Will this break my builds?

It will if you write the allowlist from memory. Run the policy in audit-only mode for a full week first — the real list always contains destinations nobody documented.

What does it actually prevent?

It turns a dependency-confusion or compromised-postinstall attack into a failed DNS lookup and a log line, rather than a successful exfiltration.

Can I allow by hostname rather than IP?

Yes. Egress policy operates on hostnames per runner group, which is why it is layered with security groups rather than replacing them.

Default deny, allow by policy

Zero-egress runners

Deny outbound traffic by default and allow only the destinations your build genuinely needs.

A CI runner with unrestricted egress is an excellent place to exfiltrate secrets from. Default-deny egress with an explicit allowlist turns a dependency-confusion attack into a failed DNS lookup and a log line.

yaml

egress:
  default: deny
  allow:
    - registry.npmjs.org
    - ghcr.io
    - github.com
    - "*.amazonaws.com"
  log: all

Policy attached to a runner group

Common questions

Will this break my builds?: It will if you write the allowlist from memory. Run the policy in audit-only mode for a full week first — the real list always contains destinations nobody documented.
What does it actually prevent?: It turns a dependency-confusion or compromised-postinstall attack into a failed DNS lookup and a log line, rather than a successful exfiltration.
Can I allow by hostname rather than IP?: Yes. Egress policy operates on hostnames per runner group, which is why it is layered with security groups rather than replacing them.

Your next build could be twice as fast, at half the price

Start free. Migrating away is the same one line, and we publish that diff too.

Start building See pricing

CI security reviewThe answers your security team will ask for Audit loggingEvery change, attributed

Zero-egress runners

Common questions

Your next build could be twice as fast, at half the price

Related