Yes—you can run a self-hosted GitHub Actions runner on a VPS. The practical recipe is to choose a supported Linux image, give it enough CPU, memory, storage and network capacity for your largest workflow, register it at repository or organization scope, install the runner as a systemd service, and route jobs with precise labels.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
The harder decision is security, not installation. A persistent VPS keeps workspaces, caches, tools and credentials between jobs. GitHub recommends self-hosted runners primarily for private repositories because code from forked public repositories can execute on the machine. Use a disposable, ephemeral runner when workloads are untrusted or when you need autoscaling.
As an Amazon Associate I earn from qualifying purchases.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWhen a VPS is a good runner host
A VPS is suitable when three conditions are met: the operating system and CPU architecture are supported, the host can reach GitHub Actions over the network, and the machine has enough resources for the workflow that will run on it. GitHub does not publish one universal VPS size because a documentation build, a large Docker image build and a mobile compilation job have very different requirements.
Supported Linux choices
GitHub documents Linux runner support for Debian 10 or later, Ubuntu 20.04 or later, RHEL 8 or later, Fedora 29 or later, and other distributions listed in its runner reference. Linux runners are available for x64, ARM64 and ARM32 architectures where the selected runner release supports that architecture. Pick an image that receives security updates from its distributor and matches the binaries your workflow needs.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
| Decision | What to verify before creating the VPS |
|---|---|
| Operating system | Use a currently maintained release in GitHub’s supported Linux families; confirm package-manager and compiler compatibility with your workflow. |
| Architecture | Choose x64, ARM64 or ARM32 deliberately. A job requiring x64 binaries will not run correctly on an ARM-only host unless your build explicitly supports cross-compilation. |
| CPU | Size for the largest concurrent build, not the average job. Parallel compilers and compression steps can consume every available core. |
| Memory | Include the operating system, the runner process, compilers, language runtimes, Docker build processes and any service containers. |
| Disk | Allow room for the checkout, dependency caches, Docker layers, temporary build output and uploaded artifacts. Monitor free space rather than relying on the advertised disk size. |
| Network | Provide outbound DNS and HTTPS access to GitHub Actions and the package and container registries your workflows use. Account for artifact and image transfer volume. |
A practical sizing method
List the heaviest workflow that can run at the same time as another job. Add the peak memory of its compiler, test processes and containers; reserve headroom for the operating system and monitoring; then choose the next VPS size above that total. Estimate storage from the largest checkout, package caches, Docker layers and artifacts retained between cleanups. If jobs queue because all runner slots are busy, add another runner or move to an autoscaled design instead of overloading one host.
Network exposure and administration
The runner needs to initiate outbound connections; it does not need to be publicly reachable for GitHub to dispatch jobs. Keep inbound access limited to a restricted SSH path, apply operating-system security updates, disable unused services and run the runner under a dedicated non-root account. These controls reduce the impact of a compromised build without changing the runner’s GitHub registration.
Decide the registration scope and trust boundary
Runner registration can be attached to one repository, an organization, or an enterprise. Repository scope is the narrowest choice and is usually easiest to reason about: only workflows in that repository can target the runner. Organization or enterprise scope is useful for a controlled fleet shared by several repositories, but every repository that can select the runner becomes part of its trust boundary.
Persistent versus disposable execution
A persistent VPS is convenient for warm dependency caches and preinstalled toolchains. It also leaves files, credentials and modified tools behind after a job. Treat every workflow that can reach it as trusted, and design cleanup explicitly.
For untrusted workloads or elastic capacity, register an ephemeral runner with the runner configuration option --ephemeral. GitHub assigns one job, automatically removes the runner registration after that job, and then your automation can wipe or rebuild the VPS. Forward runner logs to external storage before destroying the instance; otherwise a failed, already-removed runner can be difficult to diagnose.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Prepare the VPS and runner account
- Choose the image and region. Select a supported Linux distribution and architecture close to the repositories, registries and deployment targets the workflow uses. Lower latency is helpful for large checkouts and artifacts, but isolation and capacity matter more than a particular region.
- Patch the base system. Apply the image’s current security updates, configure time synchronization and install only the administration packages you need.
- Create a dedicated account. Make a non-root service user and a directory owned by that user. For example, an administrator can create an account named
actionsand a directory such as/opt/actions-runner, then grant ownership to that account. Do not run workflow steps as root. - Restrict SSH. Use key-based authentication, limit source addresses where practical, and keep the runner’s inbound firewall policy closed except for your administration path.
Log in as the dedicated account before extracting the runner. Keeping the files and service owned by one account makes permissions predictable and limits accidental access to system directories.
Recommended Free Tools
Register the runner from GitHub
Registration is performed from the repository or organization that will use the machine:
- Open the repository or organization on GitHub and go to Settings → Actions → Runners → New self-hosted runner.
- Select Linux and the VPS architecture. GitHub displays the current runner release, download command, checksum instructions and configuration command for that selection.
