What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose the execution environment first. CircleCI Machine Runner executes each job on the virtual or physical host where the runner is installed. CircleCI Container Runner schedules a containerized job in an ephemeral Kubernetes pod. Machine Runner Orchestrator is a third model: a Kubernetes controller uses KubeVirt to create full virtual machines for runner jobs. The right choice depends on whether builds require a complete operating-system environment, whether your team already operates Kubernetes, the isolation boundary you need, and who will provide and scale the underlying compute.
Container Runner is usually the simplest fit for container-native builds. A conventional Machine Runner remains the most direct option when jobs need a non-containerized host, a particular operating system, or specialized local dependencies. Orchestrator is appropriate when those VM requirements remain, but you also want Kubernetes to manage a pool of disposable runner VMs. None of the Kubernetes options transfers responsibility for cluster capacity, virtualization hardware, or security policy to CircleCI.
As an Amazon Associate I earn from qualifying purchases.
The three architectures in plain terms
These options are often grouped together because all can run CircleCI jobs on infrastructure you control. They are not interchangeable, however: each creates a different job environment and gives your team a different set of operational responsibilities.
Recommended Free Tools
Machine Runner: the job uses its installed host
You install the CircleCI runner on a virtual machine or directly on a physical machine. The task agent then executes the job in that same environment, using the operating system, tools, network access, filesystems and attached devices available to the runner user. CircleCI describes this model for jobs that are not containerized or that need the full machine environment. The documented platform scope includes Linux, Windows and macOS. See the self-hosted runner overview.
#1 Best Overall
This is a host-fleet architecture. You maintain base images, installed dependencies, patching, runner registration, cleanup and enough machines to absorb demand. You can build a separate scaling arrangement to add or remove hosts, but the runner itself does not turn your virtual-machine fleet into an automatically managed Kubernetes pool. CircleCI’s runner scaling guide describes the capacity problem and the available scaling patterns.
Container Runner on Kubernetes: one ephemeral pod per job
Container Runner is installed in a Kubernetes cluster. Its container agent claims a CircleCI task, creates an ephemeral pod for that job and removes the pod after completion. The model is designed for containerized workloads: the job runs in a pod rather than on a long-lived host image. Pods can be created to match incoming work, which helps keep idle runner capacity low when the cluster has room.
Installation requires Kubernetes 1.25 or later and Helm 3.x according to CircleCI’s current Container Runner installation guide. The cluster itself remains your responsibility. CircleCI can schedule and scale job pods, but it does not add nodes, increase your node pool, reserve cloud capacity or fix a cluster that has run out of CPU, memory, storage or IP addresses.
Machine Runner Orchestrator: Kubernetes-managed full VMs
Machine Runner Orchestrator combines Kubernetes control with a virtual-machine job environment. Its Kubernetes controller adjusts a KubeVirt VirtualMachinePool in response to CircleCI task demand, provisioning runner VMs for jobs. The job still receives a complete VM rather than a container, while Kubernetes supplies the scheduling and pool-management layer.
The current CircleCI guide identifies version 1.0.0. A configurable minimum replica count can keep a number of VMs pre-warmed, reducing the wait for VM creation at the cost of keeping those instances available. The controller chart does not install KubeVirt. You must provide KubeVirt, Helm 3 or later, a CircleCI resource-class token and /dev/kvm on nodes that host the VMs. Validate the current KubeVirt compatibility matrix and CircleCI’s Machine Runner Orchestrator guide before deploying a production cluster.
How a job moves through each model
The lifecycle difference is more important than the product names. It determines where dependencies are installed, where state can remain, how isolation is enforced and what fails when capacity is exhausted.
Machine Runner lifecycle
- Provision a VM or physical host and install the runner software, operating-system packages, build tools and any required services.
- Register the runner with the appropriate CircleCI resource class and expose only the network paths the job needs.
- CircleCI assigns a job to an available runner. The task agent starts the job directly on that host.
