Faster image pulls and stricter isolation for STACKIT runners
Section titled “Faster image pulls and stricter isolation for STACKIT runners”On November 12, 2026, we update the STACKIT runners of STACKIT Git Pipelines. Runner jobs pull the base images that we offer from an internal cache, and Docker operations that require privileged access to the runner host are no longer allowed. This makes image pulls faster and more consistent, and enforces a stronger separation between jobs.
Base images are pulled from an internal cache
Section titled “Base images are pulled from an internal cache”The runners pull the base container images that STACKIT offers from a cache on an internal registry, which shortens the time a job waits for its image. The STACKIT Container Registry is the upstream source of the cache. If the cache cannot serve an image, the runner pulls it from the STACKIT Container Registry, so pulls continue during periods of high traffic.
Because the base images come from vetted copies in our own registry, your jobs are not affected by the rate limits of third-party registries, and your builds run in a consistent environment.
Docker operations that need access to the runner host are rejected
Section titled “Docker operations that need access to the runner host are rejected”To enforce a stronger separation between jobs on shared runners, the runners reject Docker commands that would give a container privileged access to the runner host. A job that runs such a command fails with an error message that starts with Command denied by Stackit Classic runner security policy.
These operations are no longer allowed:
- Running privileged containers, for example with
docker run --privileged. - Adding Linux capabilities, for example with
docker run --cap-add=NET_ADMIN. - Sharing the process or IPC namespace of the host with
--pid=hostor--ipc=host. - Mounting system paths of the runner host, such as
/,/etc,/proc,/sys,/dev,/var, or/run, including their subdirectories. This includes mounting the Docker socket with-v /var/run/docker.sock:/var/run/docker.sock.
You can still pull images, push images, run docker build and docker buildx build, and start unprivileged containers that mount the workspace, /tmp, or named Docker volumes.
If your pipeline depends on one of these operations, contact our Help Center.
Fixed checkout race condition
Section titled “Fixed checkout race condition”We resolved an intermittent issue where concurrent Git operations cloning actions caused errors that make the job fail. Workflows should no longer fail unexpectedly on checkout steps.
Request a base image for the cache
Section titled “Request a base image for the cache”We are adding more base images to the cache. If your workflows rely on a standard base image, request it through our Help Center and include:
- The image name. We only accept requests for official images.
- The exact tags that you need, for example
ubuntu:22.04ornode:20-alpine.
If you have any questions, our STACKIT Help Center is always at your disposal.
Action cache inclusion
Section titled “Action cache inclusion”We are actively populating our pre-warmed action cache to keep step runtimes as fast as possible. If your workflows rely on custom, internal, or non-standard actions that you would like pre-cached on our runner images, please reply here with the action repository and version tag (e.g., owner/action-name@vX). We will evaluate and add frequently requested actions to the warm cache pool.