Server-Side GTM Setup: Google Tag Manager Server Container

In a server-side GTM setup, the Google tag on your site sends its requests to a tagging server on your own domain instead of straight to Google. A server container there decides what reaches GA4 and Google Ads. On Google Cloud Run, live traffic needs 2 or 3 servers at about $45 a month each. A managed host such as Stape charges $20 a month on its Pro plan.

What the finished setup does

When a patient books on a made-up dental practice's site, the page's Google tag sends one request to sgtm.brightsmile-dental.example, the practice's own tagging subdomain. The GA4 client there, the part that reads Google Analytics requests, claims it and turns it into an event. Two server tags then pass that event to GA4 and Google Ads.

Illustration: the booking reaches GA4 and Google Ads from the practice's tagging server, not from the visitor's browser.

Start here

Container and server

checks 1 to 3

Your own domain

check 4

Route the tags

checks 5 to 8

Preview and test

checks 9 and 10

Container and server

checks 1 to 3

Your own domain

check 4

Route the tags

checks 5 to 8

Preview and test

checks 9 and 10

Checks 1 to 3 stand the server up, check 4 puts it on your domain, 5 to 8 route the tags, and 9 and 10 prove it.

Stand the server up

Check 1: Create the server container

WhereGoogle Tag ManagerAccountsCreate Container

Do: Next to your account name, choose Create Container, pick Server under Target platform and click Create (Google's overview).

You should see: A dialog with two options: Automatically provision tagging server and Manually provision tagging server.

If not: Closed the dialog? Click the container ID in the top bar to reopen it.

Check 2: Pick where the tagging server runs

WhereGoogle Tag ManagerServer containerSet up your tagging server

Do: Automatic provisioning has Tag Manager create a Google Cloud project with a Cloud Run tagging server. You need the Project Creator and Billing Account User roles (Cloud Run guide). For any other host, choose manual provisioning and copy the Container Config string. On Stape, you paste that string and pick a server location. On your own Docker host, the manual setup guide runs this image twice: as a preview server (RUN_AS_PREVIEW_SERVER=true) and as a tagging cluster whose PREVIEW_SERVER_URL points at it.

gcr.io/cloud-tagging-10302018/gtm-cloud-image:stable

You should see: Your server's address, the run.app URL on Cloud Run or the one your host gives you, returns ok at /healthy.

If not: Preview broken on a manual setup? Google asks for exactly one preview server, never autoscaled, at most 1 vCPU per server, and a load balancer or CDN timeout above 20 seconds.

Route	Price on the provider's page
Cloud Run, 2 or 3 servers	About $45 per server a month (Cloud Run guide)
Load balancer for your domain	$0.025 an hour for up to 5 forwarding rules, plus data (network pricing)
Stape Pro, a managed host	$20 a month, or $17 a month billed annually, for up to 500K requests (Stape pricing)

At the rates above, one always-on server with 1 vCPU and 0.5 GiB comes to about $49 for a 30-day month once the free tier is used up. I budget with that, not Google's $45.

Check 3: Size server-side GTM on Cloud Run for live traffic

WhereGoogle CloudCloud RunEdit & Deploy New Revision

Do: Automatic provisioning leaves one server, which Google recommends for testing limited traffic only. Before real traffic, set the minimum instances to at least 2, the floor in Google's Cloud Run guide (its server-side overview says 3), and set a billing alert. Google expects 2 to 10 autoscaled servers to handle 35 to 350 requests per second.

You should see: Each instance at 1 vCPU and 0.5 GB with CPU always allocated.

If not: Bill higher than planned? Lower the minimum instances: with CPU always allocated, each one bills all month.

Check 4: Give the server your own domain

WhereGoogle Tag ManagerServer containerAdminContainer Settings

Do: On its default run.app address, Google's table says the server "can only set Javascript cookies," so give it your own domain. A path such as /metrics on your main hostname, routed through a CDN or load balancer, keeps Safari cookies longer than a subdomain. A subdomain such as sgtm.example.com, separate from the one serving your site, is simpler to set up (custom domain guide). Paste the URL into Server container URL.

You should see: https://sgtm.example.com/healthy answers ok, and server Preview opens the debugger.

If not: Cloud Run's built-in domain mapping is a Preview feature Google calls "not recommended for production services", limited to 10 regions and to /. That page marks a global external Application Load Balancer as the recommended route.

Route the tags through it

Check 5: Point the web Google tag at the server

WhereGoogle Tag ManagerWeb containerVariablesNew

Do: Create a variable of type Google tag: Configuration settings with one row: name server_container_url, value your URL from check 4. Select it under Configuration settings in your Google tag, trigger the tag on Initialization - All pages and save (Google's steps).

You should see: In the browser's Network tab, GA4 collect requests go to your tagging domain, not to google-analytics.com.

