Scannability: 'About self-hosted runners' article (#54175)
Co-authored-by: Kevin Heis <heiskr@users.noreply.github.com> Co-authored-by: Siara <108543037+SiaraMist@users.noreply.github.com>
This commit is contained in:
Ben Ahmady
@@ -40,7 +40,7 @@ GitHub Actions usage is free for {% data variables.product.prodname_ghe_server %
|
||||
There are some limits on {% data variables.product.prodname_actions %} usage when using {% data variables.product.prodname_dotcom %}-hosted runners. These limits are subject to change.
|
||||
|
||||
> [!NOTE]
|
||||
> For self-hosted runners, different usage limits apply. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#usage-limits).
|
||||
> For self-hosted runners, different usage limits apply. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/usage-limits-for-self-hosted-runners).
|
||||
|
||||
* **Job execution time** - Each job in a workflow can run for up to 6 hours of execution time. If a job reaches this limit, the job is terminated and fails to complete.
|
||||
{% data reusables.actions.usage-workflow-run-time %}
|
||||
@@ -72,7 +72,7 @@ There are some limits on {% data variables.product.prodname_actions %} usage whe
|
||||
{% data reusables.actions.usage-workflow-queue-limits %}
|
||||
|
||||
{% else %}
|
||||
Usage limits apply to self-hosted runners. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#usage-limits).
|
||||
Usage limits apply to self-hosted runners. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/usage-limits-for-self-hosted-runners).
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
|
||||
@@ -101,7 +101,8 @@ You can find the definition of ARC's runner image in [this Dockerfile](https://g
|
||||
|
||||
You can create your own runner image that meets your requirements. Your runner image must fulfill the following conditions.
|
||||
|
||||
* Use a base image that can run the self-hosted runner application. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).
|
||||
* Use a base image that can run the self-hosted runner application. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners).
|
||||
|
||||
* The [runner binary](https://github.com/actions/runner/releases) must be placed under `/home/runner/` and launched using `/home/runner/run.sh`.
|
||||
* If you use Kubernetes mode, the [runner container hooks](https://github.com/actions/runner-container-hooks/releases) must be placed under `/home/runner/k8s`.
|
||||
|
||||
|
||||
@@ -12,114 +12,33 @@ versions:
|
||||
type: overview
|
||||
---
|
||||
|
||||
{% data reusables.actions.enterprise-github-hosted-runners %}
|
||||
|
||||
## About self-hosted runners
|
||||
|
||||
A self-hosted runner is a system that you deploy and manage to execute jobs from {% data variables.product.prodname_actions %} on {% data variables.product.github %}. For more information about {% data variables.product.prodname_actions %}, see [AUTOTITLE](/actions/learn-github-actions/understanding-github-actions){% ifversion fpt %}."{% elsif ghec or ghes %} and [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/about-github-actions-for-enterprises).{% endif %}
|
||||
A self-hosted runner is a system that you deploy and manage to execute jobs from {% data variables.product.prodname_actions %} on {% data variables.product.github %}.
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-description %} {% data reusables.actions.self-hosted-runner-locations %}
|
||||
Self-hosted runners:
|
||||
|
||||
You can add self-hosted runners at various levels in the management hierarchy:
|
||||
* Repository-level runners are dedicated to a single repository.
|
||||
* Organization-level runners can process jobs for multiple repositories in an organization.
|
||||
* Enterprise-level runners can be assigned to multiple organizations in an enterprise account.
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-architecture %} {% data reusables.actions.runner-app-open-source %} {% ifversion fpt or ghec %} When a new version is released, the runner application automatically updates itself when a job is assigned to the runner, or within a week of release if the runner hasn't been assigned any jobs. {% else ifversion ghes %} When a new version is released, the runner application will automatically update within 24 hours. {% endif %}
|
||||
{% ifversion ghes %}
|
||||
|
||||
> [!NOTE]
|
||||
> {% data reusables.actions.upgrade-runners-before-upgrade-ghes %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-auto-removal %}
|
||||
|
||||
For more information about installing and using self-hosted runners, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners) and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/using-self-hosted-runners-in-a-workflow).
|
||||
|
||||
## Differences between {% data variables.product.prodname_dotcom %}-hosted and self-hosted runners
|
||||
|
||||
{% data variables.product.prodname_dotcom %}-hosted runners offer a quicker, simpler way to run your workflows, while self-hosted runners are a highly configurable way to run workflows in your own custom environment.
|
||||
|
||||
**{% data variables.product.prodname_dotcom %}-hosted runners:**
|
||||
* Receive automatic updates for the operating system, preinstalled packages and tools, and the self-hosted runner application.
|
||||
* Are managed and maintained by {% data variables.product.prodname_dotcom %}.
|
||||
* Provide a clean instance for every job execution.
|
||||
* Use free minutes on your {% data variables.product.prodname_dotcom %} plan, with per-minute rates applied after surpassing the free minutes.
|
||||
|
||||
**Self-hosted runners:**
|
||||
* Receive automatic updates for the self-hosted runner application only, though you may disable automatic updates of the runner. For more information about controlling runner software updates on self-hosted runners, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners#controlling-runner-software-updates-on-self-hosted-runners). You are responsible for updating the operating system and all other software.
|
||||
{% ifversion fpt or ghec %}
|
||||
* Give you more control of hardware, operating system, and software tools than {% data variables.product.prodname_dotcom %}-hosted runners provide.{% endif %}
|
||||
* Are free to use with {% data variables.product.prodname_actions %}, but you are responsible for the cost of maintaining your runner machines.
