Private subnets, egress you control
BYOC networking on AWS
How BYOC runners are placed in your VPC, what outbound access they need, and how to keep them off the public internet.
Runners belong in private subnets. A machine that executes pull-request code should not be reachable from the internet, and it does not need to be — the control-plane connection is outbound only.
Required outbound access
- The runnerhut control plane, over a VPC endpoint (no NAT traffic)
- github.com and api.github.com, for job assignment and log upload
- Your registry and package mirrors — whatever your builds actually pull
Keeping NAT costs down
NAT gateway charges are frequently the largest single BYOC line item, because every image pull and package download crosses it and is billed per gigabyte. Two changes remove most of it.
- Add an S3 gateway VPC endpoint — it is free and removes all cache traffic from NAT
- Add an ECR interface endpoint and use the pull-through cache, so images are fetched once
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.