Find information about setting up and using self-hosted runners.
Requirements for self-hosted runner machinesYou can use a machine as a self-hosted runner as long as it meets these requirements:
x64
- Linux, macOS, Windows.ARM64
- Linux, macOS, Windows (currently in public preview).ARM32
- Linux.When routing a job to a self-hosted runner, GitHub looks for a runner that matches the job's runs-on
labels and groups:
runs-on
labels and groups, the job is then assigned and sent to the runner.
runs-on
labels and groups, then the job will remain queued until a runner comes online.You can automatically increase or decrease the number of self-hosted runners in your environment in response to the webhook events you receive with a particular label.
Supported autoscaling solutionsGitHub-hosted runners inherently autoscale based on your needs. GitHub-hosted runners can be a low-maintenance and cost-effective alternative to developing or implementing autoscaling solutions. For more information, see GitHub-hosted runners.
The actions/actions-runner-controller (ARC) project is a Kubernetes-based runner autoscaler. GitHub recommends ARC if the team deploying it has expert Kubernetes knowledge and experience.
For more information, see Actions Runner Controller and Support for Actions Runner Controller.
Ephemeral runners for autoscalingGitHub recommends implementing autoscaling with ephemeral self-hosted runners; autoscaling with persistent self-hosted runners is not recommended. In certain cases, GitHub cannot guarantee that jobs are not assigned to persistent runners while they are shut down. With ephemeral runners, this can be guaranteed because GitHub only assigns one job to a runner.
This approach allows you to manage your runners as ephemeral systems, since you can use automation to provide a clean environment for each job. This helps limit the exposure of any sensitive resources from previous jobs, and also helps mitigate the risk of a compromised runner receiving new jobs.
Warning
The runner application log files for ephemeral runners must be forwarded to an external log storage solution for troubleshooting and diagnostic purposes. While it is not required for ephemeral runners to be deployed, GitHub recommends ensuring runner logs are forwarded and preserved externally before deploying an ephemeral runner autoscaling solution in a production environment. For more information, see Monitoring and troubleshooting self-hosted runners.
To add an ephemeral runner to your environment, include the --ephemeral
parameter when registering your runner using config.sh
. For example:
./config.sh --url https://github.com/octo-org --token example-token --ephemeral
The GitHub Actions service will then automatically de-register the runner after it has processed one job. You can then create your own automation that wipes the runner after it has been de-registered.
Note
If a job is labeled for a certain type of runner, but none matching that type are available, the job does not immediately fail at the time of queueing. Instead, the job will remain queued until the 24 hour timeout period expires.
Alternatively, you can create ephemeral, just-in-time runners using the REST API. For more information, see REST API endpoints for self-hosted runners.
Runner software updates on self-hosted runnersBy default, self-hosted runners will automatically perform a software update whenever a new version of the runner software is available. If you use ephemeral runners in containers then this can lead to repeated software updates when a new runner version is released. Turning off automatic updates allows you to update the runner version on the container image directly on your own schedule.
To turn off automatic software updates and install software updates yourself, specify the --disableupdate
flag when registering your runner using config.sh
. For example:
./config.sh --url https://github.com/YOUR-ORGANIZATION --token EXAMPLE-TOKEN --disableupdate
If you disable automatic updates, you must still update your runner version regularly. New functionality in GitHub Actions requires changes in both the GitHub Actions service and the runner software. The runner may not be able to correctly process jobs that take advantage of new features in GitHub Actions without a software update.
If you disable automatic updates, you will be required to update your runner version within 30 days of a new version being made available. You may want to subscribe to notifications for releases in the actions/runner
repository. For more information, see Configuring notifications.
For instructions on how to install the latest runner version, see the installation instructions for the latest release.
Warning
Any updates released for the software, including major, minor or patch releases, are considered as an available update. If you do not perform a software update within 30 days, the GitHub Actions service will not queue jobs to your runner. In addition, if a critical security update is required, the GitHub Actions service will not queue jobs to your runner until it has been updated.
Webhooks for autoscalingYou can create your own autoscaling environment by using payloads received from the workflow_job
webhook. This webhook is available at the repository, organization, and enterprise levels, and the payload for this event contains an action
key that corresponds to the stages of a workflow job's life-cycle; for example when jobs are queued
, in_progress
, and completed
. You must then create your own scaling automation in response to these webhook payloads.
workflow_job
webhook, see Webhook events and payloads.You can register and delete repository and organization self-hosted runners using the API. To authenticate to the API, your autoscaling implementation can use an access token or a GitHub app.
Your access token will require the following scope:
repo
scope.public_repo
scope.admin:org
scope.To authenticate using a GitHub App, it must be assigned the following permissions:
administration
permission.organization_self_hosted_runners
permission.You can register and delete enterprise self-hosted runners using the API. To authenticate to the API, your autoscaling implementation can use an access token.
Your access token will require the manage_runners:enterprise
scope.
Self-hosted runners connect to GitHub to receive job assignments and download new versions of the runner application.
The GitHub Actions runner application is open source. You can contribute and file issues in the runner repository. When a new version is released, the runner application automatically updates itself when a job is assigned to the runner, or within a week of release if the runner hasn't been assigned any jobs.
Requirements for communication with GitHubNote
Some of the domains listed are configured using CNAME
records. Some firewalls might require you to add rules recursively for all CNAME
records. Note that the CNAME
records might change in the future, and that only the domains listed will remain constant.
Needed for essential operations:
Shellgithub.com api.github.com *.actions.githubusercontent.com
github.com
api.github.com
*.actions.githubusercontent.com
Needed for downloading actions:
Shellcodeload.github.com pkg.actions.githubusercontent.com
codeload.github.com
pkg.actions.githubusercontent.com
Needed for publishing immutable actions:
Needed for uploading/downloading job summaries, logs, workflow artifacts, and caches:
Shellresults-receiver.actions.githubusercontent.com *.blob.core.windows.net
results-receiver.actions.githubusercontent.com
*.blob.core.windows.net
Needed for runner version updates:
Shellobjects.githubusercontent.com objects-origin.githubusercontent.com github-releases.githubusercontent.com github-registry-files.githubusercontent.com
objects.githubusercontent.com
objects-origin.githubusercontent.com
github-releases.githubusercontent.com
github-registry-files.githubusercontent.com
Needed for retrieving OIDC tokens:
Shell*.actions.githubusercontent.com
*.actions.githubusercontent.com
Needed for downloading or publishing packages or containers to GitHub Packages:
Shell*.pkg.github.com pkg-containers.githubusercontent.com ghcr.io
*.pkg.github.com
pkg-containers.githubusercontent.com
ghcr.io
Needed for Git Large File Storage
Shellgithub-cloud.githubusercontent.com github-cloud.s3.amazonaws.com
github-cloud.githubusercontent.com
github-cloud.s3.amazonaws.com
Needed for jobs for Dependabot updates
Shelldependabot-actions.githubapp.com
dependabot-actions.githubapp.com
Needed for downloading release assets:
Shellrelease-assets.githubusercontent.com
release-assets.githubusercontent.com
Needed for VNet:
Shellapi.snapcraft.io
api.snapcraft.io
In addition, your workflow may require access to other network resources.
If you use an IP address allow list for your GitHub organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. See Managing allowed IP addresses for your organization or Enforcing policies for security settings in your enterprise in the GitHub Enterprise Cloud documentation.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4