[Yandex Cloud documentation](../../index.md) > [Yandex API Gateway](../index.md) > [Tutorials](index.md) > Serverless-based backend > Running a containerized app in Yandex Serverless Containers

# Running a containerized app in Yandex Serverless Containers


Follow this tutorial to deploy a containerized app in [Serverless Containers](../../serverless-containers/index.md) to administer MongoDB.

MongoDB is deployed on a [Yandex Compute Cloud](../../compute/index.md) VM. A [Yandex Container Registry](../../container-registry/index.md) is used to host the container with the app. [Yandex Lockbox](../../lockbox/index.md) is used to encrypt sensitive data. Secure access to the application is enabled over a [Yandex API Gateway](../index.md). The entire infrastructure of the containerized app resides in a single folder.

To deploy your containerized app:

1. [Get your cloud ready](#before-you-begin).
1. [Create a service account](#sa-create).
1. [Create a cloud network with a subnet](#create-network).
1. [Configure the security group](#configure-sg).
1. [Create a Compute Cloud VM with MongoDB](#create-vm).
1. [Create a Yandex Lockbox secret and version](#secret-create).
1. [Create a registry in Container Registry](#create-registry).
1. [Push the Docker image to Container Registry](#push-image).
1. [Create a container in Serverless Containers](#create-container).
1. [Create an API Gateway](#create-api-gw).
1. [Test the application](#check-app).

If you no longer need the resources you created, [delete them](#clear-out).


## Get your cloud ready {#before-you-begin}

Sign up for Yandex Cloud and create a [billing account](../../billing/concepts/billing-account.md):
1. Navigate to the [management console](https://console.yandex.cloud) and log in to Yandex Cloud or create a new account.
1. On the **[Yandex Cloud Billing](https://center.yandex.cloud/billing/accounts)** page, make sure you have a billing account linked and it has the `ACTIVE` or `TRIAL_ACTIVE` [status](../../billing/concepts/billing-account-statuses.md). If you do not have a billing account, [create one](../../billing/quickstart/index.md) and [link](../../billing/operations/pin-cloud.md) a cloud to it.

If you have an active billing account, you can create or select a [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) for your infrastructure on the [cloud page](https://console.yandex.cloud/cloud).

[Learn more about clouds and folders here](../../resource-manager/concepts/resources-hierarchy.md).


### Required paid resources {#paid-resources}

The application support cost includes:

* Fee for a continuously running VM (see [Yandex Compute Cloud pricing](../../compute/pricing.md)).
* Fee for storing secrets (see [Yandex Lockbox pricing](../../lockbox/pricing.md)).
* Fee for storing a Docker image (see [Yandex Container Registry pricing](../../container-registry/pricing.md)).
* Fee for the container invocation count, computing resources allocated for the application, and outgoing traffic (see [Serverless Containers pricing](../../serverless-containers/pricing.md)).
* Fee for API gateway requests (see [Yandex API Gateway pricing](../pricing.md)).
* Fee for logging operations and data storage in a [log group](../../logging/concepts/log-group.md) (see [Yandex Cloud Logging pricing](../../logging/pricing.md)).


## Create a service account {#sa-create}

Create a [service account](../../iam/concepts/users/service-accounts.md) and assign it the required [roles](../../iam/concepts/access-control/roles.md) for the folder where you want to deploy the containerized app infrastructure.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), go to the folder where you want to deploy the containerized app infrastructure.
  1. Navigate to **Identity and Access Management**.
  1. Click **Create service account**.
  1. Enter the service account name: `mongo-express`.
  1. Click ![image](../../_assets/console-icons/plus.svg) **Add role** and select the `container-registry.images.puller`, `lockbox.payloadViewer`, and `serverless-containers.containerInvoker` roles.
  1. Click **Create**.

- CLI {#cli}

  If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../cli/quickstart.md#install).

