> Markdown version of [/videos/731-a-deep-dive-into-arc-the-kubernetes-operator-to-scale-self-hosted-runners](https://www.wearedevelopers.com/videos/731-a-deep-dive-into-arc-the-kubernetes-operator-to-scale-self-hosted-runners). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# A deep dive into ARC the Kubernetes operator to scale self-hosted runners

Stop wasting cluster capacity on idle CI/CD pipelines. Discover how the ARC Kubernetes operator securely scales self-hosted GitHub Actions runners to peak demand and down to zero.

- **Speakers:** Bassem Dghaidi
- **Event:** WeAreDevelopers LIVE
- **Published:** October 6, 2023
- **Duration:** 58:19
- **URL:** https://www.wearedevelopers.com/videos/731-a-deep-dive-into-arc-the-kubernetes-operator-to-scale-self-hosted-runners

## Summary

Actions Runner Controller (ARC) is a Kubernetes operator designed to manage and dynamically scale self-hosted GitHub Actions runners. Originally a community-driven open-source initiative, GitHub officially adopted ARC to provide a robust solution for running continuous integration workflows via securely isolated on-premise infrastructure. By bringing infrastructure in-house, enterprise teams can execute localized workflows that remote GitHub-hosted runners cannot reach while automatically scaling capacity up to meet peak demand and down to zero to eliminate wasted cluster resources.

Under the hood, ARC utilizes standard Kubernetes control loops to continuously reconcile the actual state of the deployment against a desired configuration defined by custom resource definitions. Managing these environments involves runner scale sets, which cluster homogeneous runners into highly scalable, label-free units. Rather than relying on unreliable legacy webhooks, ARC deploys a dedicated listener pod that maintains a secure, long-polling HTTPS connection back to the GitHub backend. As workflows queue up, this listener determines scale requirements and instructs the auto-scaling controllers to spin up ephemeral runner pods. To significantly tighten security controls, ARC authenticates freshly spawned runners using tightly scoped, short-lived just-in-time tokens instead of broad personal access tokens.

Because GitHub Actions inherently execute arbitrary application code, a core operational best practice is isolating ARC on a dedicated Kubernetes cluster to avoid compromising primary production workloads or triggering resource-draining noisy neighbor side effects. Maintaining these operator setups requires explicit sizing configurations, limiting parallel container resources, and carefully addressing privileged mode complications when operating internal tools like Docker-in-Docker. Ultimately, configuring automated self-hosted runners demands significant underlying infrastructure knowledge, requiring engineers to deeply understand both the eventual consistency modeling of Kubernetes distributed systems and core engineering fundamentals to maintain resilient enterprise build pipelines.

**Keywords:** actions runner controller, kubernetes operators, github actions scaling, self-hosted runner infrastructure, runner scale sets, control loop reconciliation, custom resource definitions, long-polling connections, just-in-time tokens, ephemeral runner pods, noisy neighbor isolation, helm chart deployment, docker-in-docker actions, distributed system consistency, kubernetes workload isolation

## Chapters

1. **Origin and evolution of Actions Runner Controller** (00:02) — How the community-built solution for managing self-hosted runners was officially adopted by GitHub.
1. **Demonstrating self-hosted runner scaling locally** (01:32) — A practical look at queued workflows automatically triggering runner creation within a Kubernetes cluster.
1. **State machines and reconciliation loops in Kubernetes** (03:13) — How control loops continually monitor conditions to ensure the system matches its desired operational state.
1. **Actions Runner Controller architecture and cluster isolation** (06:57) — Why arbitrary execution workloads require dedicated Kubernetes clusters rather than sharing resources with predictable production traffic.
1. **Initializing runner scale sets and listener pods** (12:04) — Converting homogeneous runner pools into deployable clusters using autoscaling controllers and scale set listeners.
1. **Step-by-step workflow scaling and job assignment** (18:06) — The lifecycle of parsing a new workflow execution to scaling up ephemeral runner pods with scoped credentials.
1. **Navigating the Actions Runner Controller open-source repository** (24:04) — Reviewing the project structure to understand the transition from unreliable webhooks to persistent long-polling connections.
1. **Defining custom resources and controller reconciliation logic** (29:28) — Inspecting the codebase constraints for custom resource definitions and the core hashing mechanism driving state updates.
1. **Exploring the listener application and connection handling** (39:42) — How the listener binary functions as a distinct web client holding an HTTP connection to the GitHub backend.
1. **Packaging releases with Helm and container registries** (43:29) — Distributing the controller manager and listener tools as OCI-compliant charts and combined container images.
1. **Accessing deep dives and setup documentation** (47:38) — Additional materials are provided to assist with operational management and complex repository configurations.
1. **The speakers journey into writing software** (48:56) — An early start fixing computers led to a lifelong commitment to building software solutions.
1. **Addressing scale complexities in Kubernetes environments** (50:47) — Running build workloads securely sometimes requires overcoming resource isolation limits intrinsic to container orchestration platforms.
1. **Balancing degrees versus self-taught software engineering skills** (53:53) — Formal training often expedites the underlying systems engineering knowledge required to scale enterprise platforms sustainably.