- On the VPS, create the dedicated directory, download the archive shown on that page, verify it using the checksum instructions, and extract it. Release filenames and checksums change, so copy the current commands from GitHub rather than embedding an old download URL in a script or article.
- Copy the generated registration token into the configuration command immediately. The token is valid for one hour only. If it expires, return to the same Settings page and generate a new token; do not keep an old token in shell history, tickets or configuration files.
- Give the runner a name that identifies its host or purpose. A name such as
build-vps-01is more useful during incident response than a default generated name. - Accept or set labels that describe the machine’s actual capabilities. Keep the standard labels for self-hosted, operating system and architecture, and add custom labels only for software that is installed and maintained on this host.
The configuration command asks for the GitHub URL, token, runner name and labels. At repository scope, use that repository’s URL; at organization scope, use the organization URL. The command and token shown in the GitHub interface are authoritative for your account and should not be replaced with a copied command from another installation.
Example configuration sequence
The exact URL, token and release filename are generated per registration, but the sequence on the VPS is consistent:
cd /opt/actions-runner
# Run the download command displayed by GitHub, then verify and extract it.
tar -xzf actions-runner-linux-*.tar.gz
# Run the ./config.sh command displayed by GitHub with the fresh token.
Do not publish the token in a workflow, commit it to a repository, or pass it through a long-lived environment variable. It grants registration authority, not permission to deploy your application, but exposure still lets someone attach an unwanted runner to the selected scope.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Install the runner as a systemd service
Running ./run.sh in an SSH session is useful for a quick diagnostic, but it stops when the session ends and will not recover after a reboot. Install the Linux runner as a service so systemd starts it with the VPS and records its state.
- From the runner directory, use the runner’s service script to install the service for the dedicated account. The standard command is
sudo ./svc.sh install actionswhen the account is namedactions. - Start it with
sudo ./svc.sh start. The script creates the systemd unit using the runner’s configured name and directory. - Check the service with
sudo ./svc.sh status. Also check the host’s systemd journal if the service exits immediately. - Return to Settings → Actions → Runners and confirm that the runner is shown as Idle or Online, rather than Offline.
The official actions/runner automation project also provides a create-latest-svc.sh flow. That automation resolves the latest runner release, obtains a registration token, configures the runner, and creates a systemd service. It accepts scope, runner name, service user and labels, which is useful when provisioning repeatable VPS instances. Review the script and its permissions before running it with administrative privileges.
Validate with a small trusted workflow
Before sending a production build to the VPS, run a minimal workflow from a trusted branch. Have it print the operating-system name, architecture and versions of the tools your build depends on. Avoid printing environment variables, secret values, full configuration files or directory listings that could contain credentials. Confirm that the job starts on the intended labels, completes, and leaves the runner online for the next job.
Use labels to route jobs correctly
Labels are cumulative routing constraints. A job that declares runs-on: [self-hosted, linux, x64] can run only on a runner carrying all three labels. If one label is absent, the job remains queued even if the machine otherwise looks suitable.
jobs:
build:
runs-on: [self-hosted, linux, x64]
steps:
- uses: actions/checkout@v4
- run: ./ci/build.sh
Use custom labels for capabilities that would make a job fail on another host. Examples include docker-build, arm64, gpu or a label for a particular compiler toolchain. Do not add a label merely to make a runner appear more powerful: a label is a promise to every workflow that selects it. If Docker is removed or a compiler is upgraded incompatibly, update the labels at the same time.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Diagnose a job that stays queued
- Compare every label in
runs-onwith the runner’s label list, including capitalization. - Confirm the runner is online and assigned to the repository or organization in which the job runs.
- Check whether another job already occupies the runner; a single runner processes one job at a time.
- Verify that an organization or enterprise policy allows the repository to use the runner group.
Install Docker only when the workflow requires it
Self-hosting does not automatically require Docker. Install and maintain Docker on the Linux VPS when workflows use Docker container actions or service containers; GitHub’s runner guidance requires both a Linux machine and Docker for those features. A workflow that runs ordinary shell commands, language actions and binaries can operate without Docker.
If Docker is installed, treat access to the Docker socket as a privileged capability. Add only the runner service account that needs it, keep Docker patched, remove unused images and volumes, and use a custom label such as docker-build so jobs that assume Docker are not routed to a plain runner. Account for image layers and build cache in the disk budget.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Operate and monitor the VPS runner
Routine checks
- Service: verify the systemd unit is active after reboot and inspect its journal when a job cannot start.
- Capacity: monitor CPU saturation, memory pressure, disk consumption, inode usage and network transfer. A runner that is technically online can still fail builds when the disk is full or the kernel is reclaiming memory.
- Job behavior: watch queue time and duration. Increasing duration can indicate exhausted caches, a dependency mirror problem or a host that has outgrown its workload.
- Workspace hygiene: remove temporary output and stale Docker layers according to a tested retention policy. Never delete files while a job is running.
- Security: apply OS, Docker and runner updates; review SSH access and the repositories permitted to target the machine.
