia-northeast1-a/instances/nfs-server
networks:
- connectMode: DIRECT_PEERING
  ipAddresses:
  - 10.169.154.82
  modes:
  - MODE_IPV4
  network: filestore-network
  reservedIpRange: 10.169.154.80/29
performanceLimits:
  maxIops: '600'
  maxReadIops: '600'
  maxReadThroughputBps: '104857600'
  maxWriteIops: '1000'
  maxWriteThroughputBps: '104857600'
protocol: NFS_V3
satisfiesPzi: true
satisfiesPzs: false
state: READY
tier: BASIC_HDD

export FILESTORE_IP=$(gcloud filestore instances describe ${FILESTORE_NAME} \
  --zone=${ZONE} \
  --project=${PROJECT_ID} \
  --format='value(networks[0].ipAddresses[0])')

echo ${FILESTORE_IP}

10.169.154.82

# 内部向け egress をデフォルトで拒否するルール（優先度 1000）
gcloud compute firewall-rules create deny-internal-egress \
  --network=${NETWORK_NAME} \
  --direction=EGRESS \
  --action=DENY \
  --rules=all \
  --destination-ranges=10.0.0.0/8 \
  --priority=1000 \
  --project=${PROJECT_ID}

Creating firewall...working..Created [https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/global/firewalls/deny-internal-egress].                                           
Creating firewall...done.                                                                                                                                                                     
NAME: deny-internal-egress
NETWORK: filestore-network
DIRECTION: EGRESS
PRIORITY: 1000
ALLOW: 
DENY: all
DISABLED: False

# Filestore への NFS 通信のみを許可するルール（優先度 900）
gcloud compute firewall-rules create allow-nfs-to-filestore \
  --network=${NETWORK_NAME} \
  --direction=EGRESS \
  --action=ALLOW \
  --rules=tcp:111,tcp:2046,tcp:2049,tcp:2050,tcp:4045 \
  --destination-ranges=${FILESTORE_IP}/32 \
  --priority=900 \
  --project=${PROJECT_ID}

Creating firewall...working..Created [https://www.googleapis.com/compute/v1/projects/YOUR_PROJECT_ID/global/firewalls/allow-nfs-to-filestore].                                         
Creating firewall...done.                                                                                                                                                                     
NAME: allow-nfs-to-filestore
NETWORK: filestore-network
DIRECTION: EGRESS
PRIORITY: 900
ALLOW: tcp:111,tcp:2046,tcp:2049,tcp:2050,tcp:4045
DENY: 
DISABLED: False

mkdir filestore-app
cd filestore-app

import os
import datetime
from flask import Flask, jsonify

app = Flask(__name__)
NFS_MOUNT_PATH = "/mnt/nfs"

@app.route("/")
def index():
    nfs_exists = os.path.isdir(NFS_MOUNT_PATH)
    return jsonify({
        "status": "ok",
        "nfs_mounted": nfs_exists,
        "endpoints": ["/write", "/read", "/files"]
    })

@app.route("/write")
def write_file():
    file_path = os.path.join(NFS_MOUNT_PATH, "test.txt")
    timestamp = datetime.datetime.now().isoformat()
    with open(file_path, "w") as f:
        f.write(f"Hello from Cloud Run! Written at {timestamp}")
    return jsonify({"message": "File written", "path": file_path, "timestamp": timestamp})

@app.route("/read")
def read_file():
    file_path = os.path.join(NFS_MOUNT_PATH, "test.txt")
    if not os.path.exists(file_path):
        return jsonify({"error": "File not found. Call /write first."}), 404
    with open(file_path, "r") as f:
        content = f.read()
    return jsonify({"content": content, "path": file_path})

@app.route("/files")
def list_files():
    if not os.path.isdir(NFS_MOUNT_PATH):
        return jsonify({"error": "NFS mount not found"}), 500
    files = os.listdir(NFS_MOUNT_PATH)
    return jsonify({"files": files, "count": len(files)})

if __name__ == "__main__":
    app.run(host="0.0.0.0", port=int(os.environ.get("PORT", 8080)))

flask==3.1.*
gunicorn==23.*

FROM python:3.13-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY main.py .

