self-hosted-runner-security-overview

Secure self-hosted GitHub Actions runners by deploying ephemeral container-based instances with per-job credentials and strict network isolation to wipe state after each run and minimize attack surface.

Persistent self-hosted runners pose risks of unauthorized access and misconfigurations that allow malicious persistence across jobs. Ephemeral execution prevents state carryover to mitigate these threats.

Configure OIDC for per-job credentials to enforce least privilege by issuing temporary tokens scoped to individual jobs. This restricts IAM access and prevents credential reuse across runner executions.

Yes, this approach specifically secures teams running internal CI workflows with external PRs. Ephemeral runtimes ensure fresh states for each job, safely handling untrusted external code contributions.

The best way to isolate networks for self-hosted runners is applying deny-by-default policies for production resources. This strict network isolation limits lateral movement and unauthorized access.

Audit logging for ephemeral GitHub Actions runners provides comprehensive records for forensic analysis. It tracks per-job credential usage and execution events to detect anomalies and maintain security visibility.