GitHub Actions Runners: GitHub-Hosted & Self-Hosted

GitHub Actions runners are the servers that execute your workflow jobs. You can use GitHub-hosted runners or host your own for custom hardware and software requirements.

What You'll Learn

In this tutorial, you'll learn the differences between GitHub-hosted and self-hosted runners, how to set up a self-hosted runner, how to use runner labels to target specific runners, and best practices for runner security and maintenance.

Why It Matters

Choosing the right runner type affects workflow speed, cost, and capabilities. GitHub-hosted runners require zero maintenance but have hardware limits. Self-hosted runners give you full control over CPU, memory, GPU, and installed software, but require ongoing maintenance and security hardening.

Real-World Use

Durga Antivirus Pro uses GitHub-hosted runners for unit tests and linting. For integration tests that require GPU access for malware detection model evaluation, they use self-hosted runners on AWS EC2 GPU instances with custom labels.

GitHub-Hosted Runners

GitHub provides runners for Linux, Windows, and macOS:

jobs:
  test-linux:
    runs-on: ubuntu-latest

  test-windows:
    runs-on: windows-latest

  test-macos:
    runs-on: macos-latest

Hardware Specifications

Self-Hosted Runners

Register a self-hosted runner on a machine you control:

jobs:
  build:
    runs-on: self-hosted
    steps:
      - uses: actions/checkout@v4
      - run: make build

Adding Labels

Assign labels for targeted job routing:

jobs:
  gpu-test:
    runs-on: [self-hosted, linux, gpu]
    steps:
      - run: nvidia-smi

Installing a Self-Hosted Runner

# Create a folder
mkdir actions-runner && cd actions-runner

# Download the runner package
curl -o actions-runner-linux-x64-2.317.0.tar.gz -L \
  https://github.com/actions/runner/releases/download/v2.317.0/actions-runner-linux-x64-2.317.0.tar.gz

# Extract and configure
tar xzf actions-runner-linux-x64-2.317.0.tar.gz
./config.sh --url https://github.com/your-org/your-repo --token YOUR_TOKEN

Security Considerations

Self-hosted runners can run arbitrary code from any workflow. Mitigate risks:

• Use self-hosted runners only for private repositories you trust
• Isolate runners in a secure network segment
• Apply regular OS and Docker updates
• Use ephemeral runners for public repositories
• Never store secrets on runner machines

Practice Questions

1. What are the three OS options for GitHub-hosted runners? Ubuntu Linux, Windows Server, and macOS.

2. How do you target a specific self-hosted runner? Use the runs-on key with a label or label array that matches your runner configuration.

3. What is a key security risk of self-hosted runners? Workflows can execute arbitrary code on the runner machine. Compromised workflows in public repositories can access the runner and any connected resources.

4. What is an ephemeral runner? A runner that is created for a single job and destroyed afterward, reducing the risk of data persistence between workflows.

5. Challenge: Set up a self-hosted runner on a local machine or VM. Register it with a test Repository and run a workflow that uses it.

Mini Project: Hybrid Runner Infrastructure

Design a workflow that uses GitHub-hosted runners for linting and unit tests, and a self-hosted runner with a gpu label for Machine Learning model evaluation. The workflow should pass build artifacts from the lint job to the evaluation job.

Built by the developers of Doda Browser, DodaZIP, and Durga Antivirus Pro.