Changedetection on Google Cloud Run

changedetection.io is a self-hosted, open-source service that monitors web pages for changes and sends notifications when they occur. This module deploys changedetection.io on Cloud Run v2 on top of the App_CloudRun foundation, which provisions and manages the shared Google Cloud infrastructure.

This guide focuses on the cloud services changedetection.io uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics common to every Cloud Run application — service identity, ingress and load balancing, scaling and concurrency, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_CloudRun foundation guide rather than repeating them here.

1. Overview

changedetection.io runs as a single Python/Flask container on Cloud Run v2. The deployment wires together a deliberately small set of Google Cloud services — there is no database and no cache:

Capability	Google Cloud service	Notes
Compute	Cloud Run v2	Python/Flask service, 1 vCPU / 1 GiB by default, listens on port 5000
Database	None	`database_type = NONE` — changedetection.io stores all state on disk, not in SQL
Persistent datastore	Cloud Storage (GCS FUSE)	One data bucket mounted at `/datastore` holding watch config, snapshots, and history
Cache & queue	None	Redis is not used; explicitly disabled
Secrets	Secret Manager	No app secret is injected; the REST API token is created in the web UI
Ingress	Cloud Run URL / Cloud Load Balancing	Default `run.app` URL; optional external HTTPS load balancer + custom domain

Sensible defaults worth knowing up front:

No database, no Redis. changedetection.io is entirely self-contained. There is no Cloud SQL instance, no db-init job, and no schema migration step. Redis is disabled (enable_redis = false) and enable_cloudsql_volume = false.
All state lives in one GCS bucket. The datastore bucket is mounted at /datastore via GCS FUSE (enable_gcs_storage_volume = true, requires the gen2 execution environment). Deleting or recreating this bucket loses every watch and its history.
Single instance by default. min_instance_count = 1 and max_instance_count = 1. changedetection.io runs its fetch scheduler in-process against a single on-disk datastore; running more than one instance against the same FUSE-mounted datastore risks concurrent-write corruption. Keep max_instance_count = 1.
min_instance_count = 1 (no scale-to-zero). The single instance is kept warm so the fetch scheduler continues to run watch checks even with no inbound web traffic.
Public ingress by default. ingress_settings = "all" so the web dashboard is reachable from a browser. The UI ships with no login — set a password in Settings → General immediately, and/or enable IAP.
BASE_URL is injected automatically. The predicted Cloud Run service URL is injected under BASE_URL (service_url_env_var_name = "BASE_URL") so notification links resolve to the real service address.
Version pinning. With application_version = "latest" the image build pins a known-good tag (0.50.19) via the app-specific CHANGEDETECTION_VERSION build arg.

2. Google Cloud Services & How to Explore Them

All commands assume PROJECT and REGION are set. Service and resource names are reported in the deployment Outputs.

A. Cloud Run — the changedetection.io service

changedetection.io runs as a Cloud Run v2 service listening on port 5000. Each deployment creates an immutable revision; traffic can be split across revisions for safe rollouts. Because the fetch scheduler runs in-process, the service is normally pinned to a single always-warm instance.

Console: Cloud Run → select the service for revisions, traffic, logs, and metrics.

CLI:

gcloud run services list --project "$PROJECT" --region "$REGION"
gcloud run services describe <service-name> --project "$PROJECT" --region "$REGION"
gcloud run revisions list --service <service-name> --project "$PROJECT" --region "$REGION"

See App_CloudRun for scaling, concurrency, execution environment, and traffic splitting.

B. Database — not used

changedetection.io uses no SQL database. database_type = NONE is fixed by Changedetection_Common; no Cloud SQL instance is created and there is no db-init initialization job. All persistent state lives in the GCS datastore bucket described below.

C. Cloud Storage — the datastore

A single Cloud Storage bucket is provisioned automatically and mounted at /datastore as a GCS FUSE volume (DATASTORE_PATH = /datastore). It holds the watch configuration JSON, page snapshots, and change history — everything the app persists.

Console: Cloud Storage → Buckets.

CLI:

gcloud storage buckets list --project "$PROJECT" --filter="name~storage"
gcloud storage ls gs://<data-bucket>/          # bucket name is in the Outputs
gcloud storage ls gs://<data-bucket>/url-watches.json

GCS FUSE requires the gen2 execution environment (the default). See App_CloudRun for GCS FUSE and CMEK options.

D. Cache & queue — not used

changedetection.io does not use Redis or any external queue; its watch scheduler is in-process. enable_redis = false is set explicitly and no Redis inputs are wired.

E. Secret Manager

No application secret is injected into the container — the optional REST API token is generated inside the web UI (Settings → API), and the datastore uses no encryption key. Secret Manager is still available for any operator-supplied secret_environment_variables.

Console: Security → Secret Manager.

CLI:

gcloud secrets list --project "$PROJECT"
gcloud secrets versions access latest --secret=<secret-name> --project "$PROJECT"

See App_CloudRun for injection and rotation details.

F. Networking & ingress

The service is reachable at its run.app URL by default (ingress_settings = "all"), which allows public browser access to the dashboard. An external HTTPS load balancer with a custom domain, Cloud CDN, and Cloud Armor can be layered on; ingress settings and VPC egress control connectivity.

Console: Cloud Run (service URL); Network services → Load balancing.

CLI:

gcloud run services describe <service-name> --region "$REGION" --format='value(status.url)'
gcloud compute addresses list --project "$PROJECT"

See App_CloudRun.

G. Cloud Logging & Monitoring

Container logs flow to Cloud Logging; Cloud Run metrics flow to Cloud Monitoring, with optional uptime checks and alert policies.

Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.

CLI:

gcloud run services logs read <service-name> --project "$PROJECT" --region "$REGION" --limit 50

3. changedetection.io Application Behaviour

No first-deploy database setup. There is no database and no init job. On first boot changedetection.io creates its datastore files (url-watches.json and per-watch history directories) under /datastore if they do not already exist.
No schema migrations. Datastore format upgrades are handled internally by the application on start; there is no separate migration step to run.
The datastore is the only stateful asset. Everything the app remembers — watches, snapshots, diff history, notification config, and any UI password — lives in the GCS datastore bucket. Protect it accordingly; recreating the bucket wipes all state.
No login by default. The dashboard ships open. Set a password under Settings → General → Password immediately after first access, and/or enable IAP in front of the service. There is no default admin account or credential.
REST API token is created in the UI. To use the REST API, generate a token under Settings → API and pass it as the x-api-key header. It is not injected via an environment variable.
BASE_URL for notification links. The predicted service URL is injected under BASE_URL so notification bodies contain working absolute links. Verify it matches the real service URL after deploy:
```
gcloud run services describe <service-name> \
  --region "$REGION" --project "$PROJECT" --format='value(status.url)'
```
Health path. Startup and liveness probes target / — the web UI, which returns HTTP 200 once the Flask server is ready. First boot is fast (no migrations); the default startup probe allows a 15-second initial delay plus a 10-retry window.
Scaling constraint. Keep max_instance_count = 1. Multiple instances share the same FUSE-mounted datastore and would race on writes; the app has no distributed coordination.

Inspect the running environment:

gcloud run services describe <service-name> --region "$REGION" \
  --format='value(spec.template.spec.containers[0].env)'

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for changedetection.io are listed; every other input is inherited from App_CloudRun with its standard behaviour.