# LocalCloud capabilities and boundaries for agents What each service runs locally and where its local behavior stops. Check the boundaries before relying on a local result, and follow the rules in https://local.cloud/ai/agents.md. The same lists appear on each service page and on https://local.cloud/compatibility/. ## Firestore Guide: https://local.cloud/services/firestore/ Runs locally: - Document CRUD - Queries and single-field indexes Boundaries: - Opt-in: add firestore to localcloud start --services - Validate composite indexes, concurrent transactions, listeners, and transforms - Security Rules and Firestore triggers need runtime validation ## Bigtable Guide: https://local.cloud/services/bigtable/ Runs locally: - Instances, clusters, tables, families, app profiles, and schema bundles - Atomic mutations, row filters including Sink, aggregates, and read sessions - Prepared GoogleSQL, logical views, and continuous materialized views - Change streams - Data-bearing backups, copy/restore, and seven-day table undelete - IAM policy storage, cbt, and Console browsing Boundaries: - Sink preserves cells past later filters; invalid inside a Condition - Verify backup listing and project deletion through the native admin API - Validate Sink filters, PostgreSQL-backed durability, and cbt scripts in your own test suite - Delete owned backups and clear resource deletion protection before instance or project deletion - Failed project cleanup keeps the project record; confirm deletion through the native admin API - Native backup listing supports filter/order/pagination; REST ignores those options - Confirm writes through the native API; the Console view may not surface rejected writes - Permissive IAM; one change-stream partition - No query statistics, view parameters, or legacy snapshot RPCs - Local encodings for HLL++ bytes and multi-column view keys ## Spanner Guide: https://local.cloud/services/spanner/ Runs locally: - GoogleSQL/PostgreSQL queries, UUIDs, and change streams - Full-text/vector search, property graphs, and graph algorithms - Sessions, serializable/repeatable-read transactions, and batch DML - Partitioned queries/reads and batch writes - Instance/database administration, DDL, and long-running operations - Database roles and fine-grained access control - Backup creation, copy, restore, and schedules Boundaries: - Change streams require streaming SQL - Backups and durable stream recovery require a persistent data directory - Unauthenticated emulator connections bypass network IAM - No CMEK; Google TrueTime and regional infrastructure are cloud-only ## AlloyDB Guide: https://local.cloud/services/alloydb/ Runs locally: - Cluster/instance CRUD and local PostgreSQL access - Configuration patching, flag discovery, and backup metadata restore Boundaries: - Backup restore covers metadata - No advanced AlloyDB engine behavior or replicas - Managed regional failover is cloud-only ## Memorystore (Redis/Valkey) Guide: https://local.cloud/services/memorystore/ Runs locally: - Valkey RESP, Lua, Pub/Sub, streams, and transactions - Redis instance lifecycle, configuration, version labels, and AUTH retrieval Boundaries: - Shared server; database numbers do not isolate Pub/Sub channels - No multi-shard topology, managed failover, or project authorization ## Cloud SQL Guide: https://local.cloud/services/cloud-sql/ Runs locally: - Instance/database/user lifecycle; PostgreSQL and on-demand MySQL 8.4 - Backup/replica administration, restore/import/export management, and upgrade prechecks - Development certificate maintenance APIs Boundaries: - Shared installed engines; version labels do not provision separate versions - No per-instance database flags; infrastructure settings are metadata - No managed backup recovery or replication guarantees - Development certificates for local connections; validate production TLS settings in Google Cloud ## Pub/Sub Guide: https://local.cloud/services/pubsub/ Runs locally: - Topics, subscriptions, push/pull, StreamingPull, and acknowledgements - Attribute filters, dead-letter forwarding, and retries - Retention, snapshots, and timestamp/snapshot seek - Avro/Protobuf schemas, revisions, and JSON/binary validation - Authenticated push with locally signed OIDC tokens