## Related Moments

- [Abstracting Kubernetes complexity with a self-service operator](https://www.wearedevelopers.com/videos/1181-startup-presentation-achieving-true-developer-self-service-in-kubernetes) (from "Startup Presentation: Achieving True Developer Self-Service in Kubernetes")
- [Understanding the continuous control loop in Kubernetes operators](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator) (from "Debug a Kubernetes Operator")
- [Architecting continuous reconciliation loops with Kubernetes controllers](https://www.wearedevelopers.com/videos/372-a-practitioners-guide-to-gitops-introduction-principles-and-implementation) (from "A Practitioners Guide to GitOps - Introduction, Principles and Implementation")
- [Audience questions on security, limitations, and Kubernetes crossover](https://www.wearedevelopers.com/videos/732-kubernetes-dev-is-fun-but-setup-and-ops-isn-t-see-a-fun-paas-alternative-to-push-any-code-ipynbs-or-even-just-data) (from "Kubernetes dev is fun, but setup and ops isn't! See a fun PaaS alternative to push any code, ipynbs or even just data!")
- [Speaker background and open source Kubernetes edge computing projects](https://www.wearedevelopers.com/videos/100094-from-bytes-to-execution-writing-a-webassembly-runtime-in-rust) (from "From Bytes to Execution: Writing a WebAssembly Runtime in Rust")
- [Orchestrating with Kubernetes against Docker and accessing slides](https://www.wearedevelopers.com/videos/487-debug-a-kubernetes-operator) (from "Debug a Kubernetes Operator")

## Related Articles

- [MLops – Deploying, Maintaining And Evolving Machine Learning Models in Production](https://www.wearedevelopers.com/magazine/115-mlops-deploying-maintaining-and-evolving-machine-learning-models-in-production)
- [How we Build The Software of Tomorrow](https://www.wearedevelopers.com/magazine/120-how-we-build-the-software-of-tomorrow)
- [What is Agentic Programming and Why Should Developers Care?](https://www.wearedevelopers.com/magazine/625-what-is-agentic-programming-and-why-should-developers-care)
- [Learning Kubernetes made easy with KubeCampus](https://www.wearedevelopers.com/magazine/348-learning-kubernetes-made-easy-with-kubecampus)

## Related Jobs

- [Principal Product Manager, Agent Platform](https://www.wearedevelopers.com/jobs/ext/277541-principal-product-manager-agent-platform) at **GitHub**
- [DevOps Engineer (m/f/d)](https://www.wearedevelopers.com/jobs/48303-devops-engineer-m-f-d) at **basebox GmbH**
- [Platform Engineer - Mercury Runtime Platform](https://www.wearedevelopers.com/jobs/ext/293235-platform-engineer-mercury-runtime-platform) at **Raiffeisen Bank International AG**
- [Staff Developer Advocate, GitHub Security Lab](https://www.wearedevelopers.com/jobs/ext/1921051-staff-developer-advocate-github-security-lab) at **GitHub**
- [Principal Software Engineer, Enterprise AI Platform](https://www.wearedevelopers.com/jobs/ext/1467292-principal-software-engineer-enterprise-ai-platform) at **GitHub**
- [Senior Software Engineer](https://www.wearedevelopers.com/jobs/ext/15942-senior-software-engineer) at **GitHub**