Self-hosted CI runners can be safe enough for a particular workload, but they are not automatically isolated or clean between jobs. A runner executes workflow code with the permissions, credentials, files, and network access available to that job. If untrusted code can run there, it may use those capabilities; if the runner is reused, a compromise may affect later jobs too. Treat the runner as a privileged execution boundary, not as a neutral place to run builds.
What is the actual risk?
“Shared secrets” is a threat-model framing, not a claim that every runner exposes every secret. Exposure depends on what the job can access, how the runner is configured, which executor it uses, and where it can connect. A compromised job may use credentials without printing them, read sensitive files available to its process, or reach services permitted by the runner’s network position.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsGitHub’s Secure use reference warns that self-hosted runners lack guarantees of clean ephemeral virtual machines and can be persistently compromised by untrusted workflow code. GitLab’s GitLab Runner security guidance likewise warns that compromised environments can expose job secrets and that non-ephemeral runners serving multiple projects increase cross-project risk. These are platform security recommendations, not prevalence statistics.
Who can cause code to run on the runner?
Start with the events and identities that can start or influence a job, rather than assuming a repository’s visibility tells you whether its contributors are trusted. Include pushes, pull requests, forks, manual dispatches, scheduled jobs, reusable workflows, and project contributors. Review the workflow definitions and third-party actions as executable code: they operate with the permissions the job makes available.
#1 Best Overall
- [INTEL POWERED CONTENT] - Built with a 8th Generation Hexa-Core Intel i5 and 32GB of DDR4 RAM; Modern, Windows 11 ready, with 4K support, Executive multitasking, media streaming and smooth, multi-tab web browsing; Perfect as an all-purpose multimedia computer; built for content creators; Plenty of RAM and Mass storage for photo and video editing powered by Intel HD 630
- [LATEST WIRELESS TECH] - This Dell Desktop Computer easily connects to the internet through the Built In WiFi / Bluetooth
- [SOLID STATE STORAGE] - This Dell Computer setup comes with an ultra-fast 1TB Solid State Drive (SSD); Setup as the primary boot device; Boot and load programs with lightning speed ; Additional expansion available
- [BUY & OWN WITH CONFIDENCE] - From the world's largest Microsoft Authorized Refurbisher; Quality Guarantee and Free Tech Support; Award-winning Customer Service; | Support Sustainable Business
- [MODERN HI-SPEED PORTS] - USB 3.0 (x4) | USB 2.0 (x4) | DisplayPort (x1) | HDMI Port (x1) | Audio Combo Jack (x1) | Audio Out (x1) | RJ-45 Ethernet (x1) | Internal SATA (x3)
- Pull requests and forks: In relevant GitHub Actions configurations, a user able to fork a repository and open a pull request may be able to compromise a self-hosted runner environment. Access to secrets or the
GITHUB_TOKENdepends on workflow configuration and token permissions; do not assume every pull request receives them, or that none can. - Public repositories: GitHub says self-hosted runners should almost never be used for public repositories. OWASP’s GitHub Actions Security Cheat Sheet advises generally avoiding them because anyone able to fork and open a pull request may potentially execute code on the runner. If a team nevertheless accepts that risk, approval controls, ephemeral execution, keeping sensitive data off the machine, and network restrictions reduce exposure. Approval alone does not make untrusted code safe to execute.
- Private or internal repositories: Visibility is not a trust boundary by itself. Contributors, credentials, workflow triggers, and the permissions assigned to jobs still determine who can cause code to run and what that code can do.
What can a job or runner reach?
Inventory both job-level access and persistent host access. A job may receive secrets directly, while the runner host may contain files, credentials, caches, or services that are available across jobs. Map network routes as well as local data: access to an internal deployment system or cloud metadata endpoint can be consequential even if no credential is printed in a build log.
- Credentials: List secrets, tokens, SSH keys, cloud credentials, package credentials, signing material, and local configuration available to the job or host.
- Build data: Include checked-out source, artifacts, workspaces, caches, Docker layers, and any local service data that survives job completion.
- Network destinations: Identify routes to source-control APIs, registries, cloud metadata services, deployment systems, and internal services. Grant access only where the workload needs it.
- Identity and permissions: Give jobs the minimum token permissions and credentials needed for their task. Prefer narrower, short-lived identity over long-lived credentials where the platform and target service support it.
Secret masking and environment protection are useful controls, not substitutes for isolation. Masking can keep a value out of logs; it cannot prevent code running in the same privileged context from using that value. Approval gates can restrict when a workflow proceeds; they do not remove the capabilities of code once it is allowed to run.
Can a pull request compromise later jobs?
Potentially, if the runner or resources it shares are not cleaned or isolated. A malicious job can attempt to alter workspaces, caches, machine files, Docker layers, background processes, local services, or other state that remains available later. On a persistent runner, that creates a path from one workflow into a subsequent job. If the runner serves multiple repositories or projects, the consequences may cross those boundaries too.