|
||||
* Let you create custom hardware configurations that meet your needs with processing power or memory to run larger jobs, install software available on your local network.
|
||||
* Receive automatic updates for the self-hosted runner application only, though you may disable automatic updates of the runner.
|
||||
* Can use cloud services or local machines that you already pay for.
|
||||
* Are customizable to your hardware, operating system, software, and security requirements.
|
||||
* Don't need to have a clean instance for every job execution.
|
||||
* Are free to use with {% data variables.product.prodname_actions %}, but you are responsible for the cost of maintaining your runner machines.{% ifversion ghec or ghes %}
|
||||
* Can be organized into groups to restrict access to specific workflows, organizations, and repositories. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups).{% endif %}
|
||||
* Don't need to have a clean instance for every job execution.{% ifversion ghec or ghes %}
|
||||
* Can be organized into groups to restrict access to specific workflows, organizations, and repositories. See [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/managing-access-to-self-hosted-runners-using-groups).{% endif %}
|
||||
* Can be physical, virtual, in a container, on-premises, or in a cloud.
|
||||
|
||||
## Requirements for self-hosted runner machines
|
||||
You can use self-hosted runners anywhere in the management hierarchy. Repository-level runners are dedicated to a single repository, while organization-level runners can process jobs for multiple repositories in an organization. Organization owners can choose which repositories are allowed to create repository-level self-hosted runners. See [AUTOTITLE](/organizations/managing-organization-settings/disabling-or-limiting-github-actions-for-your-organization#limiting-the-use-of-self-hosted-runners). Finally, enterprise-level runners can be assigned to multiple organizations in an enterprise account.
|
||||
|
||||
### Requirements for self-hosted runner machines
|
||||
|
||||
You can use any machine as a self-hosted runner as long at it meets these requirements:
|
||||
|
||||
* You can install and run the self-hosted runner application on the machine. For more information, see [Supported architectures and operating systems for self-hosted runners](#supported-architectures-and-operating-systems-for-self-hosted-runners).
|
||||
* The machine can communicate with {% data variables.product.prodname_actions %}. For more information, see [Communication between self-hosted runners and {% data variables.product.github %}](#communication-between-self-hosted-runners-and-github).
|
||||
* You can install and run the self-hosted runner application on the machine.
|
||||
* The machine can communicate with {% data variables.product.prodname_actions %}.
|
||||
* The machine has enough hardware resources for the type of workflows you plan to run. The self-hosted runner application itself only requires minimal resources.
|
||||
* If you want to run workflows that use Docker container actions or service containers, you must use a Linux machine and Docker must be installed.
|
||||
|
||||
## Autoscaling your self-hosted runners
|
||||
|
||||
You can automatically increase or decrease the number of self-hosted runners in your environment in response to the webhook events you receive. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners).
|
||||
|
||||
## Usage limits
|
||||
|
||||
There are some limits on {% data variables.product.prodname_actions %} usage when using self-hosted runners. These limits are subject to change.
|
||||
|
||||
{% ifversion fpt or ghec or ghes > 3.12 %}- **Job execution time** - Each job in a workflow can run for up to 5 days of execution time. If a job reaches this limit, the job is terminated and fails to complete.{% endif %}
|
||||
{% data reusables.actions.usage-workflow-run-time %}
|
||||
* **Job queue time** - Each job for self-hosted runners that has been queued for at least 24 hours will be canceled. The actual time in queue can reach up to 48 hours before cancellation occurs. If a self-hosted runner does not start executing the job within this limit, the job is terminated and fails to complete.
|
||||
{% data reusables.actions.usage-api-requests %}
|
||||
* **Job matrix** - {% data reusables.actions.usage-matrix-limits %}
|
||||
{% data reusables.actions.usage-workflow-queue-limits %}
|
||||
* **Registering self-hosted runners** - You can have a maximum of 10,000 self-hosted runners in one runner group. If this limit is reached, adding a new runner will not be possible.
|
||||
|
||||
## Workflow continuity for self-hosted runners
|
||||
|
||||
{% data reusables.actions.runner-workflow-continuity %}
|
||||
|
||||
## Supported architectures and operating systems for self-hosted runners
|
||||
|
||||
The following operating systems are supported for the self-hosted runner application.
|
||||
|
||||
### Linux
|
||||
|
||||
* Red Hat Enterprise Linux 8 or later
|
||||
* CentOS 8 or later
|
||||
* Oracle Linux 8 or later
|
||||
* Fedora 29 or later
|
||||
* Debian 10 or later
|
||||
* Ubuntu 20.04 or later
|
||||
* Linux Mint 20 or later
|
||||
* openSUSE 15.2 or later
|
||||
* SUSE Enterprise Linux (SLES) 15 SP2 or later
|
||||
|
||||
### Windows
|
||||
|
||||
* Windows 10 64-bit
|
||||
* Windows 11 64-bit
|
||||
* Windows Server 2016 64-bit
|
||||
* Windows Server 2019 64-bit
|
||||
* Windows Server 2022 64-bit
|
||||
|
||||
### macOS
|
||||
|
||||
* macOS 11.0 (Big Sur) or later
|
||||
|
||||
### Architectures
|
||||
|
||||
The following processor architectures are supported for the self-hosted runner application.
|
||||
|
||||
* `x64` - Linux, macOS, Windows.