- The job reads and writes the host’s filesystem and uses the privileges granted to the runner user. Any service containers, Docker daemon access or attached devices are part of the host’s configuration.
- After completion, your automation must restore the host to a known state, replace it, or otherwise remove job-created data. The runner process does not make a persistent machine automatically clean.
Container Runner lifecycle
- Install the Container Runner components into a Kubernetes 1.25-or-newer cluster with Helm 3.x.
- Configure the CircleCI resource class, credentials, namespaces, pod settings, storage and network policies required by your jobs.
- The container agent claims a task and asks Kubernetes to schedule an ephemeral job pod.
- Kubernetes places the pod on a node with sufficient resources and applies the pod’s image, mounts, policies and service configuration.
- The job runs inside the pod. When it finishes, the pod is removed, so files in the pod’s writable layer disappear unless you deliberately export artifacts or use persistent storage.
- Cluster autoscaling, node replacement, quotas, admission controls and the supply of CPU, memory and other resources remain operator tasks.
Machine Runner Orchestrator lifecycle
- Prepare a Kubernetes cluster with KubeVirt and hardware-assisted virtualization available on the nodes that will host VMs.
- Install the Orchestrator controller with Helm, provide the CircleCI resource-class token and define the KubeVirt pool and runner VM template.
- Set the minimum replica count and other pool parameters. A nonzero minimum keeps VMs warm; a zero or low minimum favors lower idle capacity but can increase startup latency.
- When CircleCI has work for the resource class, the controller adjusts the
VirtualMachinePoolso a suitable runner VM exists. - The job executes in that VM with the operating-system environment and privileges defined by the VM image and runner user.
- After the task, the VM can be recycled according to your pool and cleanup design. Kubernetes and KubeVirt still need enough node, storage and virtualization capacity to create and run the VM.
Side-by-side comparison
| Decision axis | Machine Runner | Container Runner on Kubernetes | Machine Runner Orchestrator |
|---|---|---|---|
| Job environment | Existing VM or physical host | Container in an ephemeral Kubernetes pod | Full VM provisioned through KubeVirt |
| Kubernetes required | No | Yes | Yes, plus KubeVirt |
| Best fit described by CircleCI | Non-containerized jobs or jobs needing the complete machine environment | Containerized jobs and teams already using Kubernetes | Jobs needing a full VM while the team wants Kubernetes-based VM scaling |
| Isolation boundary | Machine environment | Container and pod | Virtual machine |
| Who scales immediate job capacity | Your host-fleet automation or manual process | CircleCI schedules and scales pods; you provide cluster capacity | The controller adjusts the VM pool; you provide Kubernetes and virtualization capacity |
| Underlying infrastructure CircleCI supplies | Not stated; the host is customer-provided | Not stated; cluster nodes and capacity are operator responsibilities | Not stated; cluster nodes, KubeVirt and virtualization hardware are operator responsibilities |
| Primary operational dependency | Runner hosts, images, patches and cleanup | Kubernetes, Helm and cluster policy | Kubernetes, KubeVirt, Helm and hardware-assisted virtualization |
| Service-container and Docker behavior | Determined by the host and runner configuration | Determined by pod design and cluster policy | Determined by the VM image and VM configuration |
| Automatic cleanup of the execution environment | Not inherent; hosts are persistent unless replaced or reset | Job pod is removed after the task, but cluster-level state remains | VM lifecycle is pool-controlled; validate recycling and disk cleanup behavior |
CircleCI’s self-hosted runner feature comparison also organizes the choices around resource controls, architecture support, isolation, scaling, service containers, Docker support and cleanup. Use those dimensions when documenting an internal standard rather than treating any one architecture as a universal winner.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Choose by workload requirements
Use Machine Runner when the host itself is part of the build
Select a conventional machine runner when a job needs an operating-system installation, kernel behavior, device access or software that is awkward to package as a container. It is also the direct choice when your organization does not operate Kubernetes or when a small, stable host fleet is easier to govern than a cluster.
