Running my own CI: a self-hosted, resource-governed runner fleet
Hosted CI rents you certainty about the machines. Running your own means the identity of each runner, its resource envelope, and the boundary around untrusted code are all yours to verify — so the fleet verifies them.
§1 The situation
Personal projects with real CI needs, and a decision to own the machines: heterogeneous hardware — Dell linux-x64 boxes running docker-class jobs alongside Mac mini runners — serving repositories whose pull requests can carry untrusted code. Self-hosting concentrates the risk in two places: a job quietly landing on a machine that isn't what the job assumes, and outside code landing on any machine at all.
§2 What I did
Built and operate the fleet: canary checks that verify each runner's identity and its cgroup envelope — 8 GiB of memory, 2048 pids, a 4-core cpu.max — before jobs rely on them; a custom Docker runner image; SHA-pinned actions, so third-party steps can't change out from under the fleet; and a hardened boundary for untrusted pull requests.
§3 Result
More than 2,100 pull requests through the fleet in roughly five months — a repo-counted figure, claimed only at that precision. The resource envelopes aren't configuration aspirations: the canary checks verify them on the running fleet.
§4 Difficulty & judgment
Self-hosted CI fails quietly. A runner that drifts from its expected identity or limits will keep accepting jobs, and an untrusted pull request only needs one permissive default. The judgment call was to treat a personal fleet like production — verified envelopes, pinned dependencies, explicit trust boundaries — because the failure modes don't care that it's personal.
§5 Not claimed
Deliberately left unclaimed
- Uptime, cost, or job-duration figures — none are recorded in the evidence for this plate, so none appear.
- An impenetrable security boundary — SHA-pinning and the untrusted-PR hardening reduce exposure; they don't abolish it.
- Sole hand-written authorship — this is a personal project built with AI assistance, and labeled that way.
§6 The same work, other lenses
- Devops
- A heterogeneous runner fleet whose resource envelopes are verified by canary checks rather than assumed from configuration.
- CI security
- SHA-pinned actions, a custom runner image, and a hardened untrusted-PR boundary that treats outside code as outside.
- Operations
- Thousands of pull requests of sustained throughput on self-managed hardware, with identity and envelope checks running ahead of the jobs.