title: How to authenticate to Cloud Storage from a Docker app on Cloud Run
body: <p>I have a Node.js app in a Docker container that I'm trying to deploy to Google Cloud Run.</p>
  
  <p><strong>I want my app to be able to read/write files from my GCS buckets that live under the same project</strong>, and I haven't been able to find much information around it.</p>
  
  <p>This is what I've tried so far:</p>
  
  <h3>1. Hoping it works out of the box</h3>
  
  <p>A.k.a. initializing without credentials, like in App Engine.</p>
  
  <pre class="lang-js prettyprint-override"><code>const { Storage } = require('@google-cloud/storage');
  
  // ...later in an async function
  
  const storage = new Storage();
  
  // This line throws the exception below
  const [file] = await storage.bucket('mybucket')
    .file('myfile.txt')
    .download()
  </code></pre>
  
  <p>The last line throws this exception</p>
  
  <pre><code>{ Error: Could not refresh access token: Unsuccessful response status code. Request failed with status code 500"
      at Gaxios._request (/server/node_modules/gaxios/build/src/gaxios.js:85:23)
  
  </code></pre>
  
  <h3>2. Hoping it works out of the box after setting the Storage Admin IAM role to my Cloud Run service accounts.</h3>
  
  <p>Nope. No difference with previous.</p>
  
  <h3>3. Copying my credentials file as a <code>cloudbuild.yaml</code> step:</h3>
  
  <pre><code>...
  - name: 'gcr.io/cloud-builders/gsutil'
      args: ['cp', 'gs://top-secret-bucket/gcloud-prod-credentials.json', '/www/gcloud-prod-credentials.json']
  ...
  </code></pre>
  
  <p>It copies the file just fine, but then the file is nor visible from my app. I'm still not sure where exactly it was copied to, but listing the <code>/www</code> directory from my app shows no trace of it.</p>
  
  <h3>4. Copy my credentials file as a Docker step</h3>
  
  <p>Wait, but for that I need to authenticate <code>gsutil</code>, and for that I need the credentials.</p>
  
  <h3>So...</h3>
  
  <p>What options do I have without uploading my credentials file to version control?</p>