- Builds depend on Windows or macOS tooling, or on a Linux kernel and filesystem setup that must be controlled as a host.
- Jobs require specialized hardware, licensed desktop software, USB devices or local services that are already managed as part of a VM or physical machine.
- The platform team can maintain hardened images, rotate hosts and enforce cleanup without introducing Kubernetes.
- Workload demand is predictable enough for a fixed fleet or an existing VM autoscaling system.
The trade-off is persistent-host risk. A job can leave files, credentials, processes or altered packages behind unless each run starts on a clean image or the host is rebuilt.
Use Container Runner when builds are genuinely container-native
Container Runner is a strong fit when the build can be expressed by an image and Kubernetes pod configuration. Ephemeral pods provide a clear lifecycle boundary for the job’s writable layer and let Kubernetes place work across a shared cluster.
Rank #3
- Build images and dependencies are reproducible and do not require a full guest operating system.
- The team already has Kubernetes operations, observability, identity, policy and incident-response practices.
- Demand is bursty and pod scheduling is preferable to keeping a large machine fleet idle.
- Namespaces, resource requests, quotas and network policies can be aligned with the trust level of the code.
Do not select it merely because it says “self-scaling.” Pod creation does not create node capacity. If every node is full, jobs remain pending until your cluster scaling or capacity plan adds room.
Use Machine Runner Orchestrator when you need both VMs and Kubernetes control
Orchestrator targets the middle ground: a complete VM is necessary, but you want Kubernetes to represent, schedule and scale the runner fleet. It can be compelling for teams already standardized on Kubernetes that need stronger isolation or OS-level behavior than a pod provides.
- Jobs need a full VM image, but manually maintaining a separate autoscaling VM service would duplicate platform work.
- You can operate KubeVirt and validate nested or hardware-assisted virtualization, storage and networking behavior.
- A warm VM floor is valuable for reducing provisioning delay, and you accept the cost of idle replicas.
- Your security model benefits from a VM boundary, while still allowing Kubernetes policy and scheduling around the fleet.
It is not a lighter version of Container Runner. You are operating two infrastructure layers: Kubernetes and a virtual-machine platform inside it. Capacity failures can occur at the Kubernetes node, KubeVirt, storage, virtualization-device or VM-pool layer.
Prerequisite and deployment checklists
Machine Runner checklist
- Select the operating system and host shape required by the build.
- Create a repeatable image with the runner, compilers, SDKs, browsers, service dependencies and security updates.
- Define the runner user, resource class, credentials, outbound network rules and access to internal services.
- Decide how a host is cleaned or replaced after an untrusted or failed job.
- Set a capacity policy for normal load, bursts, maintenance windows and host failure.
- Monitor queue time, host utilization, disk growth, failed registrations and stale processes.
Container Runner checklist
- Provide Kubernetes 1.25 or later and Helm 3.x, as required by the current installation documentation.
- Choose namespaces, service accounts, admission controls, pod security settings, quotas and network policies.
- Build and scan the job images; declare CPU, memory, ephemeral-storage and any persistent-volume requirements.
- Configure artifact and cache handling so important outputs survive pod deletion.
- Confirm that cluster autoscaling or a reserved node pool can add capacity when pods are pending.
- Test image-pull limits, registry availability, DNS, egress controls and node disruption behavior.
Machine Runner Orchestrator checklist
- Install and validate KubeVirt separately; the Orchestrator chart does not install it.
- Confirm that VM-hosting nodes expose
/dev/kvmand support the KubeVirt version and virtualization mode you intend to use. - Install Helm 3 or later and the Orchestrator version documented for your environment; the current guide reports version 1.0.0.
- Create the CircleCI resource-class token and restrict its handling like any other CI credential.
