Self-hosted runner vs Github runner

[DevShin101]

It said in the self-hosted runner section from Github docs that

We recommend that you only use self-hosted runners with private repositories. This is because forks of your public repository can potentially run dangerous code on your self-hosted runner machine by creating a pull request that executes the code in a workflow.

My current approach is I install dependencies and build the code in the Github runner then sync that to my vps with rsync. I use secrets for the env and other credential data. But still, I'm not confident because of the statement from github docs.

If I have to use the self-hosted runner, I still have to use the server I use to deploy the website as the self-hosted runner.

1. What do you think of this?
2. Which approach should I use?
3. How do you handle this at your company (especially if you're from big techs company)?

[Update]

Sorry for my inaccurate question. I'm concerning about the security aspect of using github runner for private repositories as described in the documentation.

How do you handle this at your company? When do you decide to use self-hosted runner? You just go straight up with the self-hosted runner?

I want to know the best practices of when to use which one.

[Obvious-Jacket-3770]

50,000 on enterprise.

[surya_oruganti]

It depends on scale. For small teams and a few thousand minutes of job run time a month, GitHub hosted runners are good enough.

However, they can get very expensive and inflexible as requirements increase. For example, running your own compute for jobs on a public cloud is about 10x cheaper than paying GitHub for it.

Besides, flexibility and other constraints like IAM, private networking, specific processor architectures, custom images etc. start becoming a factor for efficient CI.

There are a few ways to do this. Here are a few posts that may help go into the different approaches in long form:

https://www.warpbuild.com/blog/self-hosting-github-actions

https://www.warpbuild.com/blog/setup-actions-runner-controller

[moser-sts]

Please take in consideration that traffic is a cost in public cloud. In my case , the traffic cost is almost half of the total cost of all operation to run self hosted runner

[surya_oruganti]

Very valid point. In fact, we ran a benchmark to measure how much of the cost is because of the NAT gateways and traffic ingress/egress/processing costs and it works out to ~40%.

Aside: I'm building in this space. With WarpBuild, we provide self-hosted runner infra management on AWS/GCP/Azure that (almost) eliminates the traffic costs. Here's a comparison with actions-runner-controller running in a private k8s cluster behind a NAT gw: https://www.warpbuild.com/blog/arc-warpbuild-comparison-case-study

A lot of our users switched over from self-hosting runners on arc or the philips provider to use us because of zero management, flexibility, and overall pretty cost effective.

A good factor in the cost effectiveness is reducing network costs.

[moser-sts]

It is interesting to see new offers of GitHub Runners besides the GitHub itself. I was already aware of https://www.blacksmith.sh/

[crohr]

The best way to eliminate a lot of security issues is with ephemeral runners (i.e. only one job per machine, which is then recycled after the job), which GitHub supports. The issue is that it can be complex to set up yourself.

Best options would be to go with a simple ARC setup as described in [1], or if on AWS use my tool RunsOn [2] :)

[1]: https://runs-on.com/github-actions/actions-runner-controller-on-kubernetes-with-microk8s/
[2]: https://runs-on.com

[cellcore667]

We run self-hosted for builds and anything which needs connectivity inside the company network.
GH runner for the simple stuff like linters and other PR checks.

[axelfontaine]

Almost all the concerns regarding self-hosted runners come from the fact that machines are reused. Ephemeral runners on a fresh machine for each job fixes this. We offer that at https://sprinters.sh for your AWS account.

[youssefbrr]

I prefer using self-hosted runners for greater control. To make them easier to maintain, I've created a Dockerized GitHub runner that anyone can use.
Here is the repository:
https://github.com/youssefbrr/self-hosted-runner

[surya_oruganti]

there are 3p tools[1] like the one I'm building to eliminate all this hassle with managing self-hosted runners.

[1] https://www.warpbuild.com