What is the primary security benefit of using ephemeral (just-in-time) self-hosted runners?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Ephemeral runners are disposable containers — they're born for one job and die when it's done, leaving no poisoned state for the next job.
Full explanation below image
Full Explanation
Persistent self-hosted runners accumulate state between jobs: leftover environment variables, cached credentials, modified files, installed software. A malicious workflow job could poison the environment for the next job. Ephemeral/JIT runners start fresh for each job (typically from a VM image or container) and are deregistered after the job completes. GitHub supports this via the '--ephemeral' flag during registration and the JIT runner API. The security improvement is isolation — compromise in one job cannot persist to the next. They are not inherently faster, don't auto-update, and still require secrets management.