|
||||
* `ARM64` - Linux, macOS{% ifversion actions-windows-arm %}, Windows (currently in {% data variables.release-phases.public_preview %}){% endif %}.
|
||||
* `ARM32` - Linux.
|
||||
|
||||
{% ifversion ghes %}
|
||||
|
||||
## Supported actions on self-hosted runners
|
||||
@@ -129,101 +48,12 @@ Some extra configuration might be required to use actions from {% data variables
|
||||
|
||||
{% endif %}
|
||||
|
||||
<a name="communication-requirements"></a>
|
||||
|
||||
## Communication between self-hosted runners and {% data variables.product.github %}
|
||||
|
||||
The self-hosted runner connects to {% ifversion fpt or ghec %}{% data variables.product.github %}{% else %}{% data variables.location.product_location_enterprise %}{% endif %} to receive job assignments and to download new versions of the runner application. The self-hosted runner uses an {% ifversion ghes %}HTTP(S){% else %}HTTPS{% endif %} _long poll_ that opens a connection to {% data variables.product.github %} for 50 seconds, and if no response is received, it then times out and creates a new long poll. The application must be running on the machine to accept and run {% data variables.product.prodname_actions %} jobs.
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-ports-protocols %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
Since the self-hosted runner opens a connection to {% data variables.product.github %}, you do not need to allow {% data variables.product.prodname_dotcom %} to make inbound connections to your self-hosted runner.
|
||||
{% elsif ghes %}
|
||||
Only an outbound connection from the runner to {% data variables.product.prodname_ghe_server %} is required. There is no need for an inbound connection from {% data variables.product.prodname_ghe_server %} to the runner.
|
||||
For caching to work, the runner must be able to communicate with the blob storage and directly download content from it.
|
||||
{%- endif %}
|
||||
|
||||
{% ifversion ghes %}
|
||||
|
||||
{% data variables.product.prodname_ghe_server %} must accept inbound connections from your runners over HTTP(S) at {% data variables.location.product_location %}'s hostname and API subdomain, and your runners must allow outbound connections over HTTP(S) to {% data variables.location.product_location %}'s hostname and API subdomain.
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
|
||||
You must ensure that the machine has the appropriate network access with at least 70 kilobits per second upload and download speed to communicate with the {% data variables.product.prodname_dotcom %} hosts listed below. Some hosts are required for essential runner operations, while other hosts are only required for certain functionality.
|
||||
|
||||
You can use the REST API to get meta information about {% data variables.product.company_short %}, including the IP addresses of {% data variables.product.company_short %} services. For more information about the domains and IP addresses used, see [AUTOTITLE](/rest/meta/meta).
|
||||
|
||||
{% data reusables.actions.domain-name-cname-recursive-firewall-rules %}
|
||||
|
||||
{% data reusables.actions.runner-essential-communications %}
|
||||
|
||||
In addition, your workflow may require access to other network resources.
|
||||
|
||||
If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. For more information, see [Managing allowed IP addresses for your organization](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list) or [Enforcing policies for security settings in your enterprise](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise){% ifversion fpt %} in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}.{% endif %}
|
||||
|
||||
{% else %}
|
||||
|
||||
{% ifversion ghes %}Self-hosted runners do not require any external internet access in order to function. As a result, you can use network routing to direct communication between the self-hosted runner and {% data variables.product.prodname_ghe_server %}. For example, you can assign a private IP address to your self-hosted runner and configure routing to send traffic to {% data variables.product.prodname_ghe_server %}, with no need for traffic to traverse a public network.{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
You can also use self-hosted runners with a proxy server. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners).
|
||||
|
||||
For more information about troubleshooting common network connectivity issues, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#troubleshooting-network-connectivity).
|
||||
|
||||
{% ifversion ghes %}
|
||||
|
||||
## Communication between self-hosted runners and {% data variables.product.prodname_dotcom_the_website %}
|
||||
|
||||
Self-hosted runners do not need to connect to {% data variables.product.prodname_dotcom_the_website %} unless you have enabled automatic access to {% data variables.product.prodname_dotcom_the_website %} actions for {% data variables.product.prodname_ghe_server %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/about-using-actions-in-your-enterprise).
|
||||
|
||||
If you have enabled automatic access to {% data variables.product.prodname_dotcom_the_website %} actions, then the self-hosted runner will connect directly to {% data variables.product.prodname_dotcom_the_website %} to download actions. You must ensure that the machine has the appropriate network access to communicate with the {% data variables.product.prodname_dotcom %} URLs listed below.
|
||||
|
||||
```shell copy
|
||||
github.com
|
||||
api.github.com
|
||||
codeload.github.com
|
||||
pkg.actions.githubusercontent.com
|
||||
```
|
||||
|
||||
{% data reusables.actions.domain-name-cname-recursive-firewall-rules %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
## Self-hosted runner security
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-security %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
|
||||
This is not an issue with {% data variables.product.prodname_dotcom %}-hosted runners because each {% data variables.product.prodname_dotcom %}-hosted runner is always a clean isolated virtual machine, and it is destroyed at the end of the job execution.
|
||||
|
||||
{% endif %}
|
||||
|
||||
Untrusted workflows running on your self-hosted runner pose significant security risks for your machine and network environment, especially if your machine persists its environment between jobs. Some of the risks include:
|
||||
|
||||
* Malicious programs running on the machine.
|
||||
* Escaping the machine's runner sandbox.
|
||||
* Exposing access to the machine's network environment.
|
||||
* Persisting unwanted or dangerous data on the machine.
