What Is Runner Isolation? Keeping CI Jobs From Touching Each Other

Runner isolation ensures each CI job runs in its own separate environment, so one job cannot read, tamper with, or leave traces for another.

When multiple jobs share a runner, they share risk. A leftover file, a lingering secret, or a malicious process from one job can affect the next. Runner isolation breaks that link by giving each job its own boundary. It is one of the most fundamental, and most overlooked, security properties of a build platform.

What isolation prevents

One job reading secrets left by another.
A compromised job tampering with later builds (poisoning).
State or cache from one job leaking into another's output.
A malicious process persisting across jobs on the same host.

The shared-runner problem

A persistent self-hosted runner that runs job after job on the same machine accumulates state and exposure. If one job is compromised, the attacker can wait for the next valuable job and harvest its secrets or alter its results. Shared runners turn one compromise into many.

How isolation is achieved

The strongest isolation gives each job a fresh, dedicated environment, a new VM or container that has never run anything else, and discards it when the job finishes. Weaker forms reuse a host but separate jobs with containers or users; full isolation reuses nothing.

Isolation plus ephemerality

Isolation says jobs are separated; ephemerality says the environment is destroyed afterward. Together they guarantee a clean start every time and no residue left behind, which is exactly what both security and reproducibility want.

Isolation by default

Maintaining strict isolation on a self-hosted fleet is real work. Managed runners that are isolated and ephemeral by design (like Latchkey) give every job a fresh, private environment that is torn down afterward, so cross-job attacks have nothing to exploit.

Key takeaways

Runner isolation gives each job its own environment so jobs cannot affect each other.
Shared, persistent runners let one compromise harvest or poison later jobs.
Fresh, ephemeral environments per job deliver the strongest isolation.