|
| 1 | +--- |
| 2 | +title: Communicating with self-hosted runners |
| 3 | +shortTitle: Self-hosted runner communication |
| 4 | +intro: 'Your self-hosted runners can communicate with {% ifversion fpt or ghec %}{% data variables.product.github %}{% else %}{% data variables.location.product_location_enterprise %} and {% data variables.product.prodname_dotcom_the_website %}{% endif %}' |
| 5 | +versions: |
| 6 | + fpt: '*' |
| 7 | + ghes: '*' |
| 8 | + ghec: '*' |
| 9 | +type: overview |
| 10 | +--- |
| 11 | + |
| 12 | +A self-hosted runner connects to {% ifversion fpt or ghec %}{% data variables.product.github %}{% else %}{% data variables.location.product_location_enterprise %}{% endif %} to receive job assignments and to download new versions of the runner application. The self-hosted runner uses an {% ifversion ghes %}HTTP(S){% else %}HTTPS{% endif %} long poll that opens a connection to {% data variables.product.github %} for 50 seconds, and if no response is received, it then times out and creates a new long poll. The application must be running on the machine to accept and run {% data variables.product.prodname_actions %} jobs. |
| 13 | + |
| 14 | +{% data reusables.actions.runner-app-open-source %} {% ifversion fpt or ghec %} When a new version is released, the runner application automatically updates itself when a job is assigned to the runner, or within a week of release if the runner hasn't been assigned any jobs. {% else ifversion ghes %} When a new version is released, the runner application will automatically update within 24 hours. {% endif %} |
| 15 | +{% ifversion ghes %} |
| 16 | + |
| 17 | +> [!NOTE] |
| 18 | +> {% data reusables.actions.upgrade-runners-before-upgrade-ghes %} |
| 19 | +
|
| 20 | +{% endif %} |
| 21 | + |
| 22 | +{% data reusables.actions.self-hosted-runner-auto-removal %} |
| 23 | + |
| 24 | +{% data reusables.actions.self-hosted-runner-ports-protocols %} |
| 25 | + |
| 26 | +{% ifversion fpt or ghec %} |
| 27 | +Since the self-hosted runner opens a connection to {% data variables.product.github %}, you do not need to allow {% data variables.product.prodname_dotcom %} to make inbound connections to your self-hosted runner. |
| 28 | +{% elsif ghes %} |
| 29 | +Only an outbound connection from the runner to {% data variables.product.prodname_ghe_server %} is required. There is no need for an inbound connection from {% data variables.product.prodname_ghe_server %} to the runner. |
| 30 | +For caching to work, the runner must be able to communicate with the blob storage and directly download content from it. |
| 31 | +{%- endif %} |
| 32 | + |
| 33 | +{% ifversion ghes %} |
| 34 | + |
| 35 | +{% data variables.product.prodname_ghe_server %} must accept inbound connections from your runners over HTTP(S) at {% data variables.location.product_location %}'s hostname and API subdomain, and your runners must allow outbound connections over HTTP(S) to {% data variables.location.product_location %}'s hostname and API subdomain. |
| 36 | + |
| 37 | +{% endif %} |
| 38 | + |
| 39 | +{% ifversion fpt or ghec %} |
| 40 | + |
| 41 | +You must ensure that the machine has the appropriate network access with at least 70 kilobits per second upload and download speed to communicate with the {% data variables.product.prodname_dotcom %} hosts listed below. Some hosts are required for essential runner operations, while other hosts are only required for certain functionality. |
| 42 | + |
| 43 | +You can use the REST API to get meta information about {% data variables.product.company_short %}, including the IP addresses of {% data variables.product.company_short %} services. See [AUTOTITLE](/rest/meta/meta). |
| 44 | + |
| 45 | +{% data reusables.actions.domain-name-cname-recursive-firewall-rules %} |
| 46 | + |
| 47 | +{% data reusables.actions.runner-essential-communications %} |
| 48 | + |
| 49 | +In addition, your workflow may require access to other network resources. |
| 50 | + |
| 51 | +If you use an IP address allow list for your {% data variables.product.prodname_dotcom %} organization or enterprise account, you must add your self-hosted runner's IP address to the allow list. See [Managing allowed IP addresses for your organization](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}/organizations/keeping-your-organization-secure/managing-allowed-ip-addresses-for-your-organization#using-github-actions-with-an-ip-allow-list) or [Enforcing policies for security settings in your enterprise](/{% ifversion fpt %}enterprise-cloud@latest/{% endif %}admin/policies/enforcing-policies-for-your-enterprise/enforcing-policies-for-security-settings-in-your-enterprise){% ifversion fpt %} in the {% data variables.product.prodname_ghe_cloud %} documentation.{% else %}.{% endif %} |
| 52 | + |
| 53 | +{% else %} |
| 54 | + |
| 55 | +{% ifversion ghes %}Self-hosted runners do not require any external internet access in order to function. As a result, you can use network routing to direct communication between the self-hosted runner and {% data variables.product.prodname_ghe_server %}. For example, you can assign a private IP address to your self-hosted runner and configure routing to send traffic to {% data variables.product.prodname_ghe_server %}, with no need for traffic to traverse a public network.{% endif %} |
| 56 | + |
| 57 | +{% endif %} |
| 58 | + |
| 59 | +{% ifversion ghes %} |
| 60 | + |
| 61 | +## Communication between self-hosted runners and {% data variables.product.prodname_dotcom_the_website %} |
| 62 | + |
| 63 | +Self-hosted runners do not need to connect to {% data variables.product.prodname_dotcom_the_website %} unless you have enabled automatic access to {% data variables.product.prodname_dotcom_the_website %} actions for {% data variables.product.prodname_ghe_server %}. For more information, see [AUTOTITLE](/admin/github-actions/managing-access-to-actions-from-githubcom/about-using-actions-in-your-enterprise). |
| 64 | + |
| 65 | +If you have enabled automatic access to {% data variables.product.prodname_dotcom_the_website %} actions, then the self-hosted runner will connect directly to {% data variables.product.prodname_dotcom_the_website %} to download actions. You must ensure that the machine has the appropriate network access to communicate with the {% data variables.product.prodname_dotcom %} URLs listed below. |
| 66 | + |
| 67 | +```shell copy |
| 68 | +github.com |
| 69 | +api.github.com |
| 70 | +codeload.github.com |
| 71 | +pkg.actions.githubusercontent.com |
| 72 | +``` |
| 73 | + |
| 74 | +{% data reusables.actions.domain-name-cname-recursive-firewall-rules %} |
| 75 | + |
| 76 | +{% endif %} |
| 77 | + |
| 78 | +## Further reading |
| 79 | + |
| 80 | +* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/using-a-proxy-server-with-self-hosted-runners) |
| 81 | +* [AUTOTITLE](/actions/hosting-your-own-runners/managing-self-hosted-runners/monitoring-and-troubleshooting-self-hosted-runners#troubleshooting-network-connectivity) |
0 commit comments