NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Securing CI/CD Runners and Agents
Master the security of CI/CD compute environments, differentiating between ephemeral and self-hosted runners, and implementing strict isolation controls.
Room tasks
1What Is Runner Security and Why Does It Matter
2Ephemeral vs. Persistent Runners
3Isolating Self-Hosted Runners
4Least-Privilege Pipeline Tokens
5Guided Lab: Hardening a Self-Hosted Runner
Frequently Asked Questions
What is the difference between ephemeral and self-hosted runners?
Ephemeral runners are created for one job and destroyed afterwards, leaving nothing behind. Persistent self-hosted runners stay online between jobs, so a compromised job can affect later ones unless they are carefully isolated.
Why are CI/CD runners a security risk?
Runners execute code from pull requests and hold secrets and network access. If an attacker runs malicious code on one, they may steal credentials or tamper with builds, so isolation and least privilege matter.
How can I harden a build agent?
Use ephemeral environments, minimal permissions, network restrictions and no shared state between jobs. The Codelivly room on runner security is free and gives you advanced hands-on practice with these controls.