Supported services

LocalCloud supported services and boundaries

Build and test Google Cloud applications locally with standard SDKs, real queries, and local execution workflows. Services marked Unsupported don't run locally yet. Select a service for its detailed API guide.

Browse all 27 guides Configure services

Reviewed against upstream documentation on 2026-10-20.

Ports are container defaults. Run localcloud env for the endpoints published by your running instance. Enable resource-intensive services such as Firestore when needed.

LocalCloud service capabilities, default API ports, and development boundaries
Service	Local capabilities	Boundaries
Firestore gRPC :5384	Document CRUD Queries and single-field indexes	Opt-in; include firestore in the exact --services list Validate composite indexes, concurrent transactions, listeners, transforms, Security Rules, and triggers
Bigtable gRPC :5385	Instances, clusters, tables, families, app profiles, and schema bundles Atomic mutations, row filters including Sink, aggregates, and read sessions Prepared GoogleSQL, logical views, and continuous materialized views Change streams Data-bearing backups, copy/restore, and seven-day table undelete IAM policy storage, cbt, and Console browsing	Permissive IAM and one change-stream partition; no query statistics, view parameters, or legacy snapshots Sink bypasses later filters and is invalid inside Condition; HLL++ and multi-column view keys use local encodings Delete owned backups and clear deletion protection before cleanup; check native API errors and retained project records Native backup listing supports filter/order/pagination; REST ignores them. Verify durability and row bytes with the native client
Spanner gRPC :5386 · HTTP/REST :5387	GoogleSQL/PostgreSQL queries, UUIDs, and change streams Full-text/vector search, property graphs, and graph algorithms Sessions, serializable/repeatable-read transactions, and batch DML Partitioned queries/reads and batch writes Instance/database administration, DDL, and long-running operations Database roles and fine-grained access control Backup creation, copy, restore, and schedules	Change streams require streaming SQL Backups and durable stream recovery require a persistent data directory Unauthenticated emulator connections bypass network IAM No CMEK; Google TrueTime and regional infrastructure are cloud-only
AlloyDB gRPC :5380	Cluster/instance CRUD and local PostgreSQL access Configuration patching, flag discovery, and backup metadata restore	Backup restore applies metadata; advanced engine behavior and replicas are unavailable Managed regional failover requires Google Cloud
Memorystore (Redis/Valkey) RESP :5390	Valkey RESP, Lua, Pub/Sub, streams, and transactions Redis instance lifecycle, configuration, version labels, and AUTH retrieval	Shared server; database numbers do not isolate Pub/Sub channels No multi-shard topology, managed failover, or project authorization
Cloud SQL HTTP/REST :5380 · PostgreSQL :5391 · MySQL :5406	Instance/database/user lifecycle; PostgreSQL and on-demand MySQL 8.4 Backup metadata CRUD and instance administration responses Local server CA discovery and client certificate issuance	Shared engines; version labels, instance flags, and infrastructure settings do not provision separate servers Backups are metadata; export/import/restore/restart and replica verbs do no data work. Replace-restore and migration leave Cloud SQL untouched MySQL requires Docker access; project exports omit MySQL data, non-public PostgreSQL schemas, and passwords requireSsl/sslMode, revocation, and CA rotation are not enforced; PostgreSQL does not require client certificates
Pub/Sub gRPC :5383	Topics, subscriptions, push/pull, StreamingPull, and acknowledgements Attribute filters, dead-letter forwarding, and retries Retention, snapshots, and timestamp/snapshot seek Avro/Protobuf schemas, revisions, and JSON/binary validation Wrapped and unwrapped push payloads with optional metadata headers Expiration and message-storage policy configuration readback Authenticated push with locally signed OIDC tokens	No exactly-once delivery, message ordering, export subscriptions, or transforms Push receivers must trust the local issuer/JWKS; retry and retention timing is approximate Expiration and storage policies are metadata; stored IAM does not enforce publish or topic deletion
Cloud Tasks gRPC :5380	Queue lifecycle, pause/resume, purge, and HTTP target overrides Task CRUD, BufferTask, and manual/automatic HTTP dispatch Rate/concurrency limits, deadlines, retries, and attempt history HTTP delivery with locally issued OAuth/OIDC credentials	No App Engine dispatch or logging sampling; queue target overrides need exact-image validation Authenticated receivers must trust the local issuer/JWKS Restart can redeliver; pause, purge, and delete cannot cancel in-flight requests. Inspect attempts before replaying
Cloud Scheduler gRPC + HTTP/REST :5380	Job CRUD, pause/resume, and manual runs Timezone-aware cron and schedule previews HTTP/Pub/Sub delivery, retries, deadlines, and attempt history HTTP delivery with locally issued OAuth/OIDC credentials	No App Engine targets; authenticated receivers must trust the local issuer and JWKS No interrupted-attempt replay or downtime backfill Stored policies do not enforce per-job authorization
Cloud Workflows gRPC :5380	Workflow deployment and lifecycle Local interpreter, standard library, and execution step history	Limited connector and expression support Active executions fail on restart with InstanceRestart
Cloud Functions (2nd Gen) gRPC :5380	Second-generation function metadata CRUD HTTP forwarding and Pub/Sub trigger routing	Requires your own execution target No source builds or managed function containers No Firestore/Storage/Audit Log Eventarc triggers or Google identity tokens
