# LocalCloud supported services and boundaries

> See what runs locally for each of 27 LocalCloud services, including Spanner, BigQuery, and Bigtable: capabilities, API ports, and known limits.
>
> Source: https://local.cloud/compatibility/

Supported services

Build and test Google Cloud applications locally with standard SDKs, real queries, and local execution workflows. Services marked Unsupported don't run locally yet. Select a service for its detailed API guide.

[Browse all 27 guides](https://local.cloud/services/)[Configure services](https://local.cloud/docs/configuration/)

Reviewed against upstream documentation on 2026-10-20.

> **Local development and cloud production boundaries**
>
> LocalCloud runs local versions of Google Cloud services for development and testing. Validate application behavior against real Google Cloud before production deployment. Multi-region infrastructure, physical HSMs, and production SLAs require real Google Cloud. The table highlights local workflows and service-specific boundaries.

Ports are container defaults. Run `localcloud env` for the endpoints published by your running instance. Enable resource-intensive services such as Firestore when needed.

| Service | Local capabilities | Boundaries |
| --- | --- | --- |
| [Firestore](https://local.cloud/services/firestore/) gRPC :5384 | - Document CRUD - Queries and single-field indexes | - Opt-in; include firestore in the exact --services list - Validate composite indexes, concurrent transactions, listeners, transforms, Security Rules, and triggers |
| [Bigtable](https://local.cloud/services/bigtable/) gRPC :5385 | - Instances, clusters, tables, families, app profiles, and schema bundles - Atomic mutations, row filters including Sink, aggregates, and read sessions - Prepared GoogleSQL, logical views, and continuous materialized views - Change streams - Data-bearing backups, copy/restore, and seven-day table undelete - IAM policy storage, cbt, and Console browsing | - Permissive IAM and one change-stream partition; no query statistics, view parameters, or legacy snapshots - Sink bypasses later filters and is invalid inside Condition; HLL++ and multi-column view keys use local encodings - Delete owned backups and clear deletion protection before cleanup; check native API errors and retained project records - Native backup listing supports filter/order/pagination; REST ignores them. Verify durability and row bytes with the native client |
| [Spanner](https://local.cloud/services/spanner/) gRPC :5386 · HTTP/REST :5387 | - GoogleSQL/PostgreSQL queries, UUIDs, and change streams - Full-text/vector search, property graphs, and graph algorithms - Sessions, serializable/repeatable-read transactions, and batch DML - Partitioned queries/reads and batch writes - Instance/database administration, DDL, and long-running operations - Database roles and fine-grained access control - Backup creation, copy, restore, and schedules | - Change streams require streaming SQL - Backups and durable stream recovery require a persistent data directory - Unauthenticated emulator connections bypass network IAM - No CMEK; Google TrueTime and regional infrastructure are cloud-only |
| [AlloyDB](https://local.cloud/services/alloydb/) gRPC :5380 | - Cluster/instance CRUD and local PostgreSQL access - Configuration patching, flag discovery, and backup metadata restore | - Backup restore applies metadata; advanced engine behavior and replicas are unavailable - Managed regional failover requires Google Cloud |
| [Memorystore (Redis/Valkey)](https://local.cloud/services/memorystore/) RESP :5390 | - Valkey RESP, Lua, Pub/Sub, streams, and transactions - Redis instance lifecycle, configuration, version labels, and AUTH retrieval | - Shared server; database numbers do not isolate Pub/Sub channels - No multi-shard topology, managed failover, or project authorization |
| [Cloud SQL](https://local.cloud/services/cloud-sql/) HTTP/REST :5380 · PostgreSQL :5391 · MySQL :5406 | - Instance/database/user lifecycle; PostgreSQL and on-demand MySQL 8.4 - Backup metadata CRUD and instance administration responses - Local server CA discovery and client certificate issuance | - Shared engines; version labels, instance flags, and infrastructure settings do not provision separate servers - Backups are metadata; export/import/restore/restart and replica verbs do no data work. Replace-restore and migration leave Cloud SQL untouched - MySQL requires Docker access; project exports omit MySQL data, non-public PostgreSQL schemas, and passwords - requireSsl/sslMode, revocation, and CA rotation are not enforced; PostgreSQL does not require client certificates |
