Deploy from source (buildpacks, no Dockerfile needed):
```
gcloud run deploy [SERVICE] --source . --region [REGION] --allow-unauthenticated
```
The PORT rule, non-negotiable: your container must listen on the port in the PORT env var (default 8080). If it listens on a hardcoded 3000, you get "Container failed to start. Failed to start and then listen on the port defined by the PORT environment variable." Read PORT at startup, do not hardcode.
Revision model:
- Every deploy creates an immutable revision. Traffic migrates to the newest by default.
- Roll back with `gcloud run services update-traffic [SERVICE] --to-revisions [OLD]=100`.
- `--no-traffic` on deploy lets you test a revision at its URL before shifting traffic.
Knobs that matter:
- --concurrency: requests per instance. Default 80. Lower it for heavy handlers, raise for light ones. Wrong values cause timeouts or waste.
- --min-instances: keeps instances warm. Costs money 24/7. Only set it when measured cold starts hurt users, not speculatively.
- --max-instances: your cost and quota ceiling. Set it; the default can surprise you under load.
- --set-env-vars, --set-secrets: env config. Secrets come from Secret Manager, never baked into the image.
Service account: by default the service runs as the Compute Engine default SA, which is overprivileged. Create a dedicated SA with least privilege and pass --service-account.
Verify: `gcloud run services describe [SERVICE] --region [REGION]` shows the active revision and traffic split; curl the service URL and check logs with `gcloud run services logs read`.