Hosted runner image

Workflows that target runs-on: fremforge execute inside our hosted runner image (runner-base). It’s a deliberately lean image, Alpine 3.22 + the things every CI step touches. Customers pin specific language toolchain versions per-job using standard setup-* actions, the same UX as GitHub Actions.

What’s baked in

What’s NOT baked in (use setup-* actions)

We deliberately keep the image lean (~280 MB compressed; GitHub’s ubuntu-latest is ~50 GB). Customers pin the version they want via standard actions:

Container builds

CCI v2 (the runtime that backs every fremforge runner pod) doesn’t permit privileged containers, so Docker-in-Docker is not possible. Use kaniko (pre-baked at /usr/local/bin/kaniko) for rootless OCI image builds:

- name: Build + push image
  run: |
    /usr/local/bin/kaniko \
      --context=$GITHUB_WORKSPACE \
      --dockerfile=Dockerfile \
      --destination=registry.example.com/$GITHUB_REPOSITORY:$GITHUB_SHA

For pure image copy (e.g. retag-and-push between registries) you can also use skopeo if you apk add skopeo at the start of your step.

Image size & cold-start time

The runner image is pinned weekly (every Monday 06:00 UTC), we rebuild on the latest Alpine patch set, run Trivy with HIGH/CRITICAL hard-fail, and publish the manifest at the runner-image manifests in Changelog. Each customer pod cold-starts in ~60-90 seconds (image pull + container init).

Sample workflow

A minimal “hello world” workflow that runs on fremforge runners:

name: hello

on:
  push:
    branches: [main]
  workflow_dispatch: {}

jobs:
  smoke:
    runs-on: fremforge
    steps:
      - uses: actions/checkout@v4
      - name: Show what's available
        run: |
          echo "Hello from fremforge"
          uname -a
          node --version
          git --version
          jq --version
          shellcheck --version | head -2
          gitleaks version
          trivy --version | head -1

For a more realistic example with a language toolchain, see the workflow examples in Actions and CI/CD.

Reporting issues with the runner image

If a tool you expected isn’t available, or you hit a Pod-runtime issue (security context, resource limits, network), file an issue at frem.sh/fremforge/runner-base or contact support. We respond same-business-day for hosted-runner regressions.