| [Pub/Sub](https://local.cloud/services/pubsub/) gRPC :5383 | - Topics, subscriptions, push/pull, StreamingPull, and acknowledgements - Attribute filters, dead-letter forwarding, and retries - Retention, snapshots, and timestamp/snapshot seek - Avro/Protobuf schemas, revisions, and JSON/binary validation - Wrapped and unwrapped push payloads with optional metadata headers - Expiration and message-storage policy configuration readback - Authenticated push with locally signed OIDC tokens | - No exactly-once delivery, message ordering, export subscriptions, or transforms - Push receivers must trust the local issuer/JWKS; retry and retention timing is approximate - Expiration and storage policies are metadata; stored IAM does not enforce publish or topic deletion |
| [Cloud Tasks](https://local.cloud/services/cloud-tasks/) gRPC :5380 | - Queue lifecycle, pause/resume, purge, and HTTP target overrides - Task CRUD, BufferTask, and manual/automatic HTTP dispatch - Rate/concurrency limits, deadlines, retries, and attempt history - HTTP delivery with locally issued OAuth/OIDC credentials | - No App Engine dispatch or logging sampling; queue target overrides need exact-image validation - Authenticated receivers must trust the local issuer/JWKS - Restart can redeliver; pause, purge, and delete cannot cancel in-flight requests. Inspect attempts before replaying |
| [Cloud Scheduler](https://local.cloud/services/cloud-scheduler/) gRPC + HTTP/REST :5380 | - Job CRUD, pause/resume, and manual runs - Timezone-aware cron and schedule previews - HTTP/Pub/Sub delivery, retries, deadlines, and attempt history - HTTP delivery with locally issued OAuth/OIDC credentials | - No App Engine targets; authenticated receivers must trust the local issuer and JWKS - No interrupted-attempt replay or downtime backfill - Stored policies do not enforce per-job authorization |
| [Cloud Workflows](https://local.cloud/services/cloud-workflows/) gRPC :5380 | - Workflow deployment and lifecycle - Local interpreter, standard library, and execution step history | - Limited connector and expression support - Active executions fail on restart with InstanceRestart |
| [Cloud Functions (2nd Gen)](https://local.cloud/services/cloud-functions/) gRPC :5380 | - Second-generation function metadata CRUD - HTTP forwarding and Pub/Sub trigger routing | - Requires your own execution target - No source builds or managed function containers - No Firestore/Storage/Audit Log Eventarc triggers or Google identity tokens |
| [GKE](https://local.cloud/services/gke/) gRPC :5380 · k3d :5443 | - Cluster metadata lifecycle - Real local Kubernetes clusters through k3d - Pod ADC through annotated Kubernetes-to-Google service-account bindings | - One k3d server node; requires Docker. No node-pool creation, autoscaling, resize, or upgrades - Use the exported /container/v1 REST endpoint; shared /v1 cluster routes select AlloyDB - Pod identity needs TLS, local identity, the KSA annotation, and workloadIdentityUser; direct principal federation is unavailable |
| [Compute Engine](https://local.cloud/services/compute-engine/) Unsupported HTTP/REST :5380 Stub routes only | - Local VM execution: not available yet - Disks, snapshots, templates, VPCs: use Google Cloud - Local stub routes only |  |
| [Cloud Run](https://local.cloud/services/cloud-run/) gRPC :5380 | - Service/revision metadata - Docker container execution on service create/update | - Requires Docker runtime access - No jobs, domain mappings, or full revision traffic splitting |
| [Vertex AI](https://local.cloud/services/vertex-ai/) Unsupported HTTP/REST :5380 Stub routes only | - Local stubs: deterministic responses only - Inference, embeddings, tokenization: use Google Cloud - Training, tuning, endpoints, batch prediction: use Google Cloud |  |
| [Secret Manager](https://local.cloud/services/secret-manager/) gRPC :5380 | - Secret CRUD - Version add/access/list/enable/disable/destroy - SOFTWARE CMEK encryption and per-secret IAM policy APIs | - No automatic rotation notifications or topic delivery - Authorization varies by transport and IAM mode - Hardware key custody and geographic replication are cloud-only |
| [Cloud IAM](https://local.cloud/services/cloud-iam/) gRPC :5380 | - Allow policies, permission checks, supported conditions, and project inheritance - Custom roles and grantable-role queries - Service-account metadata, key enable/disable, and testable-permission queries - Local access/ID tokens, impersonation, and blob/JWT signing - OIDC workload identity pools, providers, and token exchange | - Enforcement depends on service, transport, and IAM mode; open/permissive mode is not access control - No full CEL, organization/folder ancestry, or deny policies; federation uses local OIDC providers - Tokens use the local issuer/JWKS, without Google authority |
