Trusted repositories only: a runner with Docker access gives its jobs root on the host, including every other runner's credentials. Runners without Docker access are isolated from each other. Never attach repositories that run workflows from forks.
No runners yet.
./config.sh
Or leave the box empty and enter the URL and token:
A pool keeps a number of one-job runners: each takes a single job, is deleted with its volumes, and replaced by a fresh one.
Set a GitHub token in Settings to use pools.
No pools yet.
Fine-grained personal access token with Administration: Read and write on the pool repositories, or Self-hosted runners: Read and write on the organization. Stored on the manager's data volume and never shown again.
Jobs on runners with Docker access, and anyone who can log in to this page, can use everything this token grants (with Administration: write, that includes deleting the repositories). Give Docker access only to repositories you fully trust.
Changing the password logs out every other session.