Runner updates
The runner application normally updates itself when a new release is available. GitHub warns that a critical runner security update can prevent new jobs from being queued until the runner is updated. If you build an image with automatic updates disabled, rebuild or replace that image on a defined schedule and test the replacement before directing production jobs to it.
Remove a runner cleanly
Before deleting the VPS, stop and uninstall the service and remove the runner registration using the official removal flow or the runner automation scripts. A clean removal prevents an offline machine from remaining in the repository’s runner list and avoids confusion when a replacement uses the same name. Destroy any local credentials and persistent disks after confirming that required logs and artifacts have been retained elsewhere.
Security controls for pull requests and secrets
A workflow can execute arbitrary code through build scripts, dependency hooks and generated files. On a persistent runner, that code can inspect leftovers from previous jobs, read files accessible to the service account, or abuse installed tools. Keep deployment credentials off general-purpose build runners whenever possible; if a job must deploy, use a narrowly scoped token and a separate, tightly controlled runner.
- Prefer private repositories for persistent self-hosted runners. GitHub explicitly recommends using self-hosted runners only with private repositories.
- Do not allow unreviewed pull-request code from forks to run on a machine that contains secrets or access to production systems.
- Use least-privilege repository, cloud and package-registry credentials, and scope them to the job that needs them.
- Separate build and deployment runners with different labels, accounts, network paths and credentials.
- Clear workspaces, temporary files and caches that can contain secrets or source code after each job.
- For public or otherwise untrusted workloads, provision an ephemeral runner, forward its logs, then wipe or rebuild the VPS after the single job.
These measures do not make executing hostile code harmless; they reduce the amount of trust placed in any one runner and limit the consequences of a compromised job.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose between persistent, ephemeral and GitHub-hosted execution
| Characteristic | Persistent VPS runner | Ephemeral VPS runner | GitHub-hosted runner |
|---|---|---|---|
| Isolation after a job | Requires explicit cleanup; files, caches and tools remain. | Runner is removed after one job; automation can rebuild the host. | Managed fresh-environment behavior according to the selected hosted image. |
| Startup latency | Low while the VPS is running. | Includes provisioning and registration time. | Managed by GitHub and varies with availability. |
| Cache persistence | Strong; local caches can speed repeated builds. | Limited unless caches are stored externally. | Depends on the hosted workflow’s cache mechanisms. |
| Elasticity | Fixed capacity unless you add machines manually. | Well suited to automated scale-out. | Capacity is provided as part of the hosted service. |
| Administration | You patch the OS, runner, tools, Docker and monitoring. | You also maintain image and provisioning automation. | GitHub maintains the runner host; you still maintain workflow dependencies. |
| Secret exposure | Highest persistence risk; isolate trusted repositories and credentials. | Lower cross-job persistence risk, but the active job still controls its host. | Uses GitHub’s hosted isolation model and applicable repository controls. |
| Cost shape | Continuous VPS cost, whether busy or idle. | Instance and provisioning cost follows workload, with automation overhead. | Governed by the hosted service’s included minutes and billing terms. |
GitHub recommends ephemeral self-hosted runners for autoscaling rather than scaling persistent runners. Persistent VPS machines remain attractive when predictable workloads, low latency and warm caches outweigh the additional security and maintenance responsibility.
Troubleshoot common failures
The runner is offline immediately after installation
Check the systemd status and journal first. An incorrect service user, a directory owned by root, a missing shared library, a blocked outbound DNS or HTTPS connection, or a host reboot can all stop the process. Run the runner interactively as the service account to expose startup errors, then restart the service after correcting permissions or network policy.
The registration token is rejected
Generate a new token and configure again. Registration tokens expire after one hour and are scoped to the repository, organization or enterprise where they were created. A token copied from another scope will not register the runner you intended.
A job reports that no runner matches
Inspect the job’s complete runs-on list, then compare it with the runner’s labels and scope. Remove a custom label only if the workflow does not truly need that capability; otherwise install and verify the required tool and keep the label.
Docker steps fail while shell steps work
Confirm that Docker is installed, the daemon is running, the runner account has the required permission, and the VPS has sufficient disk space for images and layers. Ensure the workflow targets the Docker-capable label rather than a generic self-hosted label.
The runner stopped accepting jobs after an update notice
Check the runner version and update it through the current GitHub instructions. Critical security updates can block new job assignment until the application is current. For image-based fleets, publish a rebuilt image and replace instances according to your rollout plan.
What to document before handing the runner to a team
- The repository, organization or enterprise scope and the exact runner labels.
- The Linux distribution, architecture, CPU and memory size, disk layout and region.
- Which Docker, compiler, SDK and deployment tools are installed, including their update owner.
- The systemd service name, log location and restart procedure.
- Firewall and SSH rules, service-account permissions and secret-storage boundaries.
- Disk-cleanup, patching, runner-update and decommissioning schedules.
- Whether the machine is persistent or ephemeral, and where ephemeral logs are retained.
With those details recorded, a VPS runner is straightforward to operate: GitHub supplies the registration interface and runner software, while you supply the capacity, isolation and maintenance discipline that make self-hosting safe.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