|
||||
|
||||
For more information about security hardening for self-hosted runners, see [AUTOTITLE](/actions/security-guides/security-hardening-for-github-actions#hardening-for-self-hosted-runners).
|
||||
|
||||
### Restricting the use of self-hosted runners
|
||||
|
||||
{% data reusables.actions.disable-selfhosted-runners-crossrefs %}
|
||||
|
||||
{% ifversion ghec or ghes %}
|
||||
|
||||
## Further reading
|
||||
|
||||
* [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-self-hosted-runners-for-your-enterprise)
|
||||
|
||||
{% endif %}
|
||||
* [AUTOTITLE](/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions)
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/adding-self-hosted-runners)
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/using-self-hosted-runners-in-a-workflow)
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners){% ifversion ghec or ghes %}
|
||||
* [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-self-hosted-runners-for-your-enterprise){% endif %}
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/supported-architectures-and-operating-systems-for-self-hosted-runners)
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners)
|
||||
|
||||
@@ -19,12 +19,10 @@ You can add a self-hosted runner to a repository, an organization, or an enterpr
|
||||
|
||||
If you are an organization or enterprise administrator, you might want to add your self-hosted runners at the organization or enterprise level. This approach makes the runner available to multiple repositories in your organization or enterprise, and also lets you to manage your runners in one place.
|
||||
|
||||
For information on supported operating systems for self-hosted runners, or using self-hosted runners with a proxy server, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).
|
||||
|
||||
> [!WARNING]
|
||||
> {% data reusables.actions.self-hosted-runner-security %}
|
||||
>
|
||||
> For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories).
|
||||
> For more information, see [AUTOTITLE](/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions).
|
||||
|
||||
You can set up automation to scale the number of self-hosted runners. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/autoscaling-with-self-hosted-runners).
|
||||
|
||||
@@ -105,6 +103,7 @@ For more information on changing runner group access settings, see [AUTOTITLE](/
|
||||
|
||||
## Further reading
|
||||
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners)
|
||||
* [AUTOTITLE](/admin/github-actions/getting-started-with-github-actions-for-your-enterprise/getting-started-with-self-hosted-runners-for-your-enterprise)
|
||||
|
||||
{% endif %}
|
||||
|
||||
@@ -0,0 +1,81 @@
|
||||
---
|
||||
title: Communicating with self-hosted runners
|
||||
shortTitle: Self-hosted runner communication
|
||||
intro: 'Your self-hosted runners can communicate with {% ifversion fpt or ghec %}{% data variables.product.github %}{% else %}{% data variables.location.product_location_enterprise %} and {% data variables.product.prodname_dotcom_the_website %}{% endif %}'
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
ghec: '*'
|
||||
type: overview
|
||||
---
|
||||
|
||||
A self-hosted runner connects to {% ifversion fpt or ghec %}{% data variables.product.github %}{% else %}{% data variables.location.product_location_enterprise %}{% endif %} to receive job assignments and to download new versions of the runner application. The self-hosted runner uses an {% ifversion ghes %}HTTP(S){% else %}HTTPS{% endif %} long poll that opens a connection to {% data variables.product.github %} for 50 seconds, and if no response is received, it then times out and creates a new long poll. The application must be running on the machine to accept and run {% data variables.product.prodname_actions %} jobs.
|
||||
|
||||
{% data reusables.actions.runner-app-open-source %} {% ifversion fpt or ghec %} When a new version is released, the runner application automatically updates itself when a job is assigned to the runner, or within a week of release if the runner hasn't been assigned any jobs. {% else ifversion ghes %} When a new version is released, the runner application will automatically update within 24 hours. {% endif %}
|
||||
{% ifversion ghes %}
|
||||
|
||||
> [!NOTE]
|
||||
> {% data reusables.actions.upgrade-runners-before-upgrade-ghes %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-auto-removal %}
|
||||
|
||||
{% data reusables.actions.self-hosted-runner-ports-protocols %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
Since the self-hosted runner opens a connection to {% data variables.product.github %}, you do not need to allow {% data variables.product.prodname_dotcom %} to make inbound connections to your self-hosted runner.
|
||||
{% elsif ghes %}
|
||||
Only an outbound connection from the runner to {% data variables.product.prodname_ghe_server %} is required. There is no need for an inbound connection from {% data variables.product.prodname_ghe_server %} to the runner.
|
||||
For caching to work, the runner must be able to communicate with the blob storage and directly download content from it.
|
||||
{%- endif %}
|
||||
|
||||
{% ifversion ghes %}
|
||||
|
||||
{% data variables.product.prodname_ghe_server %} must accept inbound connections from your runners over HTTP(S) at {% data variables.location.product_location %}'s hostname and API subdomain, and your runners must allow outbound connections over HTTP(S) to {% data variables.location.product_location %}'s hostname and API subdomain.
