Runner Hygiene

Runner hygiene literacy names ephemeral runners, secret isolation, network egress, and self-hosted hardening — map runner policy on YOUR $DEVSEC_LAB before scaling CI.

Runner Hygiene• Audio Walkthrough

00:00/03:26

Visual · t36_runner_hygiene

Runner hygiene literacy. $DEVSEC_LAB only. Original Cyberlium.

Runners execute untrusted PR code — literacy teaches runner hygiene so build environments stay isolated on pipelines you document.

Runner hygiene covers GitHub-hosted ephemeral runners vs self-hosted pools, clearing workspaces between jobs, restricting egress to YOUR artifact registries, never persisting secrets on disk, and patching self-hosted agents. Lab repos start on hosted runners; advanced labs document self-hosted hardening checklist on $DEVSEC_LAB notes only. Cyberlium maps runner policy on YOUR $DEVSEC_LAB — write runner row for hosted vs self-hosted choice, isolation rule, egress allowlist. Next: Pipeline Lab.

1. Runner hygiene components (named)

Ephemeral: fresh VM per job on GitHub-hosted runners. Isolation: separate self-hosted pools for prod vs untrusted PR forks on YOUR infra. Egress: allowlist registries and YOUR lab URLs only. Secrets: injected at runtime, never baked into runner images.

On $DEVSEC_LAB, write runner row — runner type, isolation rule, egress note for one fictional workflow.

Command guide

Try these commands — Runner hygiene components (named)

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Gitleaks — https://gitleaks.io/ Gitleaks detect — https://github.com/gitleaks/gitleaks#usage GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

brew install gitleaks  # or go install

macOS:

Command — copy this

brew install gitleaks

Windows:

Command — copy this

choco install gitleaks

═══ LINUX / macOS ═══

Command — copy this

export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
cd "$DEVSEC_REPO" && git init -q 2>/dev/null || true
git -C "$DEVSEC_REPO" add .env.example README.md .gitignore 2>/dev/null || true
git -C "$DEVSEC_REPO" -c [email protected] -c user.name='Cyberlium Lab' commit -m 'FAKE lab seed' 2>/dev/null || true
echo '=== gitleaks detect on YOUR sample-repo (optional if installed) ==='
if command -v gitleaks >/dev/null; then gitleaks detect --source "$DEVSEC_REPO" --verbose 2>&1 | head -30; else cat > "$DEVSEC_LAB/notes/gitleaks-fallback.md" <<'EOF'
# Gitleaks Fallback — tool not installed
Install: https://github.com/gitleaks/gitleaks#installing
Then run: gitleaks detect --source $HOME/cyberlium-lab/t36-devsec/sample-repo --verbose
Expected literacy: understand detect output format; tune allowlist for FAKE strings
NEVER run against stranger repos.
EOF

Command — copy this

grep NEVER "$DEVSEC_LAB/notes/gitleaks-fallback.md"; fi
grep FAKE "$DEVSEC_REPO/.env.example" | head -3

Primary tools to practice this lesson: gitleaks, grep. Reference sites: Gitleaks (https://gitleaks.io/); Gitleaks detect (https://github.com/gitleaks/gitleaks#usage); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Why runner hygiene prevents lateral movement

Compromised build job can steal GITHUB_TOKEN and cloud creds from runner disk. Persistent self-hosted runners without patching become beachheads. Lab documentation practices safe defaults before production adopts hardened pools.

Students document lab runner policy on notes — production follows platform SRE and network segmentation standards.

3. Lab boundary

Forbidden: running stranger org workflows on YOUR self-hosted runner to 'help them.' Allowed: runner hygiene card — three rules with $DEVSEC_LAB fictional pipeline.

Ship: runner hygiene card for YOUR lab workflow. Next: Pipeline Lab.

4. What you ship: runner hygiene card for $DEVSEC_LAB

Runner type, isolation, egress rules. $DEVSEC_LAB named. chmod 600.

5. What you record before the next lesson

Date. Runner hygiene card. $DEVSEC_LAB named. File t36-m03-l03-runner-hygiene.txt chmod 600.

6. Wrong vs right: stranger orgs vs YOUR repos

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Reuse self-hosted runner for prod and untrusted forks without isolation. Allow unrestricted egress to any URL.
Right: Write runner hygiene card for YOUR $DEVSEC_LAB. Next: Pipeline Lab.

Hands-on Exercise