Permanent privileged runners — long-lived self-hosted runners with standing credentials

A permanent self-hosted runner is a host an attacker inherits - always on, registered, holding a long-lived cloud key, and answering every PR the forge sends. The first untrusted PR that runs sudo has not broken out of a sandbox; it has landed on a host whose privileges are the runner’s.

Three shapes the violation takes

• Always-on VM. Linux host registered 24/7 with sudo and a stale ~/.aws/credentials.
• Shared Docker socket. /var/run/docker.sock mounted into every job; docker run --privileged escapes to the host as root.
• Persistent cloud key. AWS_ACCESS_KEY_ID exported from a startup script and reused across every job.

    flowchart LR
        A["Always-on runner VM"] --> D["Standing privilege"]
        B["Mounted Docker socket"] --> D
        C["Persistent cloud key"] --> D
        D --> E["Compromised PR pivots to host"]
        D --> F["Compromised PR pivots to cloud"]
        D --> G["Credentials reused across jobs"]
        D --> H["No job-to-job isolation"]

Why a runner that never restarts never re-checks trust

Ephemeral runners flip the model: the host boots with no credentials; the job requests an OIDC token (short-lived, scoped to repo and branch); the host terminates; the token is revoked. A permanent runner skips every step, and the ~/.aws/credentials from the previous job stays on disk.

What ephemeral runners with OIDC look like

Ephemeral runners. Actions Runner Controller scales a Kubernetes pod per job; --ephemeral runners register, take one job, and unregister. OIDC federation. The cloud never sees a long-lived key; it sees a token issued by the forge, scoped to the repository and branch, with a sub claim naming the workflow. The trust policy in cloud IAM decides whether the token may assume a role.

Production discipline

1. Runners are ephemeral by default.
2. Standing credentials are forbidden on runner hosts. ~/.aws/credentials is minted per job by OIDC.
3. The Docker socket is not mounted.

Cross-course references

• This course, Part XLI (RunnerSecurity) - runner threat model, Docker socket risk.
• This course, Part XLIII (OIDC) - OIDC federation.
• Linux for Production Sysadmins, Part XII (RepoSecurity) - package repository trust.

Quiz