Can BYOC Runners Run in a Private Subnet?

Yes. WarpBuild BYOC runners launch in private subnets when you enable static IPs on the custom runner configuration, and the placement works as long as the route tables and the security group let each instance reach the destinations the runner needs. Those destinations and the network shape around them are listed in the AWS BYOC configuration prerequisites.

Answer

Subnet placement is a runner-level setting rather than a workflow setting. The BYOC setup documentation states that enabling static IPs creates the runners in private subnets behind NAT gateways, and that runners with static IPs use the addresses of those gateways as their external addresses. Turn the setting off and the instances are created in public subnets with no gateway in the path.

The prerequisites the private path depends on, all from the AWS BYOC configuration guide, checked on 2026-08-13:

Nothing in the workflow changes. The job keeps the runner ID as its label, prefixed with warp-custom-, exactly as it reads on a public-subnet runner:

name: build
on: [push]

jobs:
  test:
    runs-on: warp-custom-linux-private-4x
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm test

BYOC Linux runners carry a WarpBuild fee of $0.002 per runner minute and your own cloud account bills the compute, storage, and data transfer (pricing page, checked on 2026-08-13).

Detail

The outbound destinations a private-subnet runner has to reach

A private subnet only works when the route out of it terminates somewhere the runner needs. The security hardening guide lists the required outbound destinations, and each one fails in a different place when a route table or a security group rule blocks it.

Cache traffic and image pulls are the exception, per the AWS BYOC configuration guide. The stack routes S3 cache access and ECR operations inside the AWS network for runners in both public and private subnets, so that traffic does not cross the managed gateway meter. Stacks on CloudFormation template versions before v1.4 can hit ECR authentication timeouts on public-subnet runners, which the dashboard upgrade to v1.4 fixes.

What the private path costs

Traffic that leaves a private subnet through a managed gateway carries a per-gigabyte processing charge on top of the hourly charge for the gateway itself. In US East (N. Virginia), AWS charges $0.045 per hour per gateway plus $0.045 per GB of data processed in both directions (Amazon VPC pricing, checked on 2026-08-13).

Container image pulls and package downloads dominate that number. Take 2,000 jobs a month at 10 minutes each, each job pulling 2 GB of images and packages from destinations outside AWS, with two gateways for zone redundancy:

The gateway line items add up to $245.70 a month against a $40.00 platform fee, before EC2 and EBS. That ratio is the reason the BYOC documentation recommends using static IPs minimally. Split the fleet instead: one runner configuration in private subnets for the jobs that call an allowlisted third party, and one in public subnets for everything else. The routing options and their operating costs are compared in do BYOC runners need NAT gateways.

Coverage and placement notes

BYOC runs on AWS, GCP, and Azure, and the private-subnet behavior described here is the AWS path, which is also the one with import mode. The BYOC price list covers Linux runners on AWS, GCP, and Azure, and Windows runners on AWS and Azure. The stack lives in one region of your own account and cannot be moved after creation, so pick the region alongside the subnet layout. For WarpBuild-hosted runners rather than BYOC, US and EU are the regions WarpBuild names publicly.

The full prerequisite checklist, including the security group shape and the failure signatures above, is laid out in BYOC networking on AWS, and the architecture around it in the BYOC on AWS overview.

Related Questions

How do I put BYOC runners in a private subnet?

Enable static IPs on the custom runner configuration. Runners with static IPs are created in private subnets behind NAT gateways, and their external addresses are the addresses of those gateways. With static IPs disabled, the instances are created in public subnets, which is the documented default in the BYOC setup guide.

What has to be true of the VPC before a private subnet works?

The VPC needs at least one public and one private subnet, both with internet connectivity, and the private subnets need NAT gateways. Route tables send internet-bound traffic through the Internet Gateway, and each subnet needs enough addresses for peak concurrency, with 250 as the documented minimum recommendation. The wider network shape is covered in running GitHub Actions runners in your own VPC.

Does a private subnet change the workflow file?

No. Placement belongs to the runner configuration, so the workflow keeps the same runs-on label. Moving a job between a public-subnet runner set and a private-subnet runner set means pointing the label at a different runner ID.

What does the private path add to the bill?

Managed gateway charges billed by your own cloud account: $0.045 per hour per gateway plus $0.045 per GB processed in both directions in US East (N. Virginia), checked on 2026-08-13 against Amazon VPC pricing. Runners in public subnets skip that meter.

Set the network up against the AWS BYOC configuration prerequisites, harden the security group with the security guide, and price the fleet against your own minutes on the pricing page.