GitHub Actions Runner, Self-Hosted

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Run GitHub Actions on your own AWS infrastructure

This image delivers the official self hosted runner agent for GitHub Actions, fully installed, dependency resolved, and ready to accept jobs within minutes of launch. Instead of relying on GitHub hosted runners, you execute workflows on machines you control inside your own VPC.

Why self host? You need a self hosted runner when a job must reach a private network, use hardware or software the hosted runners do not offer, run inside your own compliance boundary, or simply run longer or more often than hosted minutes allow.

## How it works

The runner opens an outbound long poll connection to GitHub and waits to be handed a job. It never listens for inbound CI traffic, so this image opens no inbound port other than SSH for your own management. There is nothing to expose to the internet and nothing to put behind a load balancer.

## Pre installed toolchain

• git for checkout, which is where every workflow starts
• Docker for container jobs and service containers
• C and C++ build toolchain with make and pkg-config
• Python with pip and venv
• Utilities: jq, rsync, zip, unzip, tar, curl and wget

Every included package is documented explicitly in the deployment guide, because a build image that quietly accumulates packages is a liability rather than a convenience.

## Security by design

• No credentials shipped. The image contains no GitHub token and no runner registration. A registration token is short lived and specific to your organisation, and the credentials it is exchanged for grant the holder the ability to pick up your jobs, so shipping either would let anyone launching this image join your continuous integration.
• Gated startup. The runner service is installed but intentionally disabled, and gated on the registration state file, so it cannot start until you complete registration.
• Non root execution. The runner agent runs under a dedicated service account with no password and no sudo rights, because a runner executes whatever code your workflows contain.
• Unique identity. On first boot the instance generates a unique runner name and writes the registration instructions to a root only file, so several instances can join one organisation without colliding.
• Verifiable. A self test ships on the image and proves, on your own instance, that the agent runs, that the service is correctly disabled, and that no credential artifact is present anywhere.

## Getting started

1. Launch the image in your preferred AWS region and instance type.

2. Connect over SSH.

3. Generate a runner registration token in your GitHub repository or organisation settings.

4. Run the configuration command shown in the instructions file on the instance.

5. Enable the systemd service.

6. Your runner appears in your GitHub settings and begins accepting jobs.

## Evaluate at low cost

Launch a single instance on a small instance type to validate the runner against your workflows before scaling to a fleet. The registration and first job flow can be verified in a single session.

## Support

cloudimg engineers can help you plan runner groups and labels, scale to a fleet, harden the execution environment for untrusted code, wire up caching and container jobs, configure network and security group rules, and keep the runner version current after purchase.

Review the deployment guide linked in Additional Resources for the full package manifest and the security overview.

GitHub and GitHub Actions are trademarks of GitHub, Inc. cloudimg is not affiliated with, endorsed by, or sponsored by GitHub, Inc. or Microsoft. All other product and company names are trademarks or registered trademarks of their respective holders.