Runners
A runner pulls jobs from OxygenHub over HTTPS and runs each one in a fresh sandbox. Nothing reaches into your network.
Isolation tiers
| Tier | Needs | Isolation |
|---|---|---|
microvm | /dev/kvm | A Firecracker microVM per job |
syscall | Linux with Landlock | Landlock and seccomp; for machines without KVM, such as a RISC-V board |
flow tiers shows which tiers a machine can run, and why not the
others. A runner offers only the tiers it can run, and declines a job it
can't run, with a reason.
Registering a runner
flow runner register https://oxygenhub.io --token … --name my-runner --label fast
flow runner
- Registering binds the runner's signing key: the hub accepts receipts from that runner signed by no other key.
- Every claim carries the runner's architecture, OS, version, labels and capacity, which feed the Runners page.
Placement today
- A job goes to a runner that has every label it asks for (
runs-on), matches its image's architecture, and offers its tier. - A job no runner can take waits, and the queue says why.
What's coming
Jetstream builds on this:
- runners measure their own disk, memory, load, images held and speed, and report them with every claim;
- requirements are learned from each job's past runs;
- images are fetched by hash;
- pools extend to Kubernetes and the cloud.