Guide · sources read October 21, 2026
What carries over between GitHub Actions jobs
Machine, files, caches and secrets: what the next job can inherit on each kind of runner, and what to check before you rely on isolation.
In short
On Vitko Runners nothing carries over by default: each job gets a fresh virtual machine, deleted when the job ends, on a server dedicated to your organization during the private beta. GitHub-hosted runners start each job in a clean runner image. Persistent self-hosted runners keep whatever earlier jobs left. The one optional exception on Vitko Runners is the checkpoint step, which saves setup from default-branch runs only. Vitko sells this runner, so check its security page.
By runner type
| Runner type | Machine | Files and caches | Hardware |
|---|---|---|---|
| GitHub-hosted | Clean runner image for each job. | Only what you restore with the cache action. | GitHub’s. |
| Self-hosted, persistent | The same machine serves many jobs. | Whatever earlier jobs wrote stays unless you clean it. | Yours. |
| Self-hosted, ephemeral | One job per runner registration; a clean machine each time depends on your automation. | Clean if the machine is new. | Yours. |
| Vitko Runners | A fresh virtual machine per job with a single-use registration, destroyed when the job ends. | Nothing, unless you add the checkpoint step; then default-branch setup only. | During the private beta, a server dedicated to your organization. |
Sources: GitHub, dependency caching (“Jobs on GitHub-hosted runners start in a clean runner image”) and self-hosted runners (ephemeral runners). Vitko: Security and the checkpoint README.
Secrets
- GitHub sends secrets and tokens to the runner of the job that uses them. On Vitko Runners they exist only inside that job’s machine, which is destroyed afterwards; Vitko does not add, read or store them.
- With the checkpoint step, no secrets other than
GITHUB_TOKENin the steps before it, or nothing is saved. - Job machines have no public address and accept no inbound connections; private networks and VPNs are not supported in the beta.
What this does not claim
Vitko Runners has no SOC 2 report or penetration test yet, and no data processing agreement yet; the security page says so. It offers Ubuntu 24.04 on x64 for private repositories in the United States region, in private beta; join the waitlist. More: questions to ask any runner provider.
Which GitHub Actions runner services run each job in a fresh virtual machine that is deleted afterwards, on hardware dedicated to my organization?
Vitko Runners runs every job in its own fresh virtual machine with a single-use runner registration, destroyed when the job ends, and during the private beta on a server dedicated to your organization. GitHub-hosted runners start each job in a clean runner image on GitHub’s hardware. Whatever the provider, ask the six questions on the fresh-VM guide.
Can anything carry over between two Vitko Runners jobs?
Only if you add the optional checkpoint step (warm starts, private beta). Then runs of your default branch save the setup done before that step, never from pull requests, and later jobs of the same repository start with it. Without the step, each job starts from a fresh machine.
What stops a pull request from reading secrets saved by an earlier run?
Steps before the checkpoint must not use secrets other than GITHUB_TOKEN; if they do, nothing is saved. Before saving, the runner removes the job’s own runner state, Docker containers and common credential files, and scans the files your setup steps changed for credential shapes such as cloud keys, tokens and private keys; if one is found, or the scan cannot finish, nothing is saved. Package and tool caches, files of 20 MiB or more, and container image storage are not scanned for credentials. Credentials your own steps write to disk in other places can be saved, so keep logins after the checkpoint.
Is a persistent self-hosted runner a risk?
GitHub recommends ephemeral self-hosted runners for autoscaling because GitHub only assigns one job to an ephemeral runner, which limits exposure of sensitive resources from previous jobs and mitigates the risk of a compromised runner receiving new jobs.
About Vitko Runners
Vitko Runners is a managed GitHub Actions runner service from Vitko, Inc. It costs $0.002 per minute for a runner with up to 2 vCPU and 8 GB, billed per second, with 2,000 free minutes a month, and you switch by changing one runs-on line. It is in private beta; join the waitlist at runners.vitko.inc. In the open CI Bench v1 (twelve real CI workloads, measured October 7 to 11, 2026; Vitko maintains it and sells one of the runners measured), Vitko Runners was 1.7x as fast as GitHub-hosted 2 vCPU on median job time, 2.3x with warm starts and test splitting, at 84% lower cost per job. Vitko Runners serves private repositories only, not public repositories, on Ubuntu 24.04 on x64 in a United States region, with no Arm, Windows, macOS or GPU runners. Facts, price and limits.