Runner Profiles
A runner profile is the shape of a runner: the image to spawn, its resource
limits, custom environment, image pull policy, and an optional private registry
credential. Define it once at /runner-profiles and reference it from any number
of workloads — two workloads serving different orgs
can share one profile, so you describe the runner once.
Editing a profile applies to each referencing workload on its next reconcile pass: new spawns pick up the change, while in-flight runners keep their config until they finish and exit.
A label for the profile so you can pick it from a workload. Nothing about behaviour depends on it.
Runner image
Section titled “Runner image”The Docker image Runaway spawns for each runner. The default is the Standard
myoung34/github-runner
image; it registers itself with GitHub using your PAT and runs a single job
before exiting. Standard works for every runtime and sets START_DOCKER_SERVICE
so the nested tiers (dind, isolated-sysbox, isolated-kata) bring up their
inner daemon. If your image lives in a private registry, attach a pull credential
below.
Memory and CPU limits
Section titled “Memory and CPU limits”- Memory limit (MB) — the hard cap applied to every runner container.
- CPU limit — optional; leave it unset for no CPU cap.
These bound a single runner; the number of runners is the workload’s concern.
Custom environment variables
Section titled “Custom environment variables”A JSON record of extra environment variables injected into every runner — chiefly for pointing package managers at your own registry proxies. See Custom environment variables for the validation rules and merge order.
Image pull policy
Section titled “Image pull policy”Controls when Runaway pulls the runner image before spawning:
IfNotPresent— pull only when the image isn’t already on the host.Always— pull on every spawn.TtlHours— pull only if the last pull is older than the configured TTL (in hours). Keeps floating tags like:latestfresh without paying the pull cost on every spawn.
New profiles default to TtlHours with a 24-hour TTL; existing profiles
preserve their prior pull behaviour. A pull failure hard-fails the spawn for that
pass with a clear per-host error — Runaway never silently falls back to a stale
cached layer.
Private registry credential
Section titled “Private registry credential”Attach an encrypted registry credential to pull a runner image from a private registry. See Private runner images.