Are Global Bitbucket Runners Safe for Use with Exported Secrets, or Should I Use Self-Hosted Runners

Question

Hello Bitbucket Community,

I’m currently evaluating whether to use Bitbucket’s global runners or opt for self-hosted runners for my CI/CD workflows. My pipeline involves several steps where sensitive secrets (such as API keys, tokens, and service account credentials) are exported and utilized during the build and deployment process.

My key concern is around the security of these secrets when using Bitbucket’s global runners:

Patrik S · Answer

Hello @A Sai Shree Anjan ,

Absolutely. The 4x/8x is already available to be used on Bitbucket's cloud runners and can be configured directly in your pipeline's YAML file. You can find more details on how to set it up at the following documentation:

* Step options - Size

Thank you, @A Sai Shree Anjan !

Patrik S

A Sai Shree Anjan · Answer

Thanks you for the information @Patrik S ,

If I go for Bitbucket's hosted cloud runners, can we used 4/8x sizes for the builds ?

Patrik S · Answer

Hello @A Sai Shree Anjan ,

thanks you for reaching out to Community!

There are a few points to consider when choosing Bitbucket's hosted cloud runners or self-hosted runners with regards to security mechanisms.

Bitbucket's cloud runners are managed by Atlassian, which ensures they adhere to strict security protocols. Secrets in Bitbucket are encrypted both at rest and in transit, minimizing the risk of unauthorized access.

Also, cloud runners operate in isolated environments that are ephemeral. This means each build runs in a new fresh environment (container), reducing the risk of secret leakage between builds. Once a job is completed, the environment is destroyed, and any secrets used during the build are not retained.

While Bitbucket's cloud runners provide convenience and ease of use with built-in security measures, self-hosted runners offer additional control (such as using 3rd party secret providers). You can enforce your own security policies, network restrictions, and have more control over the physical or virtual machines running your builds.

Ultimately, the decision may depend on your organization's specific security requirements and compliance needs. If your project has specific security requirements and you prefer to have full control over your build environment, self-hosted runners might be the way to go.

However, if you prefer ease of management and are satisfied with the security measures provided by Atlassian, cloud runners can be a good choice.

I hope that helps! Let us know in case you have any questions.

Thank you, @A Sai Shree Anjan !

Patrik S