If not: Requests blocked? Allow the server URL in your Content Security Policy's img-src, connect-src and frame-src. If a diagnostic asks for a Google tag, add one with your tag ID (Google tag setup).

Check 6: Turn on GA4 server-side tracking

WhereGoogle Tag ManagerServer containerClients

Do: Open the pre-installed Google Analytics: GA4 client; most setups need no changes. Under Tags, add a GA4 tag with a custom trigger that fires on events this client claimed.

You should see: In server preview, each collect?v=2 request names the GA4 client in its Client box and lists the GA4 tag under Tags Fired. Its outgoing request shows a 2xx status (debugger guide).

If not: If another client claimed it, raise the GA4 client's priority. Clients run by Priority, highest first, and the first match wins (send data).

Check 7: Set up Google Ads server-side tracking

WhereGoogle Tag ManagerServer containerTagsNew

Do: Add a Conversion Linker tag on the All pages trigger, then a Google Ads Conversion Tracking tag with your conversion ID and label. Fire it with a Custom Event trigger on the event name your web GA4 Event tag sends, such as book_visit (Ads setup).

You should see: The Ads tag under Tags Fired on that event, and an empty Console. Google's steps also make it a GA4 key event, so even an Ads-only account needs a GA4 property.

If not: Conversions doubled? Google says to remove the matching web Ads conversion tags once the server tag works. For enhanced conversions, set a user_data parameter on the web Google tag to a User-Provided Data variable.

Check 8: Confirm consent reaches the server

WhereGoogle Tag ManagerWeb containerTags

Do: Set consent mode up in the web container only, as in consent mode v2 in Tag Manager. The Google tag adds consent parameters to the requests it sends the server.

You should see: Decline the banner with server preview open, then check the cookies. With ad_storage denied, the Ads tag neither writes nor reads Google Ads cookies. With analytics_storage denied, no Analytics cookies are set on the client or the server. Enhanced conversions need consent granted.

If not: Non-Google server tags get none of this; I treat each as blind to consent until its code shows a check (consent and server-side capture).

Prove it, then publish

Check 9: Preview both containers in one browser

WhereGoogle Tag ManagerServer containerPreview

Do: Start Preview in the server container, then in the web container, in the same browser, and make a test booking. When both look right, publish the server container first, so live hits never reach a server with no tags, then the web one.

You should see: Per Google, the Incoming HTTP Request box should match Chrome's Network tab one to one.

If not: Empty debugger? Recheck the Server container URL and the check 5 variable.

Check 10: Test the live path after publishing

WhereGA4AdminData displayDebugView

Do: Open the live site through Tag Assistant, which turns on debug mode. Accept the banner and book.

You should see: DebugView shows one page_view per page load. In Google Ads, under Goals > Summary, Tracking status reads No recent conversions, then Recording once conversions arrive. Accounts with Google's newer statuses show Awaiting conversions, then Active.

If not: Two page_views per load means another GA4 tag still sends straight to Google. Declined analytics cookies? DebugView skips those events, so accept them on the test device.

What stays out of the container

Offline conversion uploads. A booking turns into a kept visit days later, in a scheduler the tagging server never sees. An upload also needs memory across runs, so I run it as a scheduled job instead.

Frequently asked questions

When does the free server-side GTM server start to cost money?

The single server that automatic provisioning creates is free in most cases, but Google calls it fit for testing only. Per Google, it starts billing when other projects on the same billing account push it past the free tier, or when its traffic exceeds the free-tier limits. For live traffic, Google's Cloud Run guide puts each server at about $45 a month and recommends at least 2; its server-side overview says 3. A load balancer for your domain and request logging past about a million requests a month cost extra.

Do I still need a web container with server-side Google Tag Manager?

Yes. The web container's Google tag receives the event and the visitor's consent choice from your banner and sends both to your tagging server. Google says consent mode only needs setting up in the web container, because the Google tag adds the consent state to its requests to the server.

Can the GTM server container run outside Google Cloud?

Yes, through manual provisioning. Google ships the tagging server as one Docker image that runs on other clouds or your own hardware, as one preview server plus a cluster of tagging servers. Google also warns that the owner of that environment may have access to your data, so read the host's terms first.

How do I keep the tagging server up to date?

Google's release notes list each tagging server image; version 4.6.0 came out on October 29, 2026, as a security update. On Cloud Run, deploy a new revision with the stable image when Tag Manager prompts you. On a manual host, Google says to restart the servers periodically to pick up code updates; publishing the container does not need a restart.

Written by

Alexander Cheberko

Marketing Analytics & Conversion Tracking Engineer, US and Canada, run remotely

Media buyer on Google Ads and Meta Ads from October 2023 to September 2025, nearly $700K in spend.
Set up patient conversion tracking for a New York medical practice (anonymized).
Upwork Top Rated Plus, 5.0 from 20 reviews.

More about me · LinkedIn