stempy/pubsub-lens repository overview

⁠Pub/Sub Lens

A web UI for Google Cloud Pub/Sub and the Pub/Sub emulator. Browse topics and subscriptions, pull or peek at messages, watch a topic live, and publish test messages.

⁠Quick start

docker run --rm -p 127.0.0.1:8686:8686 stempy/pubsub-lens

Open http://localhost:8686⁠, click the connection pill in the top bar and choose Demo, Emulator or Google Cloud.

⁠With an emulator on your machine

An emulator already running on your machine (started by gcloud, Docker or .NET Aspire) needs no setup. Inside the container, the app looks for it at host.docker.internal:8085, which is your machine's port 8085. Choose Emulator and connect. For another port, change Emulator address in the connection dialog.

On Linux, add the host name yourself, and make sure the emulator listens on all interfaces rather than only 127.0.0.1:

docker run --rm -p 127.0.0.1:8686:8686 --add-host=host.docker.internal:host-gateway stempy/pubsub-lens

⁠With an emulator in Docker Compose

services:
  pubsub-lens:
    image: stempy/pubsub-lens:0.1
    ports: ["127.0.0.1:8686:8686"]
    environment:
      PUBSUB_EMULATOR_HOST: pubsub-emulator:8085
      PUBSUB_PROJECT_ID: local-project
    depends_on: [pubsub-emulator]

  pubsub-emulator:
    image: gcr.io/google.com/cloudsdktool/google-cloud-cli:emulators
    command: gcloud beta emulators pubsub start --host-port=0.0.0.0:8085 --project=local-project
    ports: ["127.0.0.1:8085:8085"]

Your own apps can use the same emulator at localhost:8085.

⁠With Google Cloud

The image has no gcloud, so mount credentials: a service account key, or your own from gcloud auth application-default login.

docker run --rm -p 127.0.0.1:8686:8686 \
  -v ~/.config/gcloud/application_default_credentials.json:/secrets/google.json:ro \
  -e GOOGLE_APPLICATION_CREDENTIALS=/secrets/google.json \
  -e PUBSUB_PROJECT_ID=my-project \
  --user "$(id -u):$(id -g)" \
  stempy/pubsub-lens

--user lets the container read a credentials file that only you can read. On Cloud Run or GKE, skip the mount: the app uses the workload's service account.

Keep the port private. Anyone who can reach the port can use Pub/Sub with the container's credentials, so publish it on 127.0.0.1 as above unless it's behind authentication.

⁠Configuration

⁠Tags