Why We Moved Our CI to Ephemeral Runners
Long-lived build machines were slow, flaky and a security risk. Ephemeral runners fixed all three.
Until this spring, our CI pipelines ran on twelve long-lived build machines. Over time they collected caches, stray processes and credentials, and every few weeks a build failed for reasons nobody could reproduce.
One job, one machine
We now start a fresh virtual machine for every job and destroy it as soon as the job finishes. Dependencies come from a shared, read-only cache, so builds did not get slower. The median pipeline time actually dropped from 14 to 9 minutes.
The security benefit was just as important: no secret survives longer than a single job, and a compromised build cannot affect the next one.
Flaky builds went down by roughly 80 percent. The remaining failures are now real test failures, which is exactly what CI should tell you.