  The folder used by default is the one specified when [creating](../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id <folder_ID>` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Create a service account named `mongo-express`:

      ```bash
      yc iam service-account create --name mongo-express
      ```

      Result:

      ```text
      id: aje3pdqm1cul********
      folder_id: b1g681qpemb4********
      created_at: "2025-06-14T10:31:06.911280565Z"
      name: mongo-express
      ```

  1.  Assign the service account the `container-registry.images.puller`, `lockbox.payloadViewer`, and `serverless-containers.containerInvoker` roles for the folder that will host your container:

      ```bash
      yc resource-manager folder add-access-binding <folder_name_or_ID> \
        --role container-registry.images.puller \
        --subject serviceAccount:<service_account_ID>

      yc resource-manager folder add-access-binding <folder_name_or_ID> \
        --role lockbox.payloadViewer \
        --subject serviceAccount:<service_account_ID>

      yc resource-manager folder add-access-binding <folder_name_or_ID> \
        --role serverless-containers.containerInvoker \
        --subject serviceAccount:<service_account_ID>
      ```

      Where:

      * `<folder_name_or_ID>`: Name or ID of the folder that will host the container.
      * `--subject serviceAccount`: `mongo-express` service account ID.

      Result:

      ```text
      effective_deltas:
        - action: ADD
          access_binding:
            role_id: container-registry.images.puller
            subject:
              id: aje3pdqm1cul********
              type: serviceAccount

      effective_deltas:
        - action: ADD
          access_binding:
            role_id: lockbox.payloadViewer
            subject:
              id: aje3pdqm1cul********
              type: serviceAccount

      effective_deltas:
        - action: ADD
          access_binding:
            role_id: serverless-containers.containerInvoker
            subject:
              id: aje3pdqm1cul********
              type: serviceAccount
      ```

- API {#api}

  1. To create a service account, use the [create](../../iam/api-ref/ServiceAccount/create.md) REST API method for the [ServiceAccount](../../iam/api-ref/ServiceAccount/index.md) resource or the [ServiceAccountService/Create](../../iam/api-ref/grpc/ServiceAccount/create.md) gRPC API call.
  1. To assign the service account roles for a folder, use the [updateAccessBindings](../../resource-manager/api-ref/Folder/updateAccessBindings.md) REST API method for the [Folder](../../resource-manager/api-ref/Folder/index.md) resource or the [FolderService/UpdateAccessBindings](../../resource-manager/api-ref/grpc/Folder/updateAccessBindings.md) gRPC API call.

{% endlist %}


## Create a cloud network with a subnet {#create-network}

Create a [cloud network](../../vpc/concepts/network.md) with a [subnet](../../vpc/concepts/network.md#subnet) the VM will reside in.

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [management console](https://console.yandex.cloud).
  1. Navigate to **Virtual Private Cloud**.
  1. Click **Create network**.
  1. In the **Name** field, specify `mongo-express-network`.
  1. In the **Advanced** field, select **Create subnets**.
  1. Click **Create network**.
  1. In the left-hand panel, select ![subnets](../../_assets/vpc/subnets.svg) **Subnets**.
  1. Click **Create subnet**.
  1. In the **Name** field, specify `mongo-express-subnet-ru-central1-b`.
  1. In the **Availability zone** field, select `ru-central1-b`.
  1. In the **Network** field, select `mongo-express-network`.
  1. In the **CIDR** field, specify `192.168.1.0/24`.
  1. Click **Create subnet**.

- CLI {#cli}

  1. Create a cloud network:

      ```bash
      yc vpc network create \
        --name mongo-express-network
      ```

      Result:

      ```text
      id: enp1b4okmg57********
      folder_id: b1g681qpemb4********
      created_at: "2025-06-13T12:57:02Z"
      name: mongo-express-network
      default_security_group_id: enphs1omp6m4********
      ```

      Save the default security group ID specified in the `default_security_group_id` field.

  1. Create a subnet:

      ```bash
      yc vpc subnet create \
         --name mongo-express-subnet-ru-central1-b \
         --zone ru-central1-b \
         --network-id <network_ID> \
         --range 192.168.1.0/24
      ```

      Where:

      * `--name`: Subnet name.
      * `--zone`: Availability zone.
      * `--network-id`: `mongo-express-network` ID.
      * `--range`: List of IPv4 addresses for incoming or outgoing traffic.