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
|
||||
You must ensure that the machine has the appropriate network access with at least 70 kilobits per second upload and download speed to communicate with the {% data variables.product.prodname_dotcom %} hosts listed below. Some hosts are required for essential runner operations, while other hosts are only required for certain functionality.
|
||||
|
||||
You can use the REST API to get meta information about {% data variables.product.company_short %}, including the IP addresses of {% data variables.product.company_short %} services. See [AUTOTITLE](/rest/meta/meta).
|
||||
|
||||
{% data reusables.actions.domain-name-cname-recursive-firewall-rules %}
|
||||
|
||||
{% data reusables.actions.runner-essential-communications %}
|
||||
|
||||
In addition, your workflow may require access to other network resources.
|
||||
|
||||
If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. See [Managing allowed IP addresses for your organization](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list) or [Enforcing policies for security settings in your enterprise](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise){% ifversion fpt %} in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}.{% endif %}
|
||||
|
||||
{% else %}
|
||||
|
||||
{% ifversion ghes %}Self-hosted runners do not require any external internet access in order to function. As a result, you can use network routing to direct communication between the self-hosted runner and {% data variables.product.prodname_ghe_server %}. For example, you can assign a private IP address to your self-hosted runner and configure routing to send traffic to {% data variables.product.prodname_ghe_server %}, with no need for traffic to traverse a public network.{% endif %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
{% ifversion ghes %}
|
||||
|
||||
## Communication between self-hosted runners and {% data variables.product.prodname_dotcom_the_website %}
|
||||
|
||||
Self-hosted runners do not need to connect to {% data variables.product.prodname_dotcom_the_website %} unless you have enabled automatic access to {% data variables.product.prodname_dotcom_the_website %} actions for {% data variables.product.prodname_ghe_server %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/about-using-actions-in-your-enterprise).
|
||||
|
||||
If you have enabled automatic access to {% data variables.product.prodname_dotcom_the_website %} actions, then the self-hosted runner will connect directly to {% data variables.product.prodname_dotcom_the_website %} to download actions. You must ensure that the machine has the appropriate network access to communicate with the {% data variables.product.prodname_dotcom %} URLs listed below.
|
||||
|
||||
```shell copy
|
||||
github.com
|
||||
api.github.com
|
||||
codeload.github.com
|
||||
pkg.actions.githubusercontent.com
|
||||
```
|
||||
|
||||
{% data reusables.actions.domain-name-cname-recursive-firewall-rules %}
|
||||
|
||||
{% endif %}
|
||||
|
||||
## Further reading
|
||||
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners)
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#troubleshooting-network-connectivity)
|
||||
@@ -8,6 +8,9 @@ versions:
|
||||
ghec: '*'
|
||||
children:
|
||||
- /about-self-hosted-runners
|
||||
- /communicating-with-self-hosted-runners
|
||||
- /supported-architectures-and-operating-systems-for-self-hosted-runners
|
||||
- /usage-limits-for-self-hosted-runners
|
||||
- /adding-self-hosted-runners
|
||||
- /autoscaling-with-self-hosted-runners
|
||||
- /running-scripts-before-or-after-a-job
|
||||
|
||||
@@ -71,7 +71,7 @@ config.cmd --check --url https://github.com/YOUR-ORG/YOUR-REPO --pat GHP_ABCD123
|
||||
|
||||
The script tests each service, and outputs either a `PASS` or `FAIL` for each one. If you have any failing checks, you can see more details on the problem in the log file for the check. The log files are located in the `_diag` directory where you installed the runner application, and the path of the log file for each check is shown in the console output of the script.
|
||||
|
||||
If you have any failing checks, you should also verify that your self-hosted runner machine meets all the communication requirements. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-requirements).
|
||||
If you have any failing checks, you should also verify that your self-hosted runner machine meets all the communication requirements. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners).
|
||||
|
||||
### Disabling TLS certificate verification
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
---
|
||||
title: Supported architectures and operating systems for self-hosted runners
|
||||
shortTitle: Supported platforms
|
||||
intro: 'The following processor architectures and operating systems are supported for the self-hosted runner application.'
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
ghec: '*'
|
||||
type: overview
|
||||
---
|
||||
|
||||
## Linux
|
||||
|
||||
* Red Hat Enterprise Linux 8 or later
|
||||
* CentOS 8 or later
|
||||
* Oracle Linux 8 or later
|
||||
* Fedora 29 or later
|
||||
* Debian 10 or later
|
||||
* Ubuntu 20.04 or later
|
||||
* Linux Mint 20 or later
|
||||
* openSUSE 15.2 or later
|
||||
* SUSE Enterprise Linux (SLES) 15 SP2 or later
|
||||
|
||||
## Windows
|
||||
|
||||
* Windows 10 64-bit
|
||||
* Windows 11 64-bit
|
||||
* Windows Server 2016 64-bit
|
||||
* Windows Server 2019 64-bit
|
||||
* Windows Server 2022 64-bit
|
||||
|
||||
## macOS
|
||||
|
||||
* macOS 11.0 (Big Sur) or later
|
||||
|
||||
## Supported processor architectures
|
||||
|
||||
* `x64` - Linux, macOS, Windows.
|
||||
* `ARM64` - Linux, macOS{% ifversion actions-windows-arm %}, Windows (currently in {% data variables.release-phases.public_preview %}){% endif %}.
|
||||
* `ARM32` - Linux.
|
||||
@@ -0,0 +1,18 @@
|
||||
---
|
||||
title: Usage limits for self-hosted runners
|
||||
shortTitle: Usage limits
|
||||
intro: 'There are some limits on {% data variables.product.prodname_actions %} usage when using self-hosted runners. These limits are subject to change.'