- Define the VM image, CPU and memory shape, storage class, network attachment, runner user and cleanup behavior.
- Set a minimum replica count based on acceptable queue latency and idle-capacity tolerance.
- Load-test VM startup, image distribution, node drains, KubeVirt upgrades and pool reconciliation before relying on it for release-critical work.
Scaling, latency and capacity ownership
Machine Runner capacity
With ordinary machine runners, queue latency is constrained by the number of registered hosts that are healthy and idle. Adding capacity means adding or starting hosts, installing the expected dependencies and registering them in time. A large pre-provisioned fleet reduces startup delay but increases idle cost and patching scope. A highly dynamic fleet reduces idle capacity but adds image-boot and registration time.
Container Runner capacity
Container Runner can create pods in response to work, but Kubernetes must be able to schedule them. Plan separately for pod demand and node supply: requests and limits, node-pool size, autoscaler limits, pod-per-node limits, IP addresses, storage throughput and registry bandwidth. A pod that cannot be scheduled is a cluster-capacity problem, not a CircleCI queue-scaling feature.
Free tools Windows power users keep installed
One-click scans. No signup required.
Orchestrator capacity
Orchestrator adds VM scheduling and virtualization overhead. The controller can adjust the VM pool, but each VM consumes node CPU, memory, storage and a virtualization device. Pre-warmed replicas trade idle resource consumption for shorter provisioning time. If KubeVirt cannot place a VM, if a node lacks /dev/kvm, or if the storage class cannot provision the disk, increasing the desired replica count will not solve the underlying constraint.
For all three models, collect the same decision data during a pilot: queue wait, time to usable execution environment, job duration, cleanup time, failure rate, peak utilization and capacity consumed per concurrent job. The documentation does not provide a universal performance or cost benchmark, so these measurements must come from representative builds on your infrastructure.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security and isolation are design responsibilities
Self-hosted jobs run with the privileges available to the task agent or configured runner user. CircleCI warns that granting a job access to a Docker daemon is equivalent to granting root access to the machine. Treat Docker-socket exposure, privileged containers, host mounts, cloud credentials and internal-network access as explicit exceptions, not defaults. See the self-hosted runner FAQs.
Untrusted forked pull-request jobs require a separate decision. CircleCI’s runner concepts documentation identifies risks including malicious code, access to the machine or network and unwanted persistent data. Do not route untrusted code to a runner that can reach production systems, long-lived credentials or another team’s builds.
Machine Runner controls
- Use disposable hosts or verified reset procedures for untrusted workloads.
- Run the agent as a least-privileged user and avoid sharing host credentials.
- Restrict network egress and block access to sensitive control planes.
- Never assume that deleting a workspace removes processes, package changes, caches or credentials left elsewhere on the host.
Container Runner controls
- Use pod security settings, namespaces, service-account boundaries and network policies appropriate to the code’s trust level.
- Avoid privileged pods and hostPath mounts unless the build requirement is documented and isolated.
- Separate trusted release workloads from untrusted pull-request workloads with node pools, namespaces or clusters where necessary.
- Secure the Kubernetes API, container registry, secrets system and admission path; pod ephemerality does not secure the control plane.
Orchestrator controls
- Harden the VM image and ensure the runner user cannot access host or KubeVirt control-plane credentials.
- Review VM network attachments, storage mounts, cloud-init data and any guest-agent channels.
- Separate VM pools by trust level when a single pool would allow sensitive and untrusted jobs to share infrastructure.
- Protect KubeVirt and Kubernetes permissions; a VM boundary is not proof of security without correct host and control-plane configuration.
These mechanisms describe different boundaries, not a quantified security ranking. The cited documentation does not constitute a comparative security audit of the three architectures.
