DevSecOps › Module 3 › Lesson 3
Runner Hygiene
Runner hygiene literacy names ephemeral runners, secret isolation, network egress, and self-hosted hardening — map runner policy on YOUR $DEVSEC_LAB before scaling CI.
Visual · t36_runner_hygiene
Runner hygiene literacy. $DEVSEC_LAB only. Original Cyberlium.
Opening
Runners execute untrusted PR code — literacy teaches runner hygiene so build environments stay isolated on pipelines you document.
Runner hygiene covers GitHub-hosted ephemeral runners vs self-hosted pools, clearing workspaces between jobs, restricting egress to YOUR artifact registries, never persisting secrets on disk, and patching self-hosted agents. Lab repos start on hosted runners; advanced labs document self-hosted hardening checklist on $DEVSEC_LAB notes only. Cyberlium maps runner policy on YOUR $DEVSEC_LAB — write runner row for hosted vs self-hosted choice, isolation rule, egress allowlist. Next: Pipeline Lab.
1. Runner hygiene components (named)
Ephemeral: fresh VM per job on GitHub-hosted runners. Isolation: separate self-hosted pools for prod vs untrusted PR forks on YOUR infra. Egress: allowlist registries and YOUR lab URLs only. Secrets: injected at runtime, never baked into runner images.
On $DEVSEC_LAB, write runner row — runner type, isolation rule, egress note for one fictional workflow.
Command guide
Try these commands — Runner hygiene components (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Gitleaks — https://gitleaks.io/ Gitleaks detect — https://github.com/gitleaks/gitleaks#usage GitHub Actions security — https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows:
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
export DEVSEC_REPO=${DEVSEC_REPO:-$DEVSEC_LAB/sample-repo}
cd "$DEVSEC_REPO" && git init -q 2>/dev/null || true
git -C "$DEVSEC_REPO" add .env.example README.md .gitignore 2>/dev/null || true
git -C "$DEVSEC_REPO" -c [email protected] -c user.name='Cyberlium Lab' commit -m 'FAKE lab seed' 2>/dev/null || true
echo '=== gitleaks detect on YOUR sample-repo (optional if installed) ==='
if command -v gitleaks >/dev/null; then gitleaks detect --source "$DEVSEC_REPO" --verbose 2>&1 | head -30; else cat > "$DEVSEC_LAB/notes/gitleaks-fallback.md" <<'EOF'
# Gitleaks Fallback — tool not installed
Install: https://github.com/gitleaks/gitleaks#installing
Then run: gitleaks detect --source $HOME/cyberlium-lab/t36-devsec/sample-repo --verbose
Expected literacy: understand detect output format; tune allowlist for FAKE strings
NEVER run against stranger repos.
EOFCommand — copy this
grep NEVER "$DEVSEC_LAB/notes/gitleaks-fallback.md"; fi grep FAKE "$DEVSEC_REPO/.env.example" | head -3
Primary tools to practice this lesson: gitleaks, grep. Reference sites: Gitleaks (https://gitleaks.io/); Gitleaks detect (https://github.com/gitleaks/gitleaks#usage); GitHub Actions security (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why runner hygiene prevents lateral movement
Compromised build job can steal GITHUB_TOKEN and cloud creds from runner disk. Persistent self-hosted runners without patching become beachheads. Lab documentation practices safe defaults before production adopts hardened pools.
Students document lab runner policy on notes — production follows platform SRE and network segmentation standards.
3. Lab boundary
Forbidden: running stranger org workflows on YOUR self-hosted runner to 'help them.' Allowed: runner hygiene card — three rules with $DEVSEC_LAB fictional pipeline.
Ship: runner hygiene card for YOUR lab workflow. Next: Pipeline Lab.
4. What you ship: runner hygiene card for $DEVSEC_LAB
Runner type, isolation, egress rules. $DEVSEC_LAB named. chmod 600.
5. What you record before the next lesson
Date. Runner hygiene card. $DEVSEC_LAB named. File t36-m03-l03-runner-hygiene.txt chmod 600.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Reuse self-hosted runner for prod and untrusted forks without isolation. Allow unrestricted egress to any URL.
Right
Write runner hygiene card for YOUR $DEVSEC_LAB. Next: Pipeline Lab.
Mission: document runner hygiene on YOUR lab
1) Compare hosted vs self-hosted tradeoffs. 2) Write isolation and egress rules. 3) Confirm secrets are runtime-injected only. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Untrusted PR code runs on isolated runners — never prod pools.
Knowledge Check
APPLY: Runner hygiene primarily includes:
Multiple choice
Knowledge Check
APPLY: True or False: Self-hosted runners need patching and pool isolation like any server.
True or False
Knowledge Check
APPLY: Runner hygiene literacy on Cyberlium uses:
Multiple choice