      Result:

      ```text
      id: e2l9i0eaq32t********
      folder_id: b1g681qpemb4********
      created_at: "2025-06-14T09:27:37Z"
      name: mongo-express-subnet-ru-central1-b
      network_id: enp1b4okmg57********
      zone_id: ru-central1-b
      v4_cidr_blocks:
        - 192.168.1.0/24
      ```

- API {#api}

  1. To create a cloud network, use the [create](../../vpc/api-ref/Network/create.md) REST API method for the [Network](../../vpc/api-ref/Network/index.md) resource or the [NetworkService/Create](../../vpc/api-ref/grpc/Network/create.md) gRPC API call, providing the following in your request:

      * ID of the folder that will host the network.
      * Name of the new network,`mongo-express-network`, in the `name` parameter.

  1. To create a subnet, use the [create](../../vpc/api-ref/Subnet/create.md) REST API method for the [Subnet](../../vpc/api-ref/Subnet/index.md) resource or the [SubnetService/Create](../../vpc/api-ref/grpc/Subnet/create.md) gRPC API call.

{% endlist %}


## Configure the security group {#configure-sg}

Configure the default [security group](../../vpc/concepts/security-groups.md) in the cloud network you created [earlier](#create-network).

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [management console](https://console.yandex.cloud).
  1. Navigate to **Virtual Private Cloud**.
  1. In the left-hand panel, select ![image](../../_assets/vpc/security-group.svg) **Security groups**.
  1. Next to the default security group created for `mongo-express-network`, click ![image](../../_assets/options.svg) and select ![image](../../_assets/console-icons/pencil.svg) **Edit**.
  1. Under **Rules**, navigate to the **Egress** tab.
  1. Click **Add** and create a rule based on this table:

      | Traffic<br/>direction | Description | Port range | Protocol | Destination name /<br/>Source | CIDR blocks |
      | --- | --- | --- | --- | --- | --- |
      | `Ingress` | `any` | `27017` | `Any` | `CIDR` | `0.0.0.0/0` |

  1. Click **Save**.

- CLI {#cli}

  Add the following rule to the security group:

  ```bash
  yc vpc security-group update-rules <security_group_ID> \
    --add-rule "direction=ingress,port=27017,protocol=any,v4-cidrs=[0.0.0.0/0,0.0.0.0/0]"
  ```

  Where `<security_group_ID>` is the `default_security_group_id` value obtained in the previous step.

  Result:

  ```text
  id: enpmal7qcb1q********
  folder_id: b1g681qpemb4********
  created_at: "2025-06-14T09:24:47Z"
  name: default-sg-enpeiqghds1j********
  description: Default security group for network
  network_id: enpeiqghds1j********
  status: ACTIVE
  rules:
    ...
    - id: enprm96de4ec********
      direction: INGRESS
      ports:
        from_port: "27017"
        to_port: "27017"
      protocol_name: ANY
      protocol_number: "-1"
      cidr_blocks:
        v4_cidr_blocks:
          - 0.0.0.0/0
          - 0.0.0.0/0
  default_for_network: true
  ```

- API {#api}

  To add a rule to a security group, use the [updateRules](../../vpc/api-ref/SecurityGroup/updateRules.md) REST API method for the [SecurityGroup](../../vpc/api-ref/SecurityGroup/index.md) resource or the [SecurityGroupService/UpdateRules](../../vpc/api-ref/grpc/SecurityGroup/updateRules.md) gRPC API call, providing the following in your request:

    * ID of the security group you want to add rules to, in the `securityGroupId` parameter.

        To get the security group ID, use the [list](../../vpc/api-ref/SecurityGroup/list.md) REST API method for the [SecurityGroup](../../vpc/api-ref/SecurityGroup/index.md) resource or the [SecurityGroupService/List](../../vpc/api-ref/grpc/SecurityGroup/list.md) gRPC API call and provide the folder ID in the `folderId` request parameter.

