OXYGENHUB

Community runners: lend your idle runners to open source projects issue #74 closed: completed andymccall opened this · 1 comment

andymccall

Andy (2026-10-24): an option to offer a runner to open source projects when its owner is not using it, cutting open source projects' CI cost and speeding their runs up.

For the donor (whose machine runs strangers' code):

  • Opt in per runner: community = true (and in the app, for phone runners: Android issue #8-issue #11), with windows (idle only, nights, while charging), caps (jobs at once, CPU, memory, disk, bandwidth per day) and an instant pause; the owner's own jobs always come first and pre-empt community ones.
  • MicroVM tier only (or WASM): never the syscall tier on a donor's host. No network unless the job's sandbox allows named hosts, and never the donor's LAN or private ranges. Fresh disk per job, caches kept per project and never shared across projects, wiped on the donor's request.
  • What a donor may lend to: public repositories on the hub, optionally a list of projects or labels they choose.

For the project (whose results come from strangers' machines):

  • Projects opt in to accept community runners, per pipeline or job.
  • Community jobs get no secrets, no OIDC identity tokens, no environments or approval-gated jobs: those always run on the project's own or trusted runners.
  • Results from a donated runner are signed receipts like any other, but say so; a project can require a second, independent runner to agree before a community result counts for a required check or a release (the same mechanism as oxygenhub#298), and donor reputation (agreement history) decides who is trusted alone.

On the hub:

  • A community pool in placement: open source jobs go to idle donated runners when the project's own are busy or absent; fairness across projects (turns, as priority already does), abuse limits per project.
  • Credits shown to donors and projects (jobs and CPU-hours given and received, a thank-you board), and Insights per pool.
  • Ties in with the Android runners (a phone on charge overnight as a donor), oxygenhub#296 (passes reused hub-wide) and #298 (independent rebuilds).

andymccall set labels feature ·

andymccall

Andy (2026-10-24): not pursuing this. It could be built, but it limits what jobs may do (no secrets, identities or gated work on donated runners) and running strangers' code on donated machines, and strangers' results on projects, goes against Oxygen's security model. Closing; kept for the record.

andymccall closed ·