Deploy from GCR (Artifact Registry) to VideoSDK Cloud

This guide walks you through building, pushing, and deploying an agent container image stored in Google Artifact Registry to VideoSDK Agent Cloud.

Prerequisites

• A working AI agent project.
• A Google Cloud project with the Artifact Registry API enabled.
• gcloud CLI installed and authenticated.
• VideoSDK CLI installed and authenticated.

1. Set Up Google Cloud Credentials

To allow VideoSDK Cloud to pull images from your private Artifact Registry, you need a Service Account with the correct permissions.

Create a Service Account

# Create service account
gcloud iam service-accounts create videosdk-ar-puller \
  --display-name "VideoSDK Artifact Registry Puller"

Grant Artifact Registry Reader Role

# Grant Artifact Registry Reader role at the project level
gcloud projects add-iam-policy-binding <PROJECT_ID> \
  --member="serviceAccount:videosdk-ar-puller@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/artifactregistry.reader"

Generate JSON Key

# Generate JSON key and save to keyfile.json
gcloud iam service-accounts keys create keyfile.json \
  --iam-account videosdk-ar-puller@<PROJECT_ID>.iam.gserviceaccount.com

Warning: Keep keyfile.json secure and do not commit it to version control.

---

2. Create and Configure Repository

Artifact Registry organizes images into repositories. It is recommended to create a dedicated repository for your VideoSDK workers.

Create Repository

# Create a single-purpose repository
gcloud artifacts repositories create videosdk-worker \
  --repository-format=docker \
  --location=<REGION> \
  --description="Docker repository for VideoSDK Worker"

Grant Repository-Specific Access (Optional)

If you prefer more granular access control, grant read-only access only to the specific repository instead of the entire project:

gcloud artifacts repositories add-iam-policy-binding videosdk-worker \
  --location=<REGION> \
  --member="serviceAccount:videosdk-ar-puller@<PROJECT_ID>.iam.gserviceaccount.com" \
  --role="roles/artifactregistry.reader"

---

3. Build and Push Image

Before pushing, configure Docker to authenticate with your regional registry.

Authenticate Docker

# Replace <REGION> with your repository location (e.g., us-central1)
gcloud auth configure-docker <REGION>-docker.pkg.dev

Build and Push

Update your videosdk.yaml or use the CLI flags to specify the target image path.

# Build the image
videosdk agent build --image <REGION>-docker.pkg.dev/<PROJECT_ID>/videosdk-worker/my-agent:v1

# Push the image
videosdk agent push --image <REGION>-docker.pkg.dev/<PROJECT_ID>/videosdk-worker/my-agent:v1

---

4. Create Image Pull Secret

Create the secret in VideoSDK Cloud using the service account key.

videosdk agent image-pull-secret my-gcr-secret \
  --server https://<REGION>-docker.pkg.dev \
  -u _json_key \
  -p "$(cat keyfile.json)" \
  --region us002

---

5. Deploy Agent

Use the videosdk agent up command for a streamlined workflow that handles the final build-push-deploy sequence, or use deploy if you've already pushed.

# Deploy using the GAR image and secret
videosdk agent deploy \
  --image <REGION>-docker.pkg.dev/<PROJECT_ID>/videosdk-worker/my-agent:v1 \
  --image-pull-secret my-gcr-secret

Alternatively, use the shortcut:

videosdk agent up --image <REGION>-docker.pkg.dev/<PROJECT_ID>/videosdk-worker/my-agent:v1

---

Summary of URL Format

Field	Format	Example
Server	https://<REGION>-docker.pkg.dev	https://us-central1-docker.pkg.dev
Image	<REGION>-docker.pkg.dev/<PROJECT>/<REPO>/<IMAGE>:<TAG>	us-central1-docker.pkg.dev/my-proj/worker/agent:v1