    * New security group rules, in the `additionRuleSpecs[]` array:

        * Traffic direction: `ingress`.
        * Name of the traffic transmission protocol, in the `additionRuleSpecs[].protocolName` parameter: `any`.
        * List of CIDRs and subnet masks, in the `additionRuleSpecs[].cidrBlocks.v4CidrBlocks[]` parameter: `[0.0.0.0/0,0.0.0.0/0]`.
        * First port in the traffic ports range, in the `additionRuleSpecs[].ports.fromPort` parameter: `0`.
        * Last port in the traffic port range, in the `additionRuleSpecs[].ports.toPort` parameter: `65535`.

{% endlist %}


## Create a VM with MongoDB {#create-vm}

We recommend using a [VM](../../compute/concepts/vm.md) with basic configuration.

{% list tabs group=instructions %}

- Management console {#console}

  1. In the [management console](https://console.yandex.cloud), navigate the [folder](../../resource-manager/concepts/resources-hierarchy.md#folder) dashboard, click **Create resource**, and select `Virtual machine instance`.
  1. Under **Boot disk image**:

      1. Navigate to the **Container Solution** tab and click **Configure**.
      1. In the window that opens, go to the **Docker Compose** tab and specify the Docker container as follows:

          ```yaml
          version: '3.1'

          services:
            mongo:
              image: mongo
              restart: always
              environment:
                MONGO_INITDB_ROOT_USERNAME: mongo_db_user
                MONGO_INITDB_ROOT_PASSWORD: <password>
              ports:
                - 27017:27017
          ```

          In the `MONGO_INITDB_ROOT_PASSWORD` parameter, specify a password to use for accessing the database. To create a password, you can use [this password generator](https://passwordsgenerator.net/). Save the password, as you will need it in the next steps.

      1. Click **Apply**.

  1. Under **Location**, select an [availability zone](../../overview/concepts/geo-scope.md) for your VM. If you are not sure which one to choose, leave the default.
  1. Under **Network settings**:

      * In the **Subnet** field, select `mongo-express-subnet-ru-central1-b`.
      * In the **Public IP address** field, select `Auto`.

  1. Under **Access**, select **SSH key** and specify the VM access credentials:

      * In the **Login** field, enter a username. Do not use `root` or other reserved usernames. For operations requiring root privileges, use the `sudo` command.
      * In the **SSH key** field, select the SSH key saved in your [organization user](../../organization/concepts/membership.md) profile.
        
        If there are no SSH keys in your profile or you want to add a new key:
        
        1. Click **Add key**.
        1. Enter a name for the SSH key.
        1. Select one of the following:
        
            * `Enter manually`: Paste the contents of the public SSH key. You need to [create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) an SSH key pair on your own.
            * `Load from file`: Upload the public part of the SSH key. You need to create an SSH key pair on your own.
            * `Generate key`: Automatically create an SSH key pair.
            
              When adding a new SSH key, an archive containing the key pair will be created and downloaded. In Linux or macOS-based operating systems, unpack the archive to the `/home/<user_name>/.ssh` directory. In Windows, unpack the archive to the `C:\Users\<user_name>/.ssh` directory. You do not need additionally enter the public key in the management console.
        
        1. Click **Add**.
        
        The system will add the SSH key to your organization user profile. If the organization has [disabled](../../organization/operations/os-login-access.md) the ability for users to add SSH keys to their profiles, the added public SSH key will only be saved in the user profile inside the newly created resource.

  1. Under **General information**, specify the VM name: `mongo-vm`.
  1. Click **Create VM**.

  Wait for the VM status to change to `Running` and save its public IP address; you will need it for connecting to the database.

- CLI {#cli}

  1. [Create](../../compute/operations/vm-connect/ssh.md#creating-ssh-keys) a key pair (public and private keys) for SSH access to the VM.
  1. Create `docker-spec.yaml`, a Docker container specification file:

      ```yaml
      version: '3.1'

      services:
        mongo:
          image: mongo
          restart: always
          environment:
            MONGO_INITDB_ROOT_USERNAME: mongo_db_user
            MONGO_INITDB_ROOT_PASSWORD: <password>
          ports:
            - 27017:27017
      ```

      In the `MONGO_INITDB_ROOT_PASSWORD` parameter, specify a password to use for accessing the database. To create a password, you can use [this password generator](https://passwordsgenerator.net/). Save the password, as you will need it in the next steps.