USER root
EXPOSE 8080
CMD ["gunicorn", "--bind", "0.0.0.0:8080", "main:app"]

gcloud run deploy ${SERVICE_NAME} \
  --source=. \
  --network=${NETWORK_NAME} \
  --subnet=${SUBNET_NAME} \
  --vpc-egress=private-ranges-only \
  --add-volume=mount-path=/mnt/nfs,type=nfs,location=${FILESTORE_IP}:/${SHARE_NAME},readonly=false \
  --region=${REGION} \
  --allow-unauthenticated \
  --project=${PROJECT_ID}

Building using Dockerfile and deploying container to Cloud Run service [filestore-demo] in project [YOUR_PROJECT_ID] region [asia-northeast1]
Building and deploying new service...                                                                                                                                                         
  Validating configuration...done                                                                                                                                                             
  Uploading sources...done                                                                                                                                                                    
  Building Container... Logs are available at [ https://console.cloud.google.com/cloud-build/builds;region=asia-northeast1/3c27a672-ea40-442f-aa08-fcac209239ec?project=YOUR_PROJECT_NUMBER ]....done
  Setting IAM Policy...warning                                                                                                                                                                
  Creating Revision...done                                                                                                                                                                    
  Routing traffic...done                                                                                                                                                                      
Completed with warnings:                                                                                                                                                                      
  Setting IAM policy failed, try "gcloud beta run services add-iam-policy-binding --region=asia-northeast1 --member=allUsers --role=roles/run.invoker filestore-demo"
Service [filestore-demo] revision [filestore-demo-00001-hjr] has been deployed and is serving 100 percent of traffic.
Service URL: https://filestore-demo-YOUR_PROJECT_NUMBER.asia-northeast1.run.app

gcloud run services describe ${SERVICE_NAME} \
  --region=${REGION} \
  --project=${PROJECT_ID}

✔ Service filestore-demo in region asia-northeast1
 
URL:     https://filestore-demo-YOUR_PROJECT_NUMBER.asia-northeast1.run.app
Ingress: all
Traffic:
  100% LATEST (currently filestore-demo-00001-hjr)
 
Scaling:          Auto (Min: 0, Max: 10)
Threat Detection: Enabled
 
Last updated on 2026-08-17T22:38:21.946935Z by xxxxxxxx@example.com:
  Revision filestore-demo-00001-hjr
  Container None
    Image:           asia-northeast1-docker.pkg.dev/YOUR_PROJECT_ID/cloud-run-source-deploy/filestore-demo@sha256:971078c0ca48fc66da5263a5503de28eca8fc20fa5c4544b2ed4420237e7d05d
    Port:            8080
    Memory:          512Mi
    CPU:             1000m
    Volume Mounts:
      /mnt/nfs
        name:        nfs-der-rut
        type:        nfs
        location:    10.169.154.82:/vol1
    Startup Probe:
      TCP every 240s
      Port:          8080
      Initial delay: 0s
      Timeout:       240s
      Failure threshold: 1
      Type:          Default
  Service account:   YOUR_PROJECT_NUMBER-compute@developer.gserviceaccount.com
  Concurrency:       80
  Timeout:           300s
  VPC access:
    Network:         filestore-network
    Subnet:          filestore-subnet
    Egress:          private-ranges-only
  Volumes:
    nfs-der-rut
      type:          nfs
      location:      10.169.154.82:/vol1

# サービスの URL を取得
SERVICE_URL=$(gcloud run services describe ${SERVICE_NAME} \
  --region=${REGION} \
  --format='value(status.url)' \
  --project=${PROJECT_ID})

# NFS マウントの状態を確認
curl -s ${SERVICE_URL}/ | jq .

{
  "endpoints": [
    "/write",
    "/read",
    "/files"
  ],
  "nfs_mounted": true,
  "status": "ok"
}

# ファイルの書き込み
curl -s ${SERVICE_URL}/write | jq .

{
  "message": "File written",
  "path": "/mnt/nfs/test.txt",
  "timestamp": "2026-08-17T22:48:20.688232"
}

# ファイルの読み込み
curl -s ${SERVICE_URL}/read | jq .

{
  "content": "Hello from Cloud Run! Written at 2026-08-17T22:48:20.688232",
  "path": "/mnt/nfs/test.txt"
}

# ファイル一覧の確認
curl -s ${SERVICE_URL}/files | jq .

{
  "count": 2,
  "files": [
    "test.txt",
    "lost+found"
  ]
}