GKE gRPC :5380 · k3d :5443	Cluster metadata lifecycle Real local Kubernetes clusters through k3d Pod ADC through annotated Kubernetes-to-Google service-account bindings	One k3d server node; requires Docker. No node-pool creation, autoscaling, resize, or upgrades Use the exported /container/v1 REST endpoint; shared /v1 cluster routes select AlloyDB Pod identity needs TLS, local identity, the KSA annotation, and workloadIdentityUser; direct principal federation is unavailable
Compute Engine Unsupported HTTP/REST :5380 Stub routes only	Local VM execution: not available yet Disks, snapshots, templates, VPCs: use Google Cloud Local stub routes only
Cloud Run gRPC :5380	Service/revision metadata Docker container execution on service create/update	Requires Docker runtime access No jobs, domain mappings, or full revision traffic splitting
Vertex AI Unsupported HTTP/REST :5380 Stub routes only	Local stubs: deterministic responses only Inference, embeddings, tokenization: use Google Cloud Training, tuning, endpoints, batch prediction: use Google Cloud
Secret Manager gRPC :5380	Secret CRUD Version add/access/list/enable/disable/destroy SOFTWARE CMEK encryption and per-secret IAM policy APIs	No automatic rotation notifications or topic delivery Authorization varies by transport and IAM mode Hardware key custody and geographic replication are cloud-only
Cloud IAM gRPC :5380	Allow policies, permission checks, supported conditions, and project inheritance Custom roles and grantable-role queries Service-account metadata, key enable/disable, and testable-permission queries Local access/ID tokens, impersonation, and blob/JWT signing OIDC workload identity pools, providers, and token exchange	Enforcement depends on service, transport, and IAM mode; open/permissive mode is not access control No full CEL, organization/folder ancestry, or deny policies; federation uses local OIDC providers Tokens use the local issuer/JWKS, without Google authority
Cloud KMS gRPC + HTTP/REST :5380	Locations, random bytes, keys/versions, rotation, destruction/restoration, and eligible deletion SOFTWARE symmetric/asymmetric cryptography, public keys, and MACs Supported post-quantum signing/decapsulation and wrapped key imports Strict IAM, conditions, audits, metrics, and authenticated Workflows connectors Secret Manager CMEK, project Inventory, and Autokey/KeyHandles	SOFTWARE keys; hardware custody and Google authority require Google Cloud Inventory/Autokey covers project-owned global Secret Manager resources; no folder ancestry or other protected types KeyRing deletion differs from Google Cloud
Cloud Resource Manager HTTP/REST :5380	Project CRUD through v1/v3 APIs; completed operation polling Project auto-registration on supported entry points outside strict mode	No organization/folder lifecycle, moves, search, or full ancestry No project auto-registration on direct emulator listeners
Service Usage HTTP/REST :5380	Service list/get/enable/batchEnable preflights and completed operation polling	Reports ENABLED; runtime activation uses LocalCloud service controls No quota enforcement, billing, or project-specific entitlement
Cloud Billing HTTP/REST :5380	Billing-account and budget metadata CRUD; selected Terraform paths	No cost accumulation or threshold notifications No billing exports or budget-triggered automation
Cloud Logging gRPC :5380	Log ingestion, listing, and local filtering Sink configuration and runtime/KMS audit events Logs-based metric definition create/get/list/update/delete APIs	Local filters cover a subset of Google syntax; metric definitions do not derive values Validate exclusions and sink delivery in Google Cloud
Cloud Monitoring gRPC :5380	Time-series writes, filtered reads, and derived metric descriptors Notification-channel metadata Alert-policy create/get/list/update/delete APIs	Aggregation and order_by are ignored; filters support AND-joined equality on metric/resource type and labels Validate alert evaluation, notifications, uptime execution, and dashboards in Google Cloud
Cloud Storage HTTP/REST :5382	Bucket CRUD; object upload, download, listing, and deletion Bucket IAM and mode-aware object authorization Object event delivery to local Pub/Sub topics HMAC keys and signed XML requests	Versioning and archive events await image validation; managed folders are unavailable Lifecycle, retention, holds, and encryption metadata are stored without enforcement Notifications require existing topics; ordering and atomic object/event delivery are not guaranteed
BigQuery HTTP/REST :5388 · gRPC :5389	Datasets, tables, clones, and time travel Row access policies, top-level policy tags, and masking Joins, window functions, CTEs, PIVOT/UNPIVOT, and MERGE Procedural scripts, stored procedures, and dynamic SQL Jobs, dry runs, scheduled queries, and selected ML models Materialized views and INFORMATION_SCHEMA Emulated GCS: CSV, JSONL, Parquet, Avro, ORC; EXTERNAL_QUERY gRPC Storage Read/Write with Avro and Arrow	SQL, ML, and geography have input-specific limits; ingestion-time pseudocolumn reads and nested policy tags are unavailable External tables use local GCS; native Bigtable, Sheets, HTTP, and local-file sources are unavailable Managed reservations, production IAM, and fleet scale require Google Cloud
Dataproc gRPC :5380	Local cluster lifecycle Spark/Hadoop execution in cluster and serverless modes	Requires Docker daemon access Cloud scaling, automated node repair, and production SLAs are cloud-only
Google Sheets HTTP/REST :5380	Exact A1-range reads: values.get and values.batchGet	Read-only auxiliary fixture API No spreadsheet metadata, writes, range slicing, or formulas No Google OAuth authority

Run the workflows you need

Enable services with localcloud start --services <name> or services.enabled in localcloud.yaml. Dataproc and Cloud Run use Docker execution; GKE uses k3d and Docker.

Validate your application

Use each service guide for detailed operations and setup. Test the queries, authorization rules, and delivery behavior your application relies on, and validate cloud infrastructure guarantees in Google Cloud.