  1. Run this command:

      ```bash
      yc compute instance create-with-container \
        --docker-compose-file docker-spec.yaml \
        --name mongo-vm \
        --zone ru-central1-b \
        --network-interface subnet-name=mongo-express-subnet-ru-central1-b,nat-ip-version=ipv4 \
        --ssh-key <path_to_public_key_file> \
        --create-boot-disk size=30
      ```

      Where:

      * `--docker-compose-file`: Path to the Docker container [specification file](../../cos/concepts/coi-specifications.md#coi-spec).
      * `--name`: VM name.
      * `--zone`: Availability zone.
      * `--network-interface`: VM network settings.
      * `--ssh-key`: Path to the public SSH key file, e.g., `./ssh-key.pub`. The default username for SSH access is `yc-user`.
      * `--create-boot-disk size`: Boot disk size. It must be at least 30 GB.

      Result:

      ```text
      id: epde18u4mahl********
      folder_id: b1g7gvsi89m3********
      created_at: "2023-02-08T10:34:06.601Z"
      name: mongo-vm
      ...
      ```

{% endlist %}


## Create a Yandex Lockbox secret {#secret-create}

The [Yandex Lockbox secret](../../lockbox/concepts/secret.md) will store encrypted authentication credentials.

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [management console](https://console.yandex.cloud).
  1. Navigate to **Lockbox**.
  1. Click **Create secret**.
  1. In the **Name** field, enter the secret name: `mongodb-creds`.
  1. In the **Key** field, enter `login`.
  1. In the **Value** field, enter `mongo_db_user` as your database user login.

  1. Click **Add key/value** and specify the second secret:

      * In the **Key** field, enter `password`.
      * In the **Value** field, enter the password to access the database: the `MONGO_INITDB_ROOT_PASSWORD` value from the [Docker container specification](#create-vm).

  1. Click **Create**.

- CLI {#cli}

   Create a secret named `mongodb-creds`:

    ```bash
    yc lockbox secret create \
      --name mongodb-creds \
      --payload "[{'key': 'login', 'text_value': 'mongo_db_user'},{'key': 'password', 'text_value': '<password>'}]"
    ```

    Where:

    * `--name`: Secret name.
    * `--payload`: Contents of the secret provided as a YAML or JSON array.
    * `<password>`: `MONGO_INITDB_ROOT_PASSWORD` value from the [Docker container specification](#create-vm).

    Result:

    ```text
    id: e6q6nbjfu9m2********
    folder_id: b1qt6g8ht345********
    created_at: "2023-02-08T10:34:06.601Z"
    name: mongodb-creds
    status: ACTIVE
    current_version:
      id: e6q0s9airqca********
      secret_id: e6q6nbjfu9m2********
      created_at: "2023-02-08T10:34:06.601Z"
      status: ACTIVE
      payload_entry_keys:
        - login
        - password
    ```

- API {#api}

  To create a secret, use the [create](../../lockbox/api-ref/Secret/create.md) REST API method for the [Secret](../../lockbox/api-ref/Secret/index.md) resource or the [SecretService/Create](../../lockbox/api-ref/grpc/Secret/create.md) gRPC API call.

{% endlist %}


## Create a registry in Container Registry {#create-registry}

Create a [registry](../../container-registry/concepts/registry.md) in Container Registry to store the `mongo-express` application’s Docker image.

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [management console](https://console.yandex.cloud).
  1. Navigate to **Container Registry**.
  1. Click **Create registry**.
  1. Specify `app-registry` as the registry name.
  1. Click **Create registry**.

