Security
Runner Isolation
Runner isolation separates one CI workload from other workloads and host resources. Its strength depends on boundaries such as virtual machines, containers, identities, storage, and network policy rather than the runner label alone.
Also known as: isolation
Why it matters
Untrusted build code needs boundaries that cover credentials and shared services as well as compute.
Practical example
Use separate trust boundaries for untrusted pull requests and release jobs with production credentials.
Related terms
Sources
Definition reviewed .
Start with $10 in free credits
Change the runner label in your workflow and keep the rest of your GitHub Actions setup. Runner time is billed per minute.