What security problem do ephemeral self-hosted runners primarily address compared with long-lived persistent runner hosts?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Ephemeral self-hosted runners are disposable per job or short lifecycle, so malware and leftover secrets cannot camp on the same host for months. Network controls and secret hygiene still fully apply.
Full explanation below image
Full Explanation
Persistent self-hosted runners accumulate tools, credentials in memory or disk, and potential malware across jobs. Ephemeral runners spin up clean environments for a job or brief lifetime, then destroy state, limiting lateral movement and residue. They do not remove the need for network controls, must not dump secrets into PR comments, and are unrelated to billing manager roles. Administrators should combine ephemeral patterns with runner groups, hardened images, and restricted labels. Autoscaling systems (Kubernetes, compute scale sets) are common implementation vehicles for enterprise ephemeral fleets.