Default deny, allow by policy, log everything

Controlling outbound traffic

Layering security groups, NACLs and egress policy so a compromised build step cannot exfiltrate.

A runner with unrestricted egress is an excellent place to exfiltrate secrets from. The three controls available operate at different layers and are worth using together.

Layer	Granularity	Good for
Security groups	IP and port	Coarse network boundaries
Network ACLs	Subnet-wide IP and port	Defence in depth
runnerhut egress policy	Hostname, per runner group	Allowlisting registries and APIs, with logs

yaml

egress:
  default: deny
  allow:
    - registry.npmjs.org
    - ghcr.io
    - github.com
    - "*.amazonaws.com"
  log: all

Your next build could be twice as fast, at half the price

Start free. Migrating away is the same one line, and we publish that diff too.

Start building See pricing

Control plane egress IPsThe addresses to allowlist BYOC security checklistWhat to verify before you go organisation-wide BYOC networking on AWSPrivate subnets, egress you control

Controlling outbound traffic

Your next build could be twice as fast, at half the price

Related