|
||||
versions:
|
||||
fpt: '*'
|
||||
ghes: '*'
|
||||
ghec: '*'
|
||||
type: overview
|
||||
---
|
||||
|
||||
{% ifversion fpt or ghec or ghes > 3.12 %}- **Job execution time** - Each job in a workflow can run for up to 5 days of execution time. If a job reaches this limit, the job is terminated and fails to complete.{% endif %}
|
||||
{% data reusables.actions.usage-workflow-run-time %}
|
||||
* **Job queue time** - Each job for self-hosted runners that has been queued for at least 24 hours will be canceled. The actual time in queue can reach up to 48 hours before cancellation occurs. If a self-hosted runner does not start executing the job within this limit, the job is terminated and fails to complete.
|
||||
{% data reusables.actions.usage-api-requests %}
|
||||
* **Job matrix** - {% data reusables.actions.usage-matrix-limits %}
|
||||
{% data reusables.actions.usage-workflow-queue-limits %}
|
||||
* **Registering self-hosted runners** - You can have a maximum of 10,000 self-hosted runners in one runner group. If this limit is reached, adding a new runner will not be possible.
|
||||
@@ -107,3 +107,7 @@ When routing a job to a self-hosted runner, {% data variables.product.prodname_d
|
||||
* If the runner doesn't pick up the assigned job within 60 seconds, the job is re-queued so that a new runner can accept it.
|
||||
* If {% data variables.product.prodname_dotcom %} doesn't find an online and idle runner that matches the job's `runs-on` labels and groups, then the job will remain queued until a runner comes online.
|
||||
* If the job remains queued for more than 24 hours, the job will fail.
|
||||
|
||||
## Workflow run continuity
|
||||
|
||||
{% data reusables.actions.runner-workflow-continuity %}
|
||||
|
||||
@@ -340,7 +340,7 @@ For third-party images, such as the images for ARM-powered runners, you can find
|
||||
|
||||
{% ifversion fpt or ghec %}**Self-hosted**{% elsif ghes %}Self-hosted{% endif %} runners for {% data variables.product.github %} do not have guarantees around running in ephemeral clean virtual machines, and can be persistently compromised by untrusted code in a workflow.
|
||||
|
||||
{% ifversion fpt or ghec %}As a result, self-hosted runners should almost [never be used for public repositories](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#self-hosted-runner-security) on {% data variables.product.github %}, because any user can open pull requests against the repository and compromise the environment. Similarly, be{% elsif ghes %}Be{% endif %} cautious when using self-hosted runners on private or internal repositories, as anyone who can fork the repository and open a pull request (generally those with read access to the repository) are able to compromise the self-hosted runner environment, including gaining access to secrets and the `GITHUB_TOKEN` which, depending on its settings, can grant write access to the repository. Although workflows can control access to environment secrets by using environments and required reviews, these workflows are not run in an isolated environment and are still susceptible to the same risks when run on a self-hosted runner.
|
||||
{% ifversion fpt or ghec %}As a result, self-hosted runners should almost [never be used for public repositories](/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions) on {% data variables.product.github %}, because any user can open pull requests against the repository and compromise the environment. Similarly, be{% elsif ghes %}Be{% endif %} cautious when using self-hosted runners on private or internal repositories, as anyone who can fork the repository and open a pull request (generally those with read access to the repository) are able to compromise the self-hosted runner environment, including gaining access to secrets and the `GITHUB_TOKEN` which, depending on its settings, can grant write access to the repository. Although workflows can control access to environment secrets by using environments and required reviews, these workflows are not run in an isolated environment and are still susceptible to the same risks when run on a self-hosted runner.
|
||||
|
||||
{% data reusables.actions.disable-selfhosted-runners-crossrefs %}
|
||||
|
||||
|
||||
@@ -416,7 +416,7 @@ jobs:
|
||||
|
||||
A job contains a sequence of tasks called `steps`. Steps can run commands, run setup tasks, or run an action in your repository, a public repository, or an action published in a Docker registry. Not all steps run actions, but all actions run as a step. Each step runs in its own process in the runner environment and has access to the workspace and filesystem. Because steps run in their own process, changes to environment variables are not preserved between steps. {% data variables.product.prodname_dotcom %} provides built-in steps to set up and complete a job.
|
||||
|
||||
{% data variables.product.prodname_dotcom %} only displays the first 1,000 checks, however, you can run an unlimited number of steps as long as you are within the workflow usage limits. For more information, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#usage-limits) for self-hosted runner usage limits.
|
||||
{% data variables.product.prodname_dotcom %} only displays the first 1,000 checks, however, you can run an unlimited number of steps as long as you are within the workflow usage limits. For more information, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/usage-limits-for-self-hosted-runners) for self-hosted runner usage limits.
|
||||
|
||||
### Example of `jobs.<job_id>.steps`
|
||||
|
||||
@@ -876,7 +876,7 @@ Fractional values are not supported. `timeout-minutes` must be a positive intege
|
||||
|
||||
The maximum number of minutes to let a job run before {% data variables.product.prodname_dotcom %} automatically cancels it. Default: 360
|
||||
|
||||
If the timeout exceeds the job execution time limit for the runner, the job will be canceled when the execution time limit is met instead. For more information about job execution time limits, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration#usage-limits) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#usage-limits) for self-hosted runner usage limits.
|
||||
If the timeout exceeds the job execution time limit for the runner, the job will be canceled when the execution time limit is met instead. For more information about job execution time limits, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration#usage-limits) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/usage-limits-for-self-hosted-runners) for self-hosted runner usage limits.
|
||||
|
||||
> [!NOTE]
|
||||
> {% data reusables.actions.github-token-expiration %} For self-hosted runners, the token may be the limiting factor if the job timeout is greater than 24 hours. For more information on the `GITHUB_TOKEN`, see [AUTOTITLE](/actions/security-guides/automatic-token-authentication#about-the-github_token-secret).
