docs/content/admin/github-actions/enabling-github-actions-for-github-enterprise-server/managing-self-hosted-runners-for-dependabot-updates.md

title, intro, redirect_from, allowTitleToDifferFromFilename, miniTocMaxHeadingLevel, versions, topics, shortTitle

title	intro	redirect_from	allowTitleToDifferFromFilename	miniTocMaxHeadingLevel	versions	topics	shortTitle
Managing self-hosted runners for Dependabot updates on your enterprise	You can create dedicated runners for {% data variables.location.product_location %} that {% data variables.product.prodname_dependabot %} uses to create pull requests to help secure and maintain the dependencies used in repositories on your enterprise.	/admin/github-actions/enabling-github-actions-for-github-enterprise-server/setting-up-dependabot-updates	true	3	ghes > 3.2	Enterprise Security Dependabot Dependencies	Dependabot updates

{% data reusables.dependabot.beta-security-and-version-updates %}

About self-hosted runners for {% data variables.product.prodname_dependabot_updates %}

You can help users of {% data variables.location.product_location %} to create and maintain secure code by setting up {% data variables.product.prodname_dependabot %} security and version updates. With {% data variables.product.prodname_dependabot_updates %}, developers can configure repositories so that their dependencies are updated and kept secure automatically. For more information, see "Enabling {% data variables.product.prodname_dependabot %} for your enterprise."

To use {% data variables.product.prodname_dependabot_updates %} on {% data variables.location.product_location %}, you must configure self-hosted runners to create the pull requests that will update dependencies.

Prerequisites

{% ifversion dependabot-updates-github-connect %} Configuring self-hosted runners is only one step in the middle of the process for enabling {% data variables.product.prodname_dependabot_updates %}. There are several steps you must follow before these steps, including configuring {% data variables.location.product_location %} to use {% data variables.product.prodname_actions %} with self-hosted runners. For more information, see "Enabling {% data variables.product.prodname_dependabot %} for your enterprise." {% else %} Before you configure self-hosted runners for {% data variables.product.prodname_dependabot_updates %}, you must:

• Configure {% data variables.location.product_location %} to use {% data variables.product.prodname_actions %} with self-hosted runners. For more information, see "Getting started with {% data variables.product.prodname_actions %} for GitHub Enterprise Server."
• Enable {% data variables.product.prodname_dependabot_alerts %} for your enterprise. For more information, see "Enabling {% data variables.product.prodname_dependabot %} for your enterprise." {% endif %}

Configuring self-hosted runners for {% data variables.product.prodname_dependabot_updates %}

After you configure {% data variables.location.product_location %} to use {% data variables.product.prodname_actions %}, you need to add self-hosted runners for {% data variables.product.prodname_dependabot_updates %}.

System requirements for {% data variables.product.prodname_dependabot %} runners

Any VM that you use for {% data variables.product.prodname_dependabot %} runners must meet the requirements for self-hosted runners. In addition, they must meet the following requirements.

• Linux operating system{% ifversion ghes < 3.5 %}
• Git installed{% endif %}
• Docker installed with access for the runner users:
  • We recommend installing Docker in rootless mode and configuring the runners to access Docker without root privileges.
  • Alternatively, install Docker and give the runner users raised privileges to run Docker.

The CPU and memory requirements will depend on the number of concurrent runners you deploy on a given VM. As guidance, we have successfully set up 20 runners on a single 2 CPU 8GB machine, but ultimately, your CPU and memory requirements will heavily depend on the repositories being updated. Some ecosystems will require more resources than others.

If you specify more than 14 concurrent runners on a VM, you must also update the Docker /etc/docker/daemon.json configuration to increase the default number of networks Docker can create.

{
  "default-address-pools": [
    {"base":"10.10.0.0/16","size":24}
  ]
}

Network requirements for {% data variables.product.prodname_dependabot %} runners

{% data variables.product.prodname_dependabot %} runners require access to the public internet, {% data variables.product.prodname_dotcom_the_website %}, and any internal registries that will be used in {% data variables.product.prodname_dependabot %} updates. To minimize the risk to your internal network, you should limit access from the Virtual Machine (VM) to your internal network. This reduces the potential for damage to internal systems if a runner were to download a hijacked dependency.

Adding self-hosted runners for {% data variables.product.prodname_dependabot %} updates

1. Provision self-hosted runners, at the repository, organization, or enterprise account level. For more information, see "About self-hosted runners" and "Adding self-hosted runners."

2. Set up the self-hosted runners with the requirements described above. For example, on a VM running Ubuntu 20.04 you would:{% ifversion ghes < 3.5 %}

   • Verify that Git is installed: command -v git{% endif %}
   • Install Docker and ensure that the runner users have access to Docker. For more information, see the Docker documentation.
     • Install Docker Engine on Ubuntu
     • Recommended approach: Run the Docker daemon as a non-root user (Rootless mode)
     • Alternative approach: Manage Docker as a non-root user
   • Verify that the runners have access to the public internet and can only access the internal networks that {% data variables.product.prodname_dependabot %} needs.

3. Assign a dependabot label to each runner you want {% data variables.product.prodname_dependabot %} to use. For more information, see "Using labels with self-hosted runners."

4. Optionally, enable workflows triggered by {% data variables.product.prodname_dependabot %} to use more than read-only permissions and to have access to any secrets that are normally available. For more information, see "Troubleshooting {% data variables.product.prodname_actions %} for your enterprise."