# Securing CI/CD Runners and Agents

> Master the security of CI/CD compute environments, differentiating between ephemeral and self-hosted runners, and implementing strict isolation controls.

Canonical: https://codelivly.com/rooms/securing-cicd-runners-and-agents
Last updated: 2026-10-29

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 5 |
| Estimated time | 30 min |
| XP | 100 |

This module dives deep into the compute layer of CI/CD pipelines: the runners and agents. You will learn the critical security differences between ephemeral, cloud-hosted runners and persistent, self-hosted runners. We will cover threat modeling for runner environments, implementing strict network isolation, preventing runner escape and persistence attacks, and enforcing least-privilege IAM roles for runner identities. The module culminates in a hands-on guided lab where you will audit a vulnerable self-hosted runner configuration, implement ephemeral scaling, and apply robust isolation controls to secure the build environment.

## Lessons

1. What Is Runner Security and Why Does It Matter (30 min)
2. Ephemeral vs. Persistent Runners (30 min)
3. Isolating Self-Hosted Runners (30 min)
4. Least-Privilege Pipeline Tokens (30 min)
5. Guided Lab: Hardening a Self-Hosted Runner (30 min)

## Related

- [Learning path: Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)
- [All rooms](https://codelivly.com/rooms)