|
||||
|
||||
@@ -56,7 +56,7 @@ Email ports must be accessible directly or via relay for inbound email support f
|
||||
|
||||
## {% data variables.product.prodname_actions %} ports
|
||||
|
||||
{% data variables.product.prodname_actions %} ports must be accessible for self-hosted runners to connect to {% data variables.location.product_location %}. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github-enterprise-server).
|
||||
{% data variables.product.prodname_actions %} ports must be accessible for self-hosted runners to connect to {% data variables.location.product_location %}. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners).
|
||||
|
||||
| Port | Service | Description |
|
||||
|---|---|---|
|
||||
|
||||
@@ -83,7 +83,7 @@ You can create a runner group to manage access to the runner that you added to y
|
||||
> [!WARNING]
|
||||
> {% data reusables.actions.self-hosted-runner-security %}
|
||||
>
|
||||
> For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories).
|
||||
> For more information, see [AUTOTITLE](/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions).
|
||||
|
||||
{% data reusables.actions.create-runner-group %}
|
||||
1. Click the "Runners" tab.
|
||||
|
||||
@@ -90,7 +90,7 @@ You may need to upgrade the CPU and memory resources for {% data variables.locat
|
||||
|
||||
{% data variables.product.prodname_actions %} workflows require runners.{% ifversion ghec %} You can choose to use {% data variables.product.prodname_dotcom %}-hosted runners or self-hosted runners. {% data variables.product.company_short %} manages maintenance and upgrades for {% data variables.product.prodname_dotcom %}-hosted runners. For more information, see [AUTOTITLE](/actions/using-github-hosted-runners/about-github-hosted-runners).
|
||||
|
||||
To manage your own resources, configuration, or geographic location of your runner machines, use self hosted runners. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).
|
||||
To manage your own resources, configuration, or geographic location of your runner machines, use self-hosted runners. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).
|
||||
|
||||
If you want more control over the networking policies for your runners, use self-hosted runners or private networking options for {% data variables.product.prodname_dotcom %}-hosted runners. For more information about private networking options, see [AUTOTITLE](/actions/using-github-hosted-runners/connecting-to-a-private-network/about-private-networking-with-github-hosted-runners).{% else %} You will need to host your own runners by installing the {% data variables.product.prodname_actions %} self-hosted runner application on your own machines. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners).{% endif %}
|
||||
|
||||
|
||||
@@ -117,7 +117,7 @@ Jobs that run on Windows and macOS runners that {% data variables.product.prodna
|
||||
|
||||
#### Points to note about rates for runners
|
||||
|
||||
* The number of jobs you can run concurrently across all repositories in your user or organization account depends on your {% data variables.product.prodname_dotcom %} plan. For more information, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#usage-limits) for self-hosted runner usage limits.
|
||||
* The number of jobs you can run concurrently across all repositories in your user or organization account depends on your {% data variables.product.prodname_dotcom %} plan. For more information, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/usage-limits-for-self-hosted-runners) for self-hosted runner usage limits.
|
||||
* {% data reusables.user-settings.context_switcher %}
|
||||
* {% data reusables.actions.larger-runner-permissions %}
|
||||
* {% data reusables.actions.about-larger-runners-billing %}
|
||||
|
||||
@@ -15,7 +15,7 @@ You will use a script to automate configuring your Azure resources.
|
||||
If you use {% data variables.enterprise.data_residency %}, in the `AllowOutBoundGitHub` section, you must also include the ingress IP ranges for {% data variables.enterprise.data_residency_site %}. See [AUTOTITLE](/admin/data-residency/network-details-for-ghecom#ranges-for-ingress-traffic).
|
||||
|
||||
> [!NOTE]
|
||||
> As an alternative to using the following file, to allow {% data variables.product.prodname_actions %} to communicate with the runners, you can allow the same firewall domains that are required for communication between self-hosted runners and {% data variables.product.github %}. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github-enterprise-cloud). To determine the appropriate subnet IP address range, we recommend adding a 30% buffer to the maximum job concurrency you anticipate. For instance, if your network configuration's runners are set to a maximum job concurrency of 300, it's recommended to utilize a subnet IP address range that can accommodate at least 390 runners. This buffer helps ensure that your network can handle unexpected increases in VM needs to meet job concurrency without running out of IP addresses.
|
||||
> As an alternative to using the following file, to allow {% data variables.product.prodname_actions %} to communicate with the runners, you can allow the same firewall domains that are required for communication between self-hosted runners and {% data variables.product.github %}. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners). To determine the appropriate subnet IP address range, we recommend adding a 30% buffer to the maximum job concurrency you anticipate. For instance, if your network configuration's runners are set to a maximum job concurrency of 300, it's recommended to utilize a subnet IP address range that can accommodate at least 390 runners. This buffer helps ensure that your network can handle unexpected increases in VM needs to meet job concurrency without running out of IP addresses.
|
||||
|
||||
```bicep copy
|
||||
@description('NSG for outbound rules')
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
> [!WARNING]
|
||||
> If you use an IP allow list and would also like to use {% data variables.product.prodname_actions %}, you must use self-hosted runners{% ifversion actions-hosted-runners %} or {% data variables.product.prodname_dotcom %}-hosted larger runners with static IP address ranges{% endif %}. When using [Azure private networking](/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-azure-private-networking-for-github-hosted-runners-in-your-enterprise), IPs from your Azure subnet must be used. To reduce the number of required IPs, we recommend creating a load balancer to provide a single IP range for the GitHub allow list. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners) {% ifversion actions-hosted-runners %} or [AUTOTITLE](/actions/using-github-hosted-runners/using-larger-runners/about-larger-runners){% endif %}.
