CloudBees Unify Edge Runners execute jobs directly on your infrastructure, which means that the security of your workflows depends on how runners are configured and isolated. Understanding the runner hierarchy, job execution modes, and code execution trust model is essential for designing a secure deployment.
Runner hierarchy
Runners created at the organization level are available for use within that organization as well as all associated sub-organizations.
Job execution isolation
Edge runners offer two job execution modes: native and Docker. The available modes are selected when the runner is registered.
-
Native mode executes jobs directly on the host machine. Jobs executed by edge runners in native mode have the same access to the local environment as the user running that edge runner. Actions cannot be used in native mode, as they require a containerized environment to run.
-
Docker mode runs jobs in isolated containers using Docker. Steps are isolated from each other, aligning with the security model of CloudBees Unify workflows that execute within the infrastructure of CloudBees Unify. As a result, steps are not able to read secrets intended for other steps. Use Docker mode for better isolation and security.
For more information on securing your edge runners, refer to Secure Edge Runners.