Rank #2
- Entry-level NAS Personal Storage：UGREEN NAS DH2300 is your first and best NAS made easy. It is designed for beginners who want a simple, private way to store videos, photos and personal files, which is intuitive for users moving from cloud storage or external drives and move away from scattered date across devices. This entry-level NAS 2-bay perfect for personal entertainment, photo storage, and easy data backup (doesn't support Docker or virtual machines).
- Set Your Devices Free, Expand Your Digital World: This unified storage hub supports massive capacity up to 64TB.*Storage drives not included. Stop Deleting, Start Storing. You can store 22 million 3MB images, or 2 million 30MB songs, or 43K 1.5GB movies or 67 million 1MB documents! UGREEN NAS is a better way to free up storage across all your devices such as phones, computers, tablets and also does automatic backups across devices regardless of the operating system—Window, iOS, Android or macOS.
- The Smarter Long-term Way to Store: Unlike cloud storage with recurring monthly fees, a UGREEN NAS enclosure requires only a one-time purchase for long-term use. For example, you only need to pay $459.98 for a NAS, while for cloud storage, you need to pay $719.88 per year, $2,159.64 for 3 years, $3,599.40 for 5 years. You will save $6,738.82 over 10 years with UGREEN NAS! *NAS cost based on DH2300 + 12TB HDD; cloud cost based on 12TB plan (e.g. $59.99/month).
- Blazing Speed, Minimal Power: Equipped with a high-performance processor, 1GbE port, and 4GB RAM on Board, this NAS handles multiple tasks with ease. File transfers reach up to 125MB/s—a 1GB file takes only 8 seconds. Don't let slow clouds hold you back; they often need over 100 seconds for the same task. The difference is clear.
- Let AI Better Organize Your Memories: UGREEN NAS uses AI to tag faces, locations, texts, and objects—so you can effortlessly find any photo by searching for who or what's in it in seconds. It also automatically finds and deletes similar or duplicate photo, backs up live photos and allows you to share them with your friends or family with just one tap. Everything stays effortlessly organized, powered by intelligent tagging and recognition.
GitLab specifically identifies non-ephemeral runners used by multiple projects as a heightened risk: a malicious job may compromise other repositories that use the runner. GitHub also warns that a compromised self-hosted environment can persist and notes that runners serving multiple repositories can increase the impact. These warnings do not mean every job will cross-contaminate others; they mean reuse must be treated as a security decision, not merely an efficiency setting.
A container executor is not a guarantee of complete isolation. The effective boundary depends on the executor and its configuration, including privileges, namespaces, mounts, host access, and workload. Assess what the job can actually reach rather than relying on labels such as “containerized.”
Does an ephemeral runner solve the problem?
Ephemeral execution helps limit persistence when each job receives a clean, isolated environment and the environment is reliably destroyed or reset afterward. The lifecycle has to work in practice, including after failures and during concurrent jobs. GitHub cautions that intending to destroy a runner after a job does not by itself guarantee that it runs only one job, and that concurrent jobs can create exposure between them.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 【Advanced Home Data & Media Hub】For advanced home users who need phone backup, file storage, and centralized data management. Centralize family photos, 4K videos, movies, computer backups, and personal files in one place while running multiple apps for home entertainment and everyday data management. Suitable for households with growing digital libraries and multiple NAS use cases.
- 【Built for Creators, Media Servers & Advanced Apps】Powered by the Intel N100 Quad-Core CPU, 8GB DDR5 RAM, 2.5GbE networking, and dual M.2 NVMe slots, DXP2800 handles large files and heavier workloads with ease. Run Docker, virtual machines, and media server applications compatible with Plex—ideal for content creators, tech enthusiasts, and advanced home users managing 4K videos, RAW photos, personal media libraries, and multiple NAS apps.
- 【Up to 80TB for Growing Digital Libraries】 Supports up to 80TB of storage using two HDD bays and two M.2 NVMe SSD slots for family photos, movies, RAW photos, 4K videos, work files, and device backups. AI photo management supports recognition of people, objects, scenes, and locations, album organization, and duplicate photo detection. HDDs and SSDs are not included.
- 【AI-powered Home Surveillance】Turn DXP2800 into a centralized home surveillance hub by connecting compatible network cameras and storing recordings locally on your NAS. AI-powered features include Face Recognition, People Detection, and Pet Detection, helping advanced home users review important events more efficiently while managing home surveillance and personal data in one place.
- 【One data Center Across Your Devices】Keep files from desktops, laptops, phones, tablets, and other devices together instead of scattered across cloud accounts and external drives. Access, back up, organize, and share data across Windows, macOS, Android, iOS, web browsers, and compatible smart TVs—ideal for creators and advanced home users working across multiple devices.
Check the actual lifecycle, not just the runner’s name or configuration intent:
- Provision: Confirm each job receives the intended clean instance or isolation boundary, rather than a reused host with leftover state.
