The Application Default Credentials are not available using Docker

Question

I'm integrating Google Cloud Vision API into my Spring Boot app, but I keep getting the error:

java.io.IOException: The Application Default Credentials are not available.
They are available if running in Google Compute Engine.
Otherwise, the environment variable GOOGLE_APPLICATION_CREDENTIALS must be defined
pointing to a file defining the credentials.
See https://developers.google.com/accounts/docs/application-default-credentials for more information.

What I Have Done :

Created a Google Cloud Service Account and enabled Vision API.
Placed vision-service-account.json inside src/main/resources.
Tried different ways to set credentials in application.yml:


spring:   
    cloud:
          gcp:
            project-id: keraa-notification  # My Google Cloud project ID
            credentials:
              location: classpath:vision-service-account.json

or


google:
  cloud:
    credentials:
      path: vision-service-account.json

Created a configuration class to load credentials:

2025-03-06 14:06:20 java.io.IOException: The Application Default Credentials are not available. They are available if running in Google Compute Engine. Otherwise, the environment variable GOOGLE_APPLICATION_CREDENTIALS must be defined pointing to a file defining the credentials. See https://developers.google.com/accounts/docs/application-default-credentials for more information.
2025-03-06 14:06:20     at com.google.auth.oauth2.DefaultCredentialsProvider.getDefaultCredentials(DefaultCredentialsProvider.java:127)
2025-03-06 14:06:20     at com.google.auth.oauth2.GoogleCredentials.getApplicationDefault(GoogleCredentials.java:129)
2025-03-06 14:06:20     at com.google.auth.oauth2.GoogleCredentials.getApplicationDefault(GoogleCredentials.java:101)
2025-03-06 14:06:20     at com.google.api.gax.core.GoogleCredentialsProvider.getCredentials(GoogleCredentialsProvider.java:70)
2025-03-06 14:06:20     at com.google.api.gax.rpc.ClientContext.create(ClientContext.java:168)
2025-03-06 14:06:20     at com.google.cloud.vision.v1.stub.GrpcImageAnnotatorStub.create(GrpcImageAnnotatorStub.java:115)
2025-03-06 14:06:20     at com.google.cloud.vision.v1.stub.ImageAnnotatorStubSettings.createStub(ImageAnnotatorStubSettings.java:163)
2025-03-06 14:06:20     at com.google.cloud.vision.v1.ImageAnnotatorClient.<init>(ImageAnnotatorClient.java:160)
2025-03-06 14:06:20     at com.google.cloud.vision.v1.ImageAnnotatorClient.create(ImageAnnotatorClient.java:142)
2025-03-06 14:06:20     at com.google.cloud.vision.v1.ImageAnnotatorClient.create(ImageAnnotatorClient.java:133)
2025-03-06 14:06:20     at com.keraa.api.service.ImageModerationService.isImageSafe(ImageModerationService.java:21)
2025-03-06 14:06:20     at com.keraa.api.web.rest.ProductResource.createProduct(ProductResource.java:116)

I'm not a Java (Spring Boot) dev but am familiar with Google Cloud. Generally (!) with Application Default Credentials (ADCs) you don't need to configure your code to use credentials because ADC attempts to automate credentials discovery and authentication. If your code is running locally, you can often use your user credentials. — DazWilkin
– DazWilkin, Commented Mar 6 at 16:48
If your code is running on a Google compute service (e.g. Cloud Run, Compute Engine), your code will authenticate using the Metadata service. — DazWilkin
– DazWilkin, Commented Mar 6 at 16:48
If you're using any (!) of the ADC approaches, you should be able to remove the explicit references to the Service Account that you're attempting to provide and preferably use one of the above solutions or for testing purposes only export GOOGLE_APPLICATION_CREDENTIALS=/path/to/vision-service-account.json — DazWilkin
– DazWilkin, Commented Mar 6 at 16:50
you comment helped a lot thanks, i just had to add GOOGLE_APPLICATION_CREDENTIALS to environment: on the docker compose file. — Charfeddine Mohamed Ali
– Charfeddine Mohamed Ali, Commented Mar 7 at 1:15
@DazWilkin i will reply in case other people face the same issue — Charfeddine Mohamed Ali
– Charfeddine Mohamed Ali, Commented Mar 7 at 1:21

Charfeddine Mohamed Ali · Accepted Answer · 2025-03-08 22:29:58Z

0

I had to set the GOOGLE_APPLICATION_CREDENTIALS in mydocker-compose.yml file by adding it as an environment variable. This allows your application to authenticate with Google services using a service account key.


version: "3"
services:
  myproject:
    image: myproject
    environment:
      - _JAVA_OPTIONS=-Xmx512m -Xms256m
      - SPRING_PROFILES_ACTIVE=prod,api-docs
      - GOOGLE_APPLICATION_CREDENTIALS=/app/resources/vision-service-account.json 
    volumes:
      - ./firebase-service-account.json:/app/resources/vision-service-account.json:ro

edited Mar 8 at 22:29

answered Mar 7 at 1:20

Charfeddine Mohamed Ali

1,0944 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

DazWilkin Mar 7 at 14:32

You should not store the Service Account key in the container. Anyone with the container has access to the key. You should mount the key from the environment.

Charfeddine Mohamed Ali Mar 7 at 23:07

@DazWilkin does that mean i have to remove the volumes line ?

DazWilkin Mar 8 at 2:27

My apologies, no you're doing it correctly. I read "stored inside the container" and didn't read your Docker Compose.

Charfeddine Mohamed Ali Mar 8 at 22:30

It's okay. I changed it so it doesn't confuse readers. Thanks again!

Collectives™ on Stack Overflow

The Application Default Credentials are not available using Docker

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related