CI Runner

A CI runner is the machine, physical or virtual, that executes the jobs of a CI/CD pipeline. It receives a job from the CI service, checks out the code, runs the steps and reports the results back. Jenkins and Azure Pipelines call the same thing an agent; other systems call it an executor.

How a runner works in GitHub Actions

A workflow's runs-on labels decide which runner gets a job: GitHub looks for an online runner that matches the job's labels and groups, and a job that no runner picks up stays queued and fails after 24 hours (GitHub's self-hosted runner reference). The runner application connects out to GitHub over HTTPS to receive jobs, streams logs back while the job runs and, on an ephemeral runner, is discarded afterwards.

GitHub is the control plane: it holds the repository, the workflow files, the secrets store, the logs and the checks. The runner does the work.

Three kinds of runner

• Hosted by the CI vendor. GitHub-hosted runners give each job a fresh virtual machine and are billed in build minutes.
• Self-hosted. Your own machines, which you patch, isolate and scale. See managed vs self-hosted runners.
• Third-party managed runners. A provider runs the machines, which register with GitHub as self-hosted runners. See GitHub Actions runner providers compared.

A runner is either ephemeral, one job on a fresh machine, or persistent, many jobs on the same machine. Ephemeral runners are safer: nothing one job leaves behind, files or credentials, reaches the next.

Why the runner matters for security

The runner is where source code, secrets and downloaded dependencies come together. It holds the job's tokens and cloud credentials, runs every package install script and makes every network connection the build makes. A compromised dependency acts with the runner's access.

So the runner is a security boundary. Isolate jobs from each other, limit what the runner can reach with an egress policy, and record what each job fetched.

CRACI

CRACI is a GitHub Actions runner. A job moves with runs-on: craci while the workflow stays in GitHub, and runs still appear there. Each job runs in its own isolated virtual machine under an egress policy and produces an SBOM of what it fetched. See CRACI's runners and CRACI vs GitHub-hosted runners.

CRACI runs Linux jobs for GitHub Actions only today. Runners for GitLab CI, Jenkins, Windows or macOS come from those vendors or from self-hosting.