Supported services

LocalCloud supported services and boundaries

Build and test Google Cloud applications locally with standard SDKs, real queries, and local execution workflows. Services marked Unsupported don't run locally yet. Select a service for its detailed API guide.

Browse all 27 guides Configure services

Reviewed against upstream documentation on 2026-10-09.

Ports are container defaults. Run localcloud env for the endpoints published by your running instance. Enable resource-intensive services such as Firestore when needed.

LocalCloud service capabilities, default API ports, and development boundaries
Service	Local capabilities	Boundaries
Firestore gRPC :5384	Document CRUD Queries and single-field indexes	Opt-in: add firestore to localcloud start --services Validate composite indexes, concurrent transactions, listeners, and transforms Security Rules and Firestore triggers need runtime validation
Bigtable gRPC :5385	Instances, clusters, tables, families, app profiles, and schema bundles Atomic mutations, row filters including Sink, aggregates, and read sessions Prepared GoogleSQL, logical views, and continuous materialized views Change streams Data-bearing backups, copy/restore, and seven-day table undelete IAM policy storage, cbt, and Console browsing	Sink preserves cells past later filters; invalid inside a Condition Verify backup listing and project deletion through the native admin API Validate Sink filters, PostgreSQL-backed durability, and cbt scripts in your own test suite Delete owned backups and clear resource deletion protection before instance or project deletion Failed project cleanup keeps the project record; confirm deletion through the native admin API Native backup listing supports filter/order/pagination; REST ignores those options Confirm writes through the native API; the Console view may not surface rejected writes Permissive IAM; one change-stream partition No query statistics, view parameters, or legacy snapshot RPCs Local encodings for HLL++ bytes and multi-column view keys
Spanner gRPC :5386 · HTTP/REST :5387	GoogleSQL/PostgreSQL queries, UUIDs, and change streams Full-text/vector search, property graphs, and graph algorithms Sessions, serializable/repeatable-read transactions, and batch DML Partitioned queries/reads and batch writes Instance/database administration, DDL, and long-running operations Database roles and fine-grained access control Backup creation, copy, restore, and schedules	Change streams require streaming SQL Backups and durable stream recovery require a persistent data directory Unauthenticated emulator connections bypass network IAM No CMEK; Google TrueTime and regional infrastructure are cloud-only
AlloyDB gRPC :5380	Cluster/instance CRUD and local PostgreSQL access Configuration patching, flag discovery, and backup metadata restore	Backup restore covers metadata No advanced AlloyDB engine behavior or replicas Managed regional failover is cloud-only
Memorystore (Redis/Valkey) RESP :5390	Valkey RESP, Lua, Pub/Sub, streams, and transactions Redis instance lifecycle, configuration, version labels, and AUTH retrieval	Shared server; database numbers do not isolate Pub/Sub channels No multi-shard topology, managed failover, or project authorization
Cloud SQL HTTP/REST :5380 · PostgreSQL :5391 · MySQL :5406	Instance/database/user lifecycle; PostgreSQL and on-demand MySQL 8.4 Backup/replica administration, restore/import/export management, and upgrade prechecks Development certificate maintenance APIs	Shared installed engines; version labels do not provision separate versions No per-instance database flags; infrastructure settings are metadata No managed backup recovery or replication guarantees Development certificates for local connections; validate production TLS settings in Google Cloud
Pub/Sub gRPC :5383	Topics, subscriptions, push/pull, StreamingPull, and acknowledgements Attribute filters, dead-letter forwarding, and retries Retention, snapshots, and timestamp/snapshot seek Avro/Protobuf schemas, revisions, and JSON/binary validation Authenticated push with locally signed OIDC tokens	No exactly-once delivery, exports, transforms, or push payload wrappers Push receivers must trust LocalCloud's issuer and JWKS; validate delivery with your application Approximate local retry and retention schedules Stored IAM bindings do not enforce publish or topic deletion
Cloud Tasks gRPC :5380	Queue lifecycle, pause/resume, and purge Task CRUD and manual/automatic HTTP dispatch Rate/concurrency limits, deadlines, retries, and attempt history HTTP delivery with locally issued OAuth/OIDC credentials	No App Engine delivery or routing/header overrides Authenticated receivers must trust LocalCloud's issuer and JWKS No logging sampling Restart may redeliver; pause/purge/delete cannot cancel in-flight requests Check attempt history before replaying ambiguous requests
Cloud Scheduler gRPC + HTTP/REST :5380	Job CRUD, pause/resume, and manual runs Timezone-aware cron and schedule previews HTTP/Pub/Sub delivery, retries, deadlines, and attempt history HTTP delivery with locally issued OAuth/OIDC credentials	No App Engine targets; authenticated receivers must trust the local issuer and JWKS No interrupted-attempt replay or downtime backfill Stored policies do not enforce per-job authorization
Cloud Workflows gRPC :5380	Workflow deployment and lifecycle Local interpreter, standard library, and execution step history	Limited connector and expression support Active executions fail on restart with InstanceRestart
Cloud Functions (2nd Gen) gRPC :5380	Second-generation function metadata CRUD HTTP forwarding and Pub/Sub trigger routing	Requires your own execution target No source builds or managed function containers No Firestore/Storage/Audit Log Eventarc triggers or Google identity tokens
