Reusing a build machine can make the next job start faster. It can also let the next job inherit files, processes, credentials, caches, network state, and accidents that were never declared in either workflow.
Runnable provisions a machine for one job attempt and terminates it at the end. That choice spends infrastructure effort to remove an entire class of invisible inputs from CI.
A warm machine has an undocumented API
A directory left in /tmp, a modified global package cache, a background process, or a credential helper can change the next build without changing its commit or workflow. The worker's history becomes an input that no reviewer can see.
Cleaning a reused host is an expanding blacklist: remove the files and processes the platform remembers to remove. Starting a new machine is an allowlist: only the image, assignment, declared cache, artifacts, and fetched source are present.
One attempt, one machine record
The scheduler creates an executor-machine record for an admitted attempt, then provisions a digest-pinned runner image with an attempt-scoped bootstrap token, explicit size, timeout, region, and network policy.
Heartbeats move that machine from provisioning to online. Completion, cancellation, timeout, or infrastructure failure triggers termination and records the reason. A rerun creates another attempt rather than reopening the old machine.
Persist data through named channels
Single-use does not mean every job must download the world again. Caches persist dependency material under repository, key, version, and branch rules. Artifacts persist declared outputs with integrity and retention. Workspace handoff can move a private, short-lived snapshot to an authorized direct dependency.
Each mechanism has scope and lifecycle. None requires the next job to land on the same host or trust whatever else that host happens to contain.
Isolation improves debugging
A failure that disappears only on a previously used worker is difficult to reproduce. With clean starts, a rerun repeats the workflow snapshot and source revision on a new machine. Differences are reduced to declared inputs, external systems, timing, or a platform defect that can be investigated directly.
The same property limits credential residue. Secrets exist in the job environment and process tree for the life of the attempt, then the machine holding that state is terminated.
- No filesystem inheritanceUndeclared files from another customer or job cannot become dependencies.
- No process inheritanceBackground work, sockets, and modified services end with the machine.
- No credential inheritanceAttempt-scoped tokens and decrypted environment values do not ride a worker into its next assignment.
The tradeoff is visible
Provisioning has latency, and a clean image must include the toolchains teams actually need. Runnable addresses that with a pinned runner image and explicit caches—not by turning machine history into a performance feature.
That boundary keeps optimization reviewable. If a cache is wrong, it can be invalidated. If an image changes, its digest changes. If a reused worker is wrong, the cause may be everything that ever ran on it.