Secure Edge Runners

When executing jobs on edge runners, it’s important to consider the trust model of the code being executed. Edge runners execute arbitrary commands as defined in the workflow sent by CloudBees Unify. This means that any user who can create and execute workflows in organizations where runners are available can execute scripts on the runner.

Edge runners offer two job execution modes: native and Docker (by default). The available modes are selected when the runner is registered.

If using the pull request trigger for workflows do not use self-hosted runners on public repositories, as they can be opened by anyone with access to the repo. Instead, use self-hosted runners on private repositories or use CloudBees-hosted runners for public repositories.

If using self-hosted runners, ensure that the machines hosting the runners are secure and properly maintained. Use a non-root user with access to the runner working directory (and Docker socket if configured for Docker mode) only.

Maintenance includes keeping the operating system and software up-to-date with security patches, using firewalls to restrict access, and implementing strong authentication mechanisms.

Only allow authorized users and systems to access your edge runners. Use Role-Based Access Control (RBAC) to manage who can create and register new edge runners.

Secrets are supported in CloudBees Unify and can be masked if they appear in any outputs. Other safe contexts include: cloudbees, vars, inputs, and outputs.

Keeping the edge runners up-to-date with the latest security patches and updates helps protect against known vulnerabilities and ensures that your runners are secure.

Implement monitoring and logging by codeowners for your edge runners. They can track activity, review proposed changes, and detect any suspicious behavior.

By following these best practices, you can help ensure that your CloudBees Unify Edge Runners are secure and that your workflows are protected from potential threats.

CloudBees recommends having two groups of runners: one group for relay operations and another group for workflows. Ensure both groups use different labels to avoid any potential security risks. This separation helps prevent unauthorized access to sensitive data and ensures that only authorized workflows can access the necessary resources.

CloudBees also recommends having enough runners to avoid latency issues with private SCMs, on-premises scans, and other workflows. This depends on the anticipated usage and load.