Operations and failure modes
| Symptom | Likely layer | What to check |
|---|---|---|
| Jobs remain queued with machine runners | Host fleet | Runner registration, host health, resource-class assignment, available capacity and image-boot automation |
| Container jobs remain pending | Kubernetes capacity or policy | Node resources, quotas, taints, affinity, pod limits, IP capacity, image pulls and cluster autoscaling |
| Orchestrator jobs cannot obtain a VM | KubeVirt or VM pool | Controller reconciliation, pool replicas, VM template, storage provisioning, node resources and /dev/kvm |
| Builds see stale files or processes | Persistent execution environment | Host reset and replacement policy, VM recycling, mounts, caches and cleanup hooks |
| Jobs fail only when Docker is used | Privilege and daemon design | Docker socket exposure, daemon availability, user permissions, privileged settings and network policy |
| Forked pull requests reach sensitive systems | Trust-boundary design | Resource-class routing, secrets exposure, network egress, service accounts and workload separation |
Keep ownership boundaries visible in runbooks. A CircleCI-side queue issue, a pod scheduling issue, a KubeVirt reconciliation issue and an exhausted node pool require different responders and different evidence.
A practical evaluation plan
- Classify builds. Record whether each representative workflow requires a full OS, privileged Docker, hardware, service containers, persistent caches or access to internal networks.
- Define trust tiers. Separate release, internal branch and forked pull-request workloads before choosing an execution boundary.
- Choose two candidate architectures. Compare Container Runner with Machine Runner for container-capable jobs; add Orchestrator only where VM behavior is a real requirement.
- Build equivalent images and policies. Keep tools, source revisions, cache strategy, network rules and secrets handling as similar as each architecture permits.
- Measure under realistic concurrency. Capture queue wait, environment-start time, build duration, failure recovery and resource consumption at normal and burst load.
- Induce failures. Drain nodes, exhaust capacity, break image pulls, remove a VM, restart the controller and test a dirty workspace. Verify that jobs fail safely and recover predictably.
- Document ownership. Name who patches hosts, upgrades Kubernetes and KubeVirt, expands capacity, rotates tokens, handles incidents and approves privileged workloads.
- Adopt a workload-specific standard. It is valid to run container-native builds on Container Runner while retaining machine runners for operating-system-specific or hardware-dependent jobs.
Bottom-line decision rules
- Pick Machine Runner when the complete host environment is the requirement and Kubernetes would add operational complexity without solving a real problem.
- Pick Container Runner when builds are containerized and your team can operate Kubernetes capacity, policy and security. Remember that pod scaling does not scale the cluster.
- Pick Machine Runner Orchestrator when builds need full VMs, your organization already accepts Kubernetes operations, and you can run KubeVirt with hardware-assisted virtualization. Budget for both cluster and VM-platform expertise.
- Do not pick on isolation language alone. The effective security boundary is determined by privileges, credentials, network access, cleanup and the trustworthiness of code admitted to each runner.
- Use a pilot for uncertain cases. Queue latency, utilization and cost depend on your builds and infrastructure; the official documentation does not establish a universal winner or comparative benchmark.
Frequently Asked Questions
Can Container Runner execute a job that requires a full operating system rather than a container?
Not as the same execution model. Container Runner schedules the job in a Kubernetes pod. If the workflow depends on a complete VM or host operating system, use Machine Runner or Machine Runner Orchestrator and validate the required OS and dependencies.
Does Machine Runner Orchestrator install KubeVirt for me?
No. The Orchestrator controller chart does not install KubeVirt. KubeVirt, compatible cluster infrastructure and hardware-assisted virtualization must be prepared separately.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWho is responsible when Container Runner pods cannot be scheduled?
The operator is responsible for supplying sufficient Kubernetes capacity and policy configuration. Check node resources, quotas, taints, limits, storage and networking; CircleCI’s pod scheduling does not add cluster nodes.
Is a VM automatically clean after an Orchestrator job?
The VM lifecycle is controlled by the pool configuration, but cleanup and recycling behavior must be validated in your deployment. Define how disks, credentials, processes and other job-created state are removed before production use.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
