Runner hardening is the practice of securing the machines or environments that execute CI/CD pipeline jobs. It reduces the chance that job code can affect other workloads, access unnecessary systems, or expose credentials. Common measures include running jobs with minimal permissions, isolating workloads, limiting network access, and removing temporary files and credentials after execution.
Runners matter because pipelines execute code, including dependencies and workflow steps that may be compromised or untrusted. A poorly isolated or overprivileged runner can let malicious job code reach secrets, persist on the host, or interfere with later jobs. Defenders can reduce this risk by using short-lived or dedicated runners, separating jobs by trust level, restricting secret scope, and monitoring runner configuration. Hardening complements workflow permissions and secret management; it does not replace them.