- CLI {#cli}

  Create a registry named `app-registry`:

  ```bash
  yc container registry create --name app-registry
  ```

  Result:

  ```text
  id: crpd50616s9a********
  folder_id: b1g88tflru0e********
  name: app-registry
  status: ACTIVE
  created_at: "2023-02-08T10:34:06.601Z"
  ```

- API {#api}

  To create a registry, use the [create](../../container-registry/api-ref/Registry/create.md) REST API method for the [Registry](../../container-registry/api-ref/Registry/index.md) resource or the [RegistryService/CreateRegistryRequest](../../container-registry/api-ref/grpc/Registry/create.md) gRPC API call.

{% endlist %}


## Push the Docker image to the registry {#push-image}

1. Create a [Docker Hub](https://hub.docker.com/) account.
1. Install Docker:

    * For Windows, use [this version](https://docs.docker.com/desktop/install/windows-install/).
    * For Linux, use [this version](https://docs.docker.com/desktop/install/linux-install/).
    * For Mac OS, use [this version](https://docs.docker.com/desktop/install/mac-install/).

1. [Pull](https://hub.docker.com/_/mongo-express) the `mongo-express` image:

    ```bash
    docker pull mongo-express
    ```

    Result:

    ```text
    Using default tag: latest
    latest: Pulling from library/mongo-express
    6a428f9f83b0: Pull complete
    ...
    e60224d64a04: Pull complete
    Digest: sha256:dcfcf89bf91238ff129469a5a94523b3025913dcc41597d72d4d5f4a********
    Status: Downloaded newer image for mongo-express:latest
    docker.io/library/mongo-express:latest
    ```

1. [Authenticate](../../container-registry/operations/authentication.md) in Container Registry using the Docker credential helper:

    {% list tabs group=instructions %}

    - CLI {#cli}

      1. Configure Docker to use `docker-credential-yc`:

          ```bash
          yc container registry configure-docker
          ```

          Result:

          ```text
          Credential helper is configured in '/home/<user>/.docker/config.json'
          ```

          The current user’s profile stores the settings.

      1. Check that the `${HOME}/.docker/config.json` file includes the following line:

          ```json
          "cr.yandex": "yc"
          ```

      Docker is ready to use.

    {% endlist %}

1. [Push](../../container-registry/operations/docker-image/docker-image-push.md) the Docker image to the registry:

    {% list tabs group=instructions %}

    - CLI {#cli}

      1. Assign a URL to the pushed `mongo-express` image using the following format: `cr.yandex/<registry_ID>/<Docker_image_name>:<tag>`:

          ```bash
          docker tag mongo-express \
          cr.yandex/<registry_ID>/mongo-express:mongo-tag
          ```

      1. Push the `mongo-express` image to the registry:

          ```bash
          docker push cr.yandex/<registry_ID>/mongo-express:mongo-tag
          ```

          Result:

          ```text
          \The push refers to repository [cr.yandex/crpbr3qaut47********/mongo-express]
          7c550ce9591d: Pushed
          ...
          aedc3bda2944: Pushed
          mongo-tag: digest: sha256:c641... size: 1993
          ```

    {% endlist %}


## Create a container in Serverless Containers {#create-container}

To run your application in Yandex Cloud, create a [container](../../serverless-containers/concepts/container.md) and its [revision](../../serverless-containers/concepts/container.md#revision):

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [management console](https://console.yandex.cloud).
  1. Navigate to **Serverless Containers**.
  1. Click **Create container**.
  1. Enter the container name: `mongo-express-container`.
  1. Click **Create**.
  1. Navigate to the **Editor** tab.

      1. Under **Resources**, specify the amount of RAM: `1024 MB`.
      1. Under **Image settings**:

          1. In the **Image URL** field, specify the URL of the Docker image you pushed [previously](#push-image).
          1. In the **Environment variables** field, add the following variables:

              * `ME_CONFIG_BASICAUTH_USERNAME`: Leave empty.
              * `ME_CONFIG_BASICAUTH_PASSWORD`: Leave empty.
              * `VCAP_APP_PORT`: Set it to `8080`.
              * `ME_CONFIG_MONGODB_SERVER`: Specify the VM public IP address obtained [earlier](#create-vm).