|
||||
> If you use an IP allow list and would also like to use {% data variables.product.prodname_actions %}, you must use self-hosted runners{% ifversion actions-hosted-runners %} or {% data variables.product.prodname_dotcom %}-hosted larger runners with static IP address ranges{% endif %}. When using [Azure private networking](/admin/configuration/configuring-private-networking-for-hosted-compute-products/about-azure-private-networking-for-github-hosted-runners-in-your-enterprise), IPs from your Azure subnet must be used. To reduce the number of required IPs, we recommend creating a load balancer to provide a single IP range for the GitHub allow list. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners) {% ifversion actions-hosted-runners %} or [AUTOTITLE](/actions/using-github-hosted-runners/using-larger-runners/about-larger-runners){% endif %}.
|
||||
|
||||
To allow your self-hosted {% ifversion actions-hosted-runners %}or larger hosted{% endif %} runners to communicate with {% data variables.product.prodname_dotcom %}, add the IP address or IP address range of your runners to the IP allow list that you have configured for your enterprise.
|
||||
|
||||
@@ -2,6 +2,6 @@ A workflow run is made up of one or more `jobs`, which run in parallel by defaul
|
||||
|
||||
Each job runs in a runner environment specified by `runs-on`.
|
||||
|
||||
You can run an unlimited number of jobs as long as you are within the workflow usage limits. For more information, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#usage-limits) for self-hosted runner usage limits.
|
||||
You can run an unlimited number of jobs as long as you are within the workflow usage limits. For more information, see [AUTOTITLE](/actions/learn-github-actions/usage-limits-billing-and-administration) for {% data variables.product.prodname_dotcom %}-hosted runners and [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/usage-limits-for-self-hosted-runners) for self-hosted runner usage limits.
|
||||
|
||||
If you need to find the unique identifier of a job running in a workflow run, you can use the {% data variables.product.github %} API. For more information, see [AUTOTITLE](/rest/actions#workflow-jobs).
|
||||
|
||||
@@ -1,4 +1,2 @@
|
||||
* [AUTOTITLE](/actions/deployment/security-hardening-your-deployments/using-openid-connect-with-reusable-workflows)
|
||||
{% ifversion fpt %}- [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github){% endif %}
|
||||
{% ifversion ghec %}- [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github-enterprise-cloud){% endif %}
|
||||
{% ifversion ghes %}- [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github-enterprise-server){% endif %}
|
||||
* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners)
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
{% ifversion fpt or ghec %}Self-hosted runners offer more control of hardware, operating system, and software tools than {% data variables.product.prodname_dotcom %}-hosted runners provide. {% endif %}With self-hosted runners, you can create custom hardware configurations that meet your needs with processing power or memory to run larger jobs, install software available on your local network, and choose an operating system{% ifversion fpt or ghec %} not offered by {% data variables.product.prodname_dotcom %}-hosted runners{% endif %}.
|
||||
|
||||
@@ -1 +0,0 @@
|
||||
Self-hosted runners can be physical, virtual, in a container, on-premises, or in a cloud.
|
||||
|
||||
@@ -1 +1 @@
|
||||
To use actions from {% data variables.product.prodname_dotcom_the_website %},{% ifversion ghes %} both {% data variables.product.prodname_ghe_server %} and{% endif %} your self-hosted runners must be able to make outbound connections to {% data variables.product.prodname_dotcom_the_website %}. No inbound connections from {% data variables.product.prodname_dotcom_the_website %} are required. For more information. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-betweens-self-hosted-runners-and-githubcom).
|
||||
To use actions from {% data variables.product.prodname_dotcom_the_website %},{% ifversion ghes %} both {% data variables.product.prodname_ghe_server %} and{% endif %} your self-hosted runners must be able to make outbound connections to {% data variables.product.prodname_dotcom_the_website %}. No inbound connections from {% data variables.product.prodname_dotcom_the_website %} are required. For more information. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners#communication-between-self-hosted-runners-and-githubcom).
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
> [!WARNING]
|
||||
> {% data reusables.actions.self-hosted-runner-security %}
|
||||
>
|
||||
> For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#self-hosted-runner-security-with-public-repositories).
|
||||
> For more information, see [AUTOTITLE](/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions).
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
{% data variables.product.prodname_dependabot %} runners require access to the public internet, {% data variables.product.prodname_dotcom_the_website %}, and any internal registries that will be used in {% data variables.product.prodname_dependabot_updates %}. To minimize the risk to your internal network, you should limit access from the Virtual Machine (VM) to your internal network. This reduces the potential for damage to internal systems if a runner were to download a hijacked dependency.
|
||||
|
||||
{% ifversion fpt or ghec %}
|
||||
You must also allow outbound traffic to `dependabot-actions.githubapp.com` to prevent the jobs for {% data variables.product.prodname_dependabot_security_updates %} from failing. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github).
|
||||
You must also allow outbound traffic to `dependabot-actions.githubapp.com` to prevent the jobs for {% data variables.product.prodname_dependabot_security_updates %} from failing. For more information, see [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/communicating-with-self-hosted-runners).
|
||||
|
||||
{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user