skip to Main Content

A couple of days ago my Google Cloud APIs started to return 403 error.

rpc error: code = PermissionDenied desc = unexpected HTTP status code received from server: 403 (Forbidden); transport: received unexpected content-type "text/html; charset=UTF-8"

I use Logging API and Vertex API with official Go clients.

The wired part is when I run it without Docker on the same server it works fine. Also when I run it on other server in Docker it also works fine.
I don’t know whats the problem in my current server.

I created minimal program to reproduce the bug:

package main

import (
    "context"
    "fmt"
    "log"
    "os"

    "cloud.google.com/go/logging"
)

func main() {
    projectID := os.Getenv("GOOGLE_LOGGING_PROJECT_ID")
    logName := os.Getenv("GOOGLE_LOGGING_LOG_NAME")

    ctx := context.Background()

    client, err := logging.NewClient(ctx, projectID)
    if err != nil {
        log.Fatalf("Failed to create client: %v", err)
    }

    logInfo := client.Logger(logName)

    err = logInfo.LogSync(ctx, logging.Entry{
        Payload: "This is a test log message",
    })
    if err != nil {
        log.Fatalf("Failed to log message: %v", err)
    }

    fmt.Println("Logged message to Google Cloud Logging")

}

and with sh file works fine:

#!/bin/sh

export GOOGLE_APPLICATION_CREDENTIALS=google-credentials.json
export GOOGLE_LOGGING_PROJECT_ID=summ-435417
export GOOGLE_LOGGING_LOG_NAME=main
./gce_log_test

but in Docker not

version: "3.8"
services:
  gce-test:
    image: golang:alpine
    container_name: gce-test
    environment:
      - GOOGLE_APPLICATION_CREDENTIALS=/home/app/google-credentials.json
      - GOOGLE_LOGGING_PROJECT_ID=summ-435417
      - GOOGLE_LOGGING_LOG_NAME=main
    volumes:
      - /home/summ/gce-test:/home/app
    working_dir: /home/app
    command: ["./gce_log_test"]

2

Answers



  1. Maybe your 403 error in docker could be due to incorrect permissions for your service account or issues with the environment variables not being set correctly. Try to double check that the service account has the ‘Logging Writer’ role and that the credentials file is properly mounted inside your docker container.

    Login or Signup to reply.
Please signup or login to give your own answer.
Back To Top
Search