          1. In the **Lockbox secrets** field, specify the secrets as follows:

              * `ME_CONFIG_MONGODB_AUTH_USERNAME`: Secret with the `login` key.
              * `ME_CONFIG_MONGODB_AUTH_PASSWORD`: Secret with the `password` key.

        1. Under **Settings**:

            1. In the **Service account** field, specify `mongo-express`.
            1. In the **Timeout** field, specify `15`.

  1. Click **Create revision**.

- CLI {#cli}

  1. Create a container:

      ```bash
      yc serverless container create --name mongo-express-container
      ```

      Result:

      ```text
      id: bba3fva6ka5g********
      folder_id: b1gqvft7kjk3********
      created_at: "2023-02-08T10:34:06.601Z"
      name: mongo-express-container
      url: https://bba3fva6ka5g********.containers.yandexcloud.net/
      status: ACTIVE
      ```

  1. Create a container revision:

      ```bash
      yc serverless container revision deploy \
        --container-name mongo-express-container \
        --cores 1 \
        --memory 1GB \
        --image cr.yandex/<registry_ID>/mongo-express:mongo-tag \
        --environment ME_CONFIG_BASICAUTH=false \
        --environment VCAP_APP_PORT=8080 \
        --environment ME_CONFIG_MONGODB_SERVER=<VM_public_address> \
        --secret environment-variable=ME_CONFIG_MONGODB_AUTH_USERNAME,key=login,id=<secret_ID> \
        --secret environment-variable=ME_CONFIG_MONGODB_AUTH_PASSWORD,key=password,id=<secret_ID> \
        --service-account-id <mongo_express_service_account_ID> \
        --network-id <network_ID> \
        --execution-timeout 15s \
        --concurrency 1
      ```

      Where:

      * `--image`: URL of the `mongo-express` Docker image you pushed [earlier](#push-image).
      * `--environment`: Environment variables:

          * `ME_CONFIG_BASICAUTH`: Set it to `false`.
          * `VCAP_APP_PORT`: Set it to `8080`.
          * `ME_CONFIG_MONGODB_SERVER`: Specify the VM public IP address obtained [earlier](#create-vm).

      * `--secret environment-variable`: `ME_CONFIG_MONGODB_AUTH_USERNAME` and `ME_CONFIG_MONGODB_AUTH_PASSWORD` secrets you created [earlier](#secret-create).
      * `--service-account-id`: [ID of the `mongo-express` service account](../../iam/operations/sa/get-id.md) you created [earlier](#sa-create).
      * `--network-id`: `mongo-express-network` ID.

      Result:

      ```text
      id: bbas0ktemln9********
      container_id: bbai45hrl5et********
      created_at: "2025-06-14T10:18:06.791Z"
      image:
        image_url: cr.yandex/crpbr3qaut47********/mongo-express:mongo-tag
        image_digest: sha256:c641....
        environment:
          ME_CONFIG_BASICAUTH: "false"
          ME_CONFIG_MONGODB_SERVER: 89.169.***.***
          VCAP_APP_PORT: "8080"
      resources:
        memory: "1073741824"
        cores: "1"
        core_fraction: "100"
      execution_timeout: 15s
      concurrency: "1"
      service_account_id: ajeldi88vl73********
      status: ACTIVE
      secrets:
        - id: e6qfi832v2j8********
          version_id: e6qj9a9oifme********
          key: login
          environment_variable: ME_CONFIG_MONGODB_AUTH_USERNAME
        - id: e6qfi832v2j8********
          version_id: e6qj9a9oifme********
          key: password
          environment_variable: ME_CONFIG_MONGODB_AUTH_PASSWORD
      log_options:
        folder_id: b1g681qpemb4********
      runtime:
        http: {}
      ```

- API {#api}

  1. To create a container, use the [create](../../serverless-containers/containers/api-ref/Container/create.md) REST API method for the [Container](../../serverless-containers/containers/api-ref/Container/index.md) resource or the [ContainerService/Create](../../serverless-containers/containers/api-ref/grpc/Container/create.md) gRPC API call.
  1. To create a container revision, use the [deployRevision](../../serverless-containers/containers/api-ref/Container/deployRevision.md) REST API method for the [Container](../../serverless-containers/containers/api-ref/Container/index.md) resource or the [ContainerService/DeployRevision](../../serverless-containers/containers/api-ref/grpc/Container/deployRevision.md) gRPC API call.

