Air-gapped and offline notes
Runaway orchestrates GitHub Actions runners. The hub has to reach github.com (or your GitHub
host) to register runners, poll for queued jobs, and clean up after them. A fully air-gapped, no-
GitHub deployment isn’t supported: there’d be no GitHub for the runners to talk to. Restricted-egress
networks, where GitHub stays reachable but the rest of the internet doesn’t, work fine.
What the hub never phones home for
Section titled “What the hub never phones home for”GitHub is the only outbound dependency. No Runaway-operated service has to be reachable for the hub to function.
Anonymous telemetry is on by default for new installs but opt-out: a daily ping of counts and versions, no names or secrets. Turn it off in Settings. On a restricted network it has nowhere to send and fails silently. See Telemetry.
Nothing else is fetched at boot. Pricing tables and similar data are vendored into the build rather than downloaded at startup, so the hub doesn’t depend on a third party to come up.
Restricted-egress networks
Section titled “Restricted-egress networks”If your hosts can’t pull images or packages from the public internet directly:
- Pull images through a mirror. The agent and runner images can come from a local registry mirror or pull-through cache instead of the public registry. See Registry mirror.
- Route package downloads through your own proxies. Point package managers at your internal registry proxies via a runner profile’s custom env, so jobs pull dependencies from your network. See Custom environment variables.
Both cover the common “egress locked down, GitHub reachable” case. If GitHub is unreachable, the runners have nothing to do.