Ephemeral CI migration checklist: are you ready to move?

You are ready to move a pipeline to ephemeral container jobs when you can answer yes to the questions below. They cover the runner image, caching, secrets, scan placement, logs and rollback. Move one low risk pipeline first, learn from it, then widen.

Image

• Is the runner image built from a written definition in version control?
• Does it contain every tool the pipeline needs at pinned versions?
• Is there a scheduled rebuild and a scan of the image?
• Do jobs reference the image by version or digest, not a moving label?
• Does the image run as a non-root user?

Caching

• Is there a keyed dependency cache with a defined owner?
• Can untrusted pull requests write to the cache that deploy jobs read? It should be no.
• Do you know what happens to build times on a cold cache?

Secrets and identity

• Does each job receive only the credentials it needs?
• Have long lived stored keys been replaced with short lived tokens where the target supports it?
• Are credentials absent from the image and from build logs?
• For Kubernetes runners, is service account token automounting disabled on job pods?

Scan placement

• Do scans run as separate jobs fed by the build output?
• Is the vulnerability database fresh on a new runner?
• Is a required check enforced by branch rules?

Logs and evidence

• Are runner and job logs shipped outside the runner?
• Does each build record the commit, image digest and approvals?
• Have you tested rebuilding the story of one past build from stored data?

Isolation and limits

• Is each runner used for exactly one job?
• Are CPU, memory and time limits set on job pods?
• Are privileged jobs on their own isolated pool?
• Does the network allow only what jobs need?

Rollback and parallel run

• Can you send a pipeline back to the old server in minutes?
• Will you run old and new side by side before cutting over? See run old and new builds side by side before cutover.
• Has someone listed the hidden state on the old agents? See what hidden state a long lived agent holds.

How to use the list

Score each section as ready, partly ready or not ready. Do not move a pipeline with deploy credentials until secrets, logs and rollback are all ready. A pipeline that only runs tests can move earlier.

Try it yourself

Click through it at your own pace, or open it full screen.

Watch how monitoring keeps checking after a build ends, which covers the gap an ephemeral runner leaves once it is gone.

Safeguard offers continuous monitoring, dependency scanning and policy gates. You can try a free scan at gold.safeguard.sh/scan.

Quick check

Last reviewed: 19 October 2026.