A non-root Cloud Run container starts but cannot read its mounted secret file

Also check whether access to the secret version changed after deployment. A runtime read can fail for platform access reasons even when the file path itself is correct.

Check the configured mount path, the application’s expected file path and access under the container’s actual user. Google’s documentation describes ownership differences across Cloud Run execution environments and deployment arrangements. Service-account permission and in-container file access are related but distinct checks.

A mounted secret can fail when the application reads it during runtime. That is different from environment-secret retrieval before instance startup. Capture the exact failure category without logging contents. Validate the fix with the same container user and deployment arrangement rather than testing only as root in a local shell.