---
title: "CI runners · Ataris"
description: "Hosted CI runners give anyone with a repository a VM. Free minutes get spent on mining and scanning. Ataris ties each job's runtime behavior on the host back to the account that queued it."
canonical: "https://ataris.dev/use-cases/ci-runners"
last-updated: 2026-11-02
---
# Free build minutes, spent on builds.

Hosted CI runners give anyone with a repository a VM. Free minutes get spent on mining and scanning. Ataris ties each job's runtime behavior on the host back to the account that queued it.

## A workflow file is all it takes.

Abuse on CI looks like a job. Its behavior on the host doesn't.

### 1. Watch: Every runner VM.

Flows, counters, and block I/O on each runner, from the host.

Example (runner-77): job = build.yml; vCPUs = pinned 6 min.

### 2. Detect: Jobs that aren't builds.

Mining, scans, and