Hey, we're seeing some issues with software downloads from our fleet instance that runs on GCP cloud run. Cloud Run has a max response body size of 32MB, thus we end up seeing a lot of 500s from

<https://fleet.shared-medal.tv/api/fleet/orbit/software_install/package?alt=media|https://$domain/api/fleet/orbit/software_install/package?alt=media>

(and failures on the client-side). I think we could fix this by setting up Cloudfront in front of the GCS bucket, but this hurts a bit as we're a GCP shop and would prefer to avoid having to involve another cloud to make it work reliably. What I think should work without too much changes to the codebase is to stop proxying downloads through fleet entirely if the software origin is GCS, and rather use the HMAC keys to issue signed urls similar to how it's done for Cloudfront. Thoughts on whether this should work? And is this something you'd consider implementing, or should we patch this ourselves and run a fork (would prefer to avoid the overhead of this, but if you don't want to invest further in GCP support we'll probably do it. Can contribute a PR in that case if it's interesting)

Hi @Tarjei Husøy! I hadn't heard of anyone running into this with GCP, so I took a look at the Cloud Run docs and it looks like, while there is a 32mb limit for inbound requests, there isn't a limit for responses when using streaming protocols. What's the exact error you're seeing?

@Tarjei Husøy I fixed this recently in https://github.com/fleetdm/fleet-terraform/pull/234

Thanks Robbie, that's a nice workaround, we'll probably deploy that short-term. We did run on h2c previously, but that broke the websocket as you say, main impact was osquery live results not working correctly (not sure if there's anything else as well, but that was the main thing we noticed). Kathy, this is the log output we get:

{
  "insertId": "6a208c54000cfafc6a92d622",
  "httpRequest": {
    "requestMethod": "POST",
    "requestUrl": "https://$domain/api/fleet/orbit/software_install/package?alt=media",
    "requestSize": "659",
    "status": 500,
    "userAgent": "Go-http-client/2.0",
    "remoteIp": "<snip>",
    "serverIp": "<snip>",
    "latency": "0.727122677s",
    "protocol": "HTTP/1.1"
  },
  "resource": {
    "type": "cloud_run_revision",
    "labels": {
      "location": "us-east4",
      "configuration_name": "fleet-backend",
      "project_id": "$project",
      "revision_name": "fleet-backend-00016-j8r",
      "service_name": "fleet-backend"
    }
  },
  "timestamp": "2026-06-03T20:19:32.122289Z",
  "severity": "ERROR",
  "labels": {
    "instanceId": "0007b734d93a5a2d6b34d3b8974190b62805bc0eaeae040c2a20159ec9d12e9432703f8fef811b95c5589068b25adfc0b409e0177476953a4a5b454334e8866eb5d33e538991fa5232b0a42bcb08fec0835d5de2fb353eb38ae1bd",
    "team": "shared"
  },
  "logName": "projects/$project/logs/run.googleapis.com%2Frequests",
  "trace": "projects/$project/traces/38c50485e02b5dc3b257bf8cabb82919",
  "receiveTimestamp": "2026-06-03T20:19:32.976038645Z",
  "spanId": "4633615d629ca537"
}
{
  "textPayload": "Response size was too large. Please consider reducing response size.",
  "insertId": "6a208c54000cfa65ba42a5a8",
  "resource": {
    "type": "cloud_run_revision",
    "labels": {
      "location": "us-east4",
      "project_id": "$project",
      "revision_name": "fleet-backend-00016-j8r",
      "configuration_name": "fleet-backend",
      "service_name": "fleet-backend"
    }
  },
  "timestamp": "2026-06-03T20:19:32.850533Z",
  "severity": "WARNING",
  "labels": {
    "instanceId": "0007b734d93a5a2d6b34d3b8974190b62805bc0eaeae040c2a20159ec9d12e9432703f8fef811b95c5589068b25adfc0b409e0177476953a4a5b454334e8866eb5d33e538991fa5232b0a42bcb08fec0835d5de2fb353eb38ae1bd",
    "team": "shared"
  },
  "logName": "projects/$project/logs/run.googleapis.com%2Fvarlog%2Fsystem",
  "trace": "projects/$project/traces/38c50485e02b5dc3b257bf8cabb82919",
  "receiveTimestamp": "2026-06-03T20:19:32.853657703Z"
}

Hey @Tarjei Husøy, Kathy is out of office until the 19th, but having a quick look through and checking the PR from Robbie (thank you!), this is on our radar and is planned to be reviewed.