What is the difference between a GitHub-hosted and a self-hosted runner?
CI/CD & GitOps · Intermediate level
Answer
GitHub-hosted runners are managed by GitHub, ephemeral, and easy to use. Self-hosted runners are managed by the organization and can access private networks or custom tools, but they require patching, scaling, isolation, and hardening.
Technical explanation
Workflow files live under .github/workflows and are triggered by events such as push, pull_request, workflow_dispatch, schedule, or release.
Runners should be ephemeral or carefully isolated because workflow code can execute arbitrary commands.
GitHub delivery controls combine repository settings, branch protection, required status checks, environments, CODEOWNERS, and workflow permissions.
Use least-privilege permissions for the GITHUB_TOKEN and prefer OIDC federation over long-lived cloud access keys.
Separate trusted and untrusted workflow contexts, especially pull_request from forks, and avoid exposing secrets to unreviewed code.
Make merge policy explicit: linear history, squash, merge commits, signed commits, or code-owner approvals should match audit and release requirements.
Hands-on example
1. Implement the control for: What is the difference between a GitHub-hosted and a self-hosted runner in a GitHub repository that contains a simple service and .github/workflows/ci.yml.
2. Create a workflow with on: [pull_request], jobs: build, test, scan; set permissions: contents: read by default and grant write only to jobs that truly need it.
3. Run the same workflow once on ubuntu-latest and once on a hardened self-hosted runner; compare network access, installed tools, cleanup behavior, and patch ownership.
4. Use environments for staging/prod with required reviewers and environment secrets; prefer OIDC cloud login over storing AWS/Azure/GCP access keys.
5. Validate by opening a PR that fails one required check and confirm GitHub blocks merge until the check passes and required reviewers approve.
Check how well your resume matches the role with our free resume checker— match score, ATS check, and the skills you're missing.
More CI/CD & GitOps interview questions
- What is CI/CD, and what is the difference between continuous delivery and continuous deployment?
- What are the goals of a CI pipeline beyond just running tests?
- What is Jenkins, and what is the difference between a controller and an agent?
- What is the difference between a freestyle job and a pipeline job in Jenkins?
- What is the difference between a declarative and a scripted Jenkins pipeline?
- What is a Jenkinsfile, and why keep your pipeline as code in the repo?
- Explain the structure of a declarative pipeline (agent, stages, steps, post).
- What is the post section used for, and what are its conditions (success, failure, always)?