- Constrain: Verify that jobs cannot access other jobs’ files, processes, credentials, or host resources through shared mounts, services, or executor settings.
- Destroy or reset: Confirm cleanup happens after successful jobs, failed jobs, cancellations, and concurrent workloads. Establish what happens if cleanup itself fails.
- Verify: Check that credentials and sensitive data are not retained in images, caches, logs, or host storage for a later job.
Ephemeral infrastructure reduces the chance that a job’s compromise persists, but it does not make untrusted code harmless while the job is running. The job can still use its own permissions and network access during execution.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the runner model by its boundary
No deployment type is universally safe. GitHub distinguishes its hosted ephemeral clean, isolated virtual machines from self-hosted runners, while GitLab’s guidance emphasizes that self-managed runner risk depends in part on the executor and its configuration. Teams may need self-hosting for custom hardware, specialized software, or internal network access; isolate that pool and give it only the corresponding access.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Rank #4
- Dell PowerEdge R730xd 24B SFF 2U Server
- 2x Intel Xeon E5-2690 v4 2.6Ghz 14-Core (28-cores Total)
- 128GB DDR4 RAM – 4x 1.2TB 10K SAS 2.5” 12Gb/s
- Dell H730P mini 2GB 12Gb/s RAID
- 2x 750W PSU - 2x 10Gb SFP+ 2x 1Gb (RJ45) NIC
| Approach | Security property to evaluate | Main question |
|---|---|---|
| Hosted ephemeral runner | GitHub describes hosted runners as clean, isolated ephemeral virtual machines. | Does the hosted environment meet the workload’s hardware, software, and network requirements, and what permissions does the job receive? |
| Persistent self-hosted runner | Self-hosted runners do not have a general guarantee of clean ephemeral virtual machines; state and access may survive between jobs. | What can remain on the host, and which repositories, trust levels, and jobs share it? |
| Ephemeral self-hosted runner | Per-job lifecycle can limit persistence, but only if isolation, cleanup, and concurrency behavior are effective. | Is every job actually isolated from other work and followed by reliable destruction or reset? |
Use the same review questions for any model: who can trigger code, what each job can access, what survives afterward, what network routes exist, and who owns patching, monitoring, rebuilding, and audit. A “self-hosted,” “container,” or “ephemeral” label does not answer those questions on its own.
Controls to put at each trust boundary
- Separate runner pools: Segregate by repository or project, trust level, and privilege. Do not let untrusted contribution workflows share a runner pool with release or deployment jobs.
- Restrict assignment: Limit runner groups to the intended organizations and repositories. Review which workflows can target each group.
- Use clean per-job execution for untrusted workloads: Prefer genuinely isolated ephemeral instances, and validate destruction or reset under failures and concurrency.
- Minimize credentials: Keep secrets out of untrusted jobs unless needed. Scope token permissions and use narrower, short-lived credentials where supported.
- Limit network reach: Restrict egress and access to internal services, metadata endpoints, and deployment control planes. Do not grant reachability merely because it simplifies testing or deployment.
- Reduce host exposure: Use dedicated, minimally privileged host identities; avoid persistent credentials and sensitive data on runner machines; and include patching and hardening in fleet lifecycle management.
- Review pipeline code: Treat workflow definitions and third-party actions as code that may use job permissions. Apply review and trust controls to changes that alter triggers or execution behavior.
These controls work together: isolation limits what a job can affect, least privilege limits what it can use, and network restrictions limit where it can go. Patching and hardening matter, but they do not replace those boundaries.
A practical threat-model review
- Map execution paths: Record every trigger, contributor class, workflow, and runner group that can start or influence a job.
- Map capabilities: For each job type, document its token permissions, secrets, host files, caches, artifacts, and network destinations.
- Trace shared state: Identify anything that survives a job or is shared concurrently, including workspaces, images, processes, mounts, and credentials.
- Draw trust boundaries: Separate untrusted contribution work from trusted release, signing, deployment, and internal-network workloads.
- Test lifecycle and access: Verify runner assignment restrictions, cleanup after failure, concurrency isolation, and the actual network and host boundary for the selected executor.
- Assign ownership: Name who rebuilds, patches, monitors, and audits each runner pool, and how configuration or access changes are reviewed.
For each finding, state the threat in concrete terms: for example, “a forked pull request can run code on a runner that also holds deployment credentials and can reach the deployment network.” Then remove one or more links in that path: block the trigger, move the job to an isolated pool, remove the credential, or restrict network access.
Sources and scope
This guidance reflects the platform and security recommendations in GitHub Docs’ Secure use reference, OWASP’s GitHub Actions Security Cheat Sheet, GitLab Runner’s GitLab Runner security, and OWASP’s CI/CD Pipeline Security guideline. The source material was accessed October 7, 2026. It does not establish a universal compromise rate or assess any particular organization’s workflows, runner fleet, or network configuration; those details determine the actual exposure.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
