Use a dedicated machine for pipelines, isolate the runners, use '-ephemeral', disable user registration, restrict inbound to the gitea IP
Make sure you use latest software as there were some big vulnerabilities a few months back
We use Kata and Cloud Hypervisor, don't try to use firecracker as it doesn't allow the mount for the cache server
Freedom Tech Co.
npub1fr…ch4dd
2026-09-21 08:46:44 UTC
in reply to nevent1q…7jl5
Author Public Key
npub1frdmtech5c3p6e8azwapy72tc289qeavr4mr9m55xl2nxae82r0sach4ddSeen on
wss://relay.sigit.ioPublished at
2026-09-21 08:46:44 UTCEvent JSON
{
"id": "b2ede5509bb35dc150b9afe4c83aad7d5bae5a8f385aabea22289f3e1f0618dd",
"pubkey": "48dbb5e717a6221d64fd13ba12794bc28e5067ac1d7632ee9437d533772750df",
"created_at": 1789980404,
"kind": 1,
"tags": [
[
"e",
"3e19ecd10d4f9aa941203627dc33f95386fb872bac3016995fea609a6c84ca58",
"wss://nostr21.com/",
"root",
"fd208ee8c8f283780a9552896e4823cc9dc6bfd442063889577106940fd927c1"
],
[
"p",
"fd208ee8c8f283780a9552896e4823cc9dc6bfd442063889577106940fd927c1",
"wss://nostr.land/"
],
[
"client",
"Amethyst"
]
],
"content": "Use a dedicated machine for pipelines, isolate the runners, use '-ephemeral', disable user registration, restrict inbound to the gitea IP\n\nMake sure you use latest software as there were some big vulnerabilities a few months back\n\nWe use Kata and Cloud Hypervisor, don't try to use firecracker as it doesn't allow the mount for the cache server",
"sig": "91757c380d5734af5ec7e24e7379926f40af4b73111b4d7027f2ba8c12d0801ca6349210b017c0a7987913f61c2908c382f7ded41c12fa53510d74af15ee272c"
}