Boundaries: - No exactly-once delivery, exports, transforms, or push payload wrappers - Push receivers must trust LocalCloud's issuer and JWKS; validate delivery with your application - Approximate local retry and retention schedules - Stored IAM bindings do not enforce publish or topic deletion ## Cloud Tasks Guide: https://local.cloud/services/cloud-tasks/ Runs locally: - Queue lifecycle, pause/resume, and purge - Task CRUD and manual/automatic HTTP dispatch - Rate/concurrency limits, deadlines, retries, and attempt history - HTTP delivery with locally issued OAuth/OIDC credentials Boundaries: - No App Engine delivery or routing/header overrides - Authenticated receivers must trust LocalCloud's issuer and JWKS - No logging sampling - Restart may redeliver; pause/purge/delete cannot cancel in-flight requests - Check attempt history before replaying ambiguous requests ## Cloud Scheduler Guide: https://local.cloud/services/cloud-scheduler/ Runs locally: - Job CRUD, pause/resume, and manual runs - Timezone-aware cron and schedule previews - HTTP/Pub/Sub delivery, retries, deadlines, and attempt history - HTTP delivery with locally issued OAuth/OIDC credentials Boundaries: - No App Engine targets; authenticated receivers must trust the local issuer and JWKS - No interrupted-attempt replay or downtime backfill - Stored policies do not enforce per-job authorization ## Cloud Workflows Guide: https://local.cloud/services/cloud-workflows/ Runs locally: - Workflow deployment and lifecycle - Local interpreter, standard library, and execution step history Boundaries: - Limited connector and expression support - Active executions fail on restart with InstanceRestart ## Cloud Functions (2nd Gen) Guide: https://local.cloud/services/cloud-functions/ Runs locally: - Second-generation function metadata CRUD - HTTP forwarding and Pub/Sub trigger routing Boundaries: - Requires your own execution target - No source builds or managed function containers - No Firestore/Storage/Audit Log Eventarc triggers or Google identity tokens ## GKE Guide: https://local.cloud/services/gke/ Runs locally: - Cluster metadata lifecycle - Real local Kubernetes clusters through k3d - Pod ADC through annotated Kubernetes-to-Google service-account bindings Boundaries: - Requires k3d and Docker - No node-pool creation, autoscaling, resize, or upgrades - GKE REST cluster calls require AlloyDB disabled; gRPC is separate - Pod identity requires the service-account annotation and workloadIdentityUser grant; direct principal federation is unsupported ## Compute Engine Unsupported locally; use Google Cloud. Guide: https://local.cloud/services/compute-engine/ ## Cloud Run Guide: https://local.cloud/services/cloud-run/ Runs locally: - Service/revision metadata - Docker container execution on service create/update Boundaries: - Requires Docker runtime access - No jobs, domain mappings, or full revision traffic splitting ## Vertex AI Unsupported locally; use Google Cloud. Guide: https://local.cloud/services/vertex-ai/ ## Secret Manager Guide: https://local.cloud/services/secret-manager/ Runs locally: - Secret CRUD - Version add/access/list/enable/disable/destroy - SOFTWARE CMEK encryption and per-secret IAM policy APIs Boundaries: - No automatic rotation notifications or topic delivery - Authorization varies by transport and IAM mode - Hardware key custody and geographic replication are cloud-only ## Cloud IAM Guide: https://local.cloud/services/cloud-iam/ Runs locally: - Allow policies, permission checks, supported conditions, and project inheritance - Custom roles and grantable-role queries - Service-account metadata, key enable/disable, and testable-permission queries - Local access/ID tokens, impersonation, and blob/JWT signing - OIDC workload identity pools, providers, and token exchange Boundaries: - Enforcement varies by service, transport, and IAM mode - Open/permissive probes do not establish enforced access - No full CEL, organization/folder ancestry, or deny policies - Tokens use LocalCloud's issuer; configure receivers to trust its local JWKS - Federation uses durable OIDC providers; other enterprise identity integrations require validation ## Cloud KMS Guide: https://local.cloud/services/cloud-kms/ Runs locally: - Locations, random