Before deploymentci-runner-security

CI Runner Security Checklist

16 items ·9 critical ·7 warn ·0 info

How to use this checklist

This is the runner-side companion to the CI Pipeline Security checklist. A pipeline that asks the right questions about secrets and OIDC still fails if the runner it runs on can be turned into a general-purpose foothold.

Treat this as the gate a self-hosted runner pool must pass before production credentials land on it. Hosted runners are evaluated against the items the platform covers (ephemeral execution, network egress, isolation between forks); everything else still applies to the host that runs them.

Sign-off

Every critical item must pass. A failing critical item blocks the runner from being granted production credentials; it is not a note for later. Record the date, the reviewer, and the disposition of every item that did not pass.

Critical9 items

Production-bound runners are ephemeral: a fresh VM or container is created for each job and destroyed afterwards. No persistent runner carries state, caches, or credentials between unrelated jobs.
No runner mounts the host Docker socket (`/var/run/docker.sock`) into job containers. Docker-in-Docker is used for nested builds, and the host socket is treated as root-equivalent.
```
grep -RIn -E "docker\.sock|/var/run/docker" .github/ .gitlab-ci.yml runners/ 2>/dev/null || echo "no Docker socket mounts found"
```
Job containers do not run in `--privileged` mode unless explicitly required, and the list of jobs that need it is reviewed and minimal. `--cap-add` is used instead of `--privileged` whenever possible.
Runner network egress is restricted to the registries, secret stores, and APIs the runner needs (an allow-list, not a block-list). Egress to arbitrary internet destinations is logged or denied.
Production secrets do not live on disk on a persistent runner. They are fetched at job start via OIDC, sealed secrets, or a short-lived secret fetch, and are not written to the runner filesystem beyond the job lifetime.
Runner pools are segregated: a pool that runs untrusted (fork) PRs is physically or namespace-separated from the pool that holds production credentials. A pool boundary is enforced, not implied.
CI caches are scoped per-branch or per-PR and never shared across forks. A poisoned cache (rebuilt under a malicious commit) cannot be picked up by a different branch or repo.
Artifacts produced by untrusted (fork) PR jobs are not consumed by other jobs. They are uploaded to a separate path or namespace and discarded if the PR is closed.
A runner-compromise runbook exists, has been read by someone other than its author, and includes: drain the runner pool, revoke the credentials it had access to, identify which jobs ran on the affected runner, and quarantine those artifacts.

Warning7 items

Self-hosted runner hosts run a minimal OS image, are patched on a known schedule, have SSH disabled except through a bastion, and have audit logging enabled (auditd, syslog forwarding) to a SIEM.
Runner autoscaling is configured with a maximum size and a queue depth alarm, so that a malicious or runaway job cannot provision an unbounded number of nodes (and bill, or worse, exfiltrate to).
Build steps that need root do not use sudo on a shared host. They use user namespace remapping, a build container with the right capabilities, or a single-purpose ephemeral VM.
Each runner has a unique identity (instance tag, label, certificate), and that identity is recorded in every deploy. A deploy from "a runner" with no recorded identity is rejected.
Runner base images (the image a self-hosted runner boots from) come from a controlled registry, are scanned, and are rebuilt on a schedule — not frozen at "the image we set up last year".
The runner binary itself is pinned to a known version per pool, and upgrades are deliberate (not auto-updated by the platform). A runner that silently updated itself overnight is a finding, not a feature.
Build steps that compile or pull dependencies do not have unrestricted egress to the public internet. The dependency mirror or cache is the default destination, and direct public pulls are audited.