| [Cloud KMS](https://local.cloud/services/cloud-kms/) gRPC + HTTP/REST :5380 | - Locations, random bytes, keys/versions, rotation, destruction/restoration, and eligible deletion - SOFTWARE symmetric/asymmetric cryptography, public keys, and MACs - Supported post-quantum signing/decapsulation and wrapped key imports - Strict IAM, conditions, audits, metrics, and authenticated Workflows connectors - Secret Manager CMEK, project Inventory, and Autokey/KeyHandles | - SOFTWARE keys; hardware custody and Google authority require Google Cloud - Inventory/Autokey covers project-owned global Secret Manager resources; no folder ancestry or other protected types - KeyRing deletion differs from Google Cloud |
| [Cloud Resource Manager](https://local.cloud/services/cloud-resource-manager/) HTTP/REST :5380 | - Project CRUD through v1/v3 APIs; completed operation polling - Project auto-registration on supported entry points outside strict mode | - No organization/folder lifecycle, moves, search, or full ancestry - No project auto-registration on direct emulator listeners |
| [Service Usage](https://local.cloud/services/service-usage/) HTTP/REST :5380 | - Service list/get/enable/batchEnable preflights and completed operation polling | - Reports ENABLED; runtime activation uses LocalCloud service controls - No quota enforcement, billing, or project-specific entitlement |
| [Cloud Billing](https://local.cloud/services/cloud-billing/) HTTP/REST :5380 | - Billing-account and budget metadata CRUD; selected Terraform paths | - No cost accumulation or threshold notifications - No billing exports or budget-triggered automation |
| [Cloud Logging](https://local.cloud/services/cloud-logging/) gRPC :5380 | - Log ingestion, listing, and local filtering - Sink configuration and runtime/KMS audit events - Logs-based metric definition create/get/list/update/delete APIs | - Local filters cover a subset of Google syntax; metric definitions do not derive values - Validate exclusions and sink delivery in Google Cloud |
| [Cloud Monitoring](https://local.cloud/services/cloud-monitoring/) gRPC :5380 | - Time-series writes, filtered reads, and derived metric descriptors - Notification-channel metadata - Alert-policy create/get/list/update/delete APIs | - Aggregation and order\_by are ignored; filters support AND-joined equality on metric/resource type and labels - Validate alert evaluation, notifications, uptime execution, and dashboards in Google Cloud |
| [Cloud Storage](https://local.cloud/services/cloud-storage/) HTTP/REST :5382 | - Bucket CRUD; object upload, download, listing, and deletion - Bucket IAM and mode-aware object authorization - Object event delivery to local Pub/Sub topics - HMAC keys and signed XML requests | - Versioning and archive events await image validation; managed folders are unavailable - Lifecycle, retention, holds, and encryption metadata are stored without enforcement - Notifications require existing topics; ordering and atomic object/event delivery are not guaranteed |
| [BigQuery](https://local.cloud/services/bigquery/) HTTP/REST :5388 · gRPC :5389 | - Datasets, tables, clones, and time travel - Row access policies, top-level policy tags, and masking - Joins, window functions, CTEs, PIVOT/UNPIVOT, and MERGE - Procedural scripts, stored procedures, and dynamic SQL - Jobs, dry runs, scheduled queries, and selected ML models - Materialized views and INFORMATION\_SCHEMA - Emulated GCS: CSV, JSONL, Parquet, Avro, ORC; EXTERNAL\_QUERY - gRPC Storage Read/Write with Avro and Arrow | - SQL, ML, and geography have input-specific limits; ingestion-time pseudocolumn reads and nested policy tags are unavailable - External tables use local GCS; native Bigtable, Sheets, HTTP, and local-file sources are unavailable - Managed reservations, production IAM, and fleet scale require Google Cloud |
| [Dataproc](https://local.cloud/services/dataproc/) gRPC :5380 | - Local cluster lifecycle - Spark/Hadoop execution in cluster and serverless modes | - Requires Docker daemon access - Cloud scaling, automated node repair, and production SLAs are cloud-only |
| [Google Sheets](https://local.cloud/services/google-sheets/) HTTP/REST :5380 | - Exact A1-range reads: values.get and values.batchGet | - Read-only auxiliary fixture API - No spreadsheet metadata, writes, range slicing, or formulas - No Google OAuth authority |

Run the workflows you need

Enable services with `localcloud start --services <name>` or `services.enabled` in `localcloud.yaml`. Dataproc and Cloud Run use Docker execution; GKE uses k3d and Docker.

Validate your application

Use each service guide for detailed operations and setup. Test the queries, authorization rules, and delivery behavior your application relies on, and validate cloud infrastructure guarantees in Google Cloud.