ephemeral-runner-patterns

What problem does it solve?

Disposable runner environments solve the risk of persistent state and cross-job contamination by ensuring every GitHub Actions job runs in a fresh environment that is destroyed after completion, thereby reducing attack surfaces and credential leakage.

Core Features & Use Cases

• Container-based ephemeral runners: per-job isolation via container patterns (Podman) with optional enhanced isolation (e.g., gVisor) for rapid provisioning and cleanup.
• VM-based ephemeral runners: full hardware-like isolation per job for high-security requirements with longer provisioning times.
• ARC patterns: Kubernetes-native runner orchestration for scalable, pod-level isolation within clusters.
• Automatic teardown: guaranteed cleanup after job completion to prevent state leakage and reduce maintenance burden.
• Flexible deployment: choose container, VM, or ARC models to balance speed, cost, and security in CI pipelines.
• Use cases: ideal for CI workflows handling sensitive artifacts, secrets, or multi-tenant builds requiring strong job isolation.

Quick Start

Deploy an ephemeral runner pattern (container, VM, or ARC) and trigger a GitHub Actions workflow to observe per-job isolation and automatic teardown.