GKE gRPC :5380 · k3d :5443	Cluster metadata lifecycle Real local Kubernetes clusters through k3d Pod ADC through annotated Kubernetes-to-Google service-account bindings	Requires k3d and Docker No node-pool creation, autoscaling, resize, or upgrades GKE REST cluster calls require AlloyDB disabled; gRPC is separate Pod identity requires the service-account annotation and workloadIdentityUser grant; direct principal federation is unsupported
Compute Engine Unsupported HTTP/REST :5380 Stub routes only	Local VM execution: not available yet Disks, snapshots, templates, VPCs: use Google Cloud Local stub routes only
Cloud Run gRPC :5380	Service/revision metadata Docker container execution on service create/update	Requires Docker runtime access No jobs, domain mappings, or full revision traffic splitting
Vertex AI Unsupported HTTP/REST :5380 Stub routes only	Local stubs: deterministic responses only Inference, embeddings, tokenization: use Google Cloud Training, tuning, endpoints, batch prediction: use Google Cloud
Secret Manager gRPC :5380	Secret CRUD Version add/access/list/enable/disable/destroy SOFTWARE CMEK encryption and per-secret IAM policy APIs	No automatic rotation notifications or topic delivery Authorization varies by transport and IAM mode Hardware key custody and geographic replication are cloud-only
Cloud IAM gRPC :5380	Allow policies, permission checks, supported conditions, and project inheritance Custom roles and grantable-role queries Service-account metadata, key enable/disable, and testable-permission queries Local access/ID tokens, impersonation, and blob/JWT signing OIDC workload identity pools, providers, and token exchange	Enforcement varies by service, transport, and IAM mode Open/permissive probes do not establish enforced access No full CEL, organization/folder ancestry, or deny policies Tokens use LocalCloud's issuer; configure receivers to trust its local JWKS Federation uses durable OIDC providers; other enterprise identity integrations require validation
Cloud KMS gRPC + HTTP/REST :5380	Locations, random bytes, keys/versions, rotation, destruction/restoration, and eligible deletion SOFTWARE symmetric/asymmetric cryptography, public keys, and MACs Supported post-quantum signing/decapsulation and wrapped key imports Strict IAM, conditions, audits, metrics, and authenticated Workflows connectors Secret Manager CMEK, project Inventory, and Autokey/KeyHandles	SOFTWARE keys; hardware custody and Google authority are cloud-only Inventory/Autokey: project-owned global Secret Manager resources only No folder ancestry or other protected-resource types KeyRing deletion isn't guaranteed to match Google Cloud
Cloud Resource Manager HTTP/REST :5380	Project CRUD through v1/v3 APIs; completed operation polling Project auto-registration on supported entry points outside strict mode	No organization/folder lifecycle, moves, search, or full ancestry No project auto-registration on direct emulator listeners
Service Usage HTTP/REST :5380	Service list/get/enable/batchEnable preflights and completed operation polling	Reports ENABLED; runtime activation uses LocalCloud service controls No quota enforcement, billing, or project-specific entitlement
Cloud Billing HTTP/REST :5380	Billing-account and budget metadata CRUD; selected Terraform paths	No cost accumulation or threshold notifications No billing exports or budget-triggered automation
Cloud Logging gRPC :5380	Log ingestion, listing, and local filtering Sink configuration and runtime/KMS audit events Logs-based metric definition create/get/list/update/delete APIs	Limited Google filter semantics Metric definitions do not derive values from log entries Validate log-based metrics, exclusions, and sink delivery in Google Cloud
Cloud Monitoring gRPC :5380	Time-series and metric-descriptor create/list APIs Notification-channel metadata Alert-policy create/get/list/update/delete APIs	Limited query alignment/aggregation Validate alert evaluation, notifications, uptime execution, and dashboards in Google Cloud
Cloud Storage HTTP/REST :5382	Bucket CRUD; object upload, download, listing, and deletion Bucket IAM and mode-aware object authorization Object event delivery to local Pub/Sub topics HMAC keys and signed XML requests	No bucket versioning, archive events, or managed folders No lifecycle scheduling or retention enforcement Notifications need precreated Pub/Sub topics No event ordering or atomic object/event delivery guarantees
BigQuery HTTP/REST :5388 · gRPC :5389	Datasets, tables, clones, and time travel Row access policies, top-level policy tags, and masking Joins, window functions, CTEs, PIVOT/UNPIVOT, and MERGE Procedural scripts, stored procedures, and dynamic SQL Jobs, dry runs, scheduled queries, and selected ML models Materialized views and INFORMATION_SCHEMA Emulated GCS: CSV, JSONL, Parquet, Avro, ORC; EXTERNAL_QUERY gRPC Storage Read/Write with Avro and Arrow	Function/input-specific SQL limits; check the feature matrix No ingestion-time partitioning or nested policy tags No native Bigtable, Sheets, HTTP, or local-file external sources Model, ML transform, and geography input limits Managed reservations, production IAM, and fleet scale are cloud-only
Dataproc gRPC :5380	Local cluster lifecycle Spark/Hadoop execution in cluster and serverless modes	Requires Docker daemon access Cloud scaling, automated node repair, and production SLAs are cloud-only
Google Sheets HTTP/REST :5380	Exact A1-range reads: values.get and values.batchGet	Read-only auxiliary fixture API No spreadsheet metadata, writes, range slicing, or formulas No Google OAuth authority

Run the workflows you need

Enable services with localcloud start --services <name> or services.enabled in localcloud.yaml. Dataproc and Cloud Run use Docker execution; GKE uses k3d and Docker.

Validate your application

Use each service guide for detailed operations and setup. Test the queries, authorization rules, and delivery behavior your application relies on, and validate cloud infrastructure guarantees in Google Cloud.