{% endlist %}


## Create an API Gateway {#create-api-gw}

Create an [API gateway](../concepts/index.md) with the `x-yc-apigateway-integration:serverless_containers` extension.

{% list tabs group=instructions %}

- Management console {#console}

  1. Open the [management console](https://console.yandex.cloud).
  1. Navigate to **API Gateway**.
  1. Click **Create API gateway**.
  1. In the **Name** field, enter the API gateway name: `mongo-express-gw`.
  1. Under **Specification**, add the following specification:

      ```yaml
      openapi: 3.0.0
      info:
        title: Sample API
        version: 1.0.0
      paths:
        /{proxy+}:
          x-yc-apigateway-any-method:
            x-yc-apigateway-integration:
              type: serverless_containers
              container_id: <container_ID>
              service_account_id: <service_account_ID>
            parameters:
            - explode: false
              in: path
              name: proxy
              required: false
              schema:
                default: '-'
                type: string
              style: simple
      ```

      Where:

      * `container_id`: `mongo-express-container` ID.
      * `service_account_id`: `mongo-express` service account ID.

  1. Click **Create**.
  1. Open the created API gateway and copy the link from the **Default domain** field.

- CLI {#cli}

  1. Create an [OpenAPI 3.0](https://github.com/OAI/OpenAPI-Specification) specification file to describe your API.

      {% cut "Specification" %}

      ```yaml
      openapi: 3.0.0
      info:
        title: Sample API
        version: 1.0.0
      paths:
        /{proxy+}:
          x-yc-apigateway-any-method:
            x-yc-apigateway-integration:
              type: serverless_containers
              container_id: <container_ID>
              service_account_id: <service_account_ID>
            parameters:
            - explode: false
              in: path
              name: proxy
              required: false
              schema:
                default: '-'
                type: string
              style: simple
      ```

      Where:

      * `container_id`: `mongo-express-container` ID.
      * `service_account_id`: `mongo-express` service account ID.

      {% endcut %}

  1. Specify the properties and use the following command to create your API gateway:

      ```bash
      yc serverless api-gateway create \
          --name mongo-express-gw \
          --spec=<specification_file_path>
      ```

      Result:

      ```text
      id: d5d63uh1h26g********
      folder_id: b1g681qpemb4********
      created_at: "2025-06-14T10:23:19.682Z"
      name: mongo-express-gw
      status: ACTIVE
      domain: d5d63uh1h26g********.********.apigw.yandexcloud.net
      connectivity: {}
      log_options:
        folder_id: b1g681qpemb4********
      execution_timeout: 300s
      ```

      Save the link specified in the `domain` field.

- API {#api}

  To create an API gateway, use the [create](../apigateway/api-ref/ApiGateway/create.md) REST API method for the [ApiGateway](../apigateway/api-ref/ApiGateway/index.md) resource or the [ApiGatewayService/Create](../apigateway/api-ref/grpc/ApiGateway/create.md) gRPC API call.

{% endlist %}


## Test the application {#check-app}

Follow the previously obtained link in `d5d63uh1h26g********.********.apigw.yandexcloud.net` format. The MongoDB admin panel opens.


## How to delete the resources you created {#clear-out}

To stop paying for the resources you created:

1. [Delete](../operations/api-gw-delete.md) the `mongo-express-gw` API gateway.
1. [Delete](../../serverless-containers/operations/delete.md) `mongo-express-container`.
1. [Delete](../../container-registry/operations/docker-image/docker-image-delete.md) the image from `app-registry`.
1. [Delete](../../container-registry/operations/registry/registry-delete.md) `app-registry`.
1. [Delete](../../lockbox/operations/secret-delete.md) the `mongodb-creds` secret.
1. [Delete](../../storedoc/operations/cluster-delete.md) `mongo-vm`.
1. [Delete](../../iam/operations/sa/delete.md) the `mongo-express` service account.