bytes, keys/versions, rotation, destruction/restoration, and eligible deletion - SOFTWARE symmetric/asymmetric cryptography, public keys, and MACs - Supported post-quantum signing/decapsulation and wrapped key imports - Strict IAM, conditions, audits, metrics, and authenticated Workflows connectors - Secret Manager CMEK, project Inventory, and Autokey/KeyHandles Boundaries: - SOFTWARE keys; hardware custody and Google authority are cloud-only - Inventory/Autokey: project-owned global Secret Manager resources only - No folder ancestry or other protected-resource types - KeyRing deletion isn't guaranteed to match Google Cloud ## Cloud Resource Manager Guide: https://local.cloud/services/cloud-resource-manager/ Runs locally: - Project CRUD through v1/v3 APIs; completed operation polling - Project auto-registration on supported entry points outside strict mode Boundaries: - No organization/folder lifecycle, moves, search, or full ancestry - No project auto-registration on direct emulator listeners ## Service Usage Guide: https://local.cloud/services/service-usage/ Runs locally: - Service list/get/enable/batchEnable preflights and completed operation polling Boundaries: - Reports ENABLED; runtime activation uses LocalCloud service controls - No quota enforcement, billing, or project-specific entitlement ## Cloud Billing Guide: https://local.cloud/services/cloud-billing/ Runs locally: - Billing-account and budget metadata CRUD; selected Terraform paths Boundaries: - No cost accumulation or threshold notifications - No billing exports or budget-triggered automation ## Cloud Logging Guide: https://local.cloud/services/cloud-logging/ Runs locally: - Log ingestion, listing, and local filtering - Sink configuration and runtime/KMS audit events - Logs-based metric definition create/get/list/update/delete APIs Boundaries: - Limited Google filter semantics - Metric definitions do not derive values from log entries - Validate log-based metrics, exclusions, and sink delivery in Google Cloud ## Cloud Monitoring Guide: https://local.cloud/services/cloud-monitoring/ Runs locally: - Time-series and metric-descriptor create/list APIs - Notification-channel metadata - Alert-policy create/get/list/update/delete APIs Boundaries: - Limited query alignment/aggregation - Validate alert evaluation, notifications, uptime execution, and dashboards in Google Cloud ## Cloud Storage Guide: https://local.cloud/services/cloud-storage/ Runs locally: - Bucket CRUD; object upload, download, listing, and deletion - Bucket IAM and mode-aware object authorization - Object event delivery to local Pub/Sub topics - HMAC keys and signed XML requests Boundaries: - No bucket versioning, archive events, or managed folders - No lifecycle scheduling or retention enforcement - Notifications need precreated Pub/Sub topics - No event ordering or atomic object/event delivery guarantees ## BigQuery Guide: https://local.cloud/services/bigquery/ Runs locally: - Datasets, tables, clones, and time travel - Row access policies, top-level policy tags, and masking - Joins, window functions, CTEs, PIVOT/UNPIVOT, and MERGE - Procedural scripts, stored procedures, and dynamic SQL - Jobs, dry runs, scheduled queries, and selected ML models - Materialized views and INFORMATION_SCHEMA - Emulated GCS: CSV, JSONL, Parquet, Avro, ORC; EXTERNAL_QUERY - gRPC Storage Read/Write with Avro and Arrow Boundaries: - Function/input-specific SQL limits; check the feature matrix - No ingestion-time partitioning or nested policy tags - No native Bigtable, Sheets, HTTP, or local-file external sources - Model, ML transform, and geography input limits - Managed reservations, production IAM, and fleet scale are cloud-only ## Dataproc Guide: https://local.cloud/services/dataproc/ Runs locally: - Local cluster lifecycle - Spark/Hadoop execution in cluster and serverless modes Boundaries: - Requires Docker daemon access - Cloud scaling, automated node repair, and production SLAs are cloud-only ## Google Sheets Guide: https://local.cloud/services/google-sheets/ Runs locally: - Exact A1-range reads: values.get and values.batchGet Boundaries: - Read-only auxiliary fixture API - No spreadsheet metadata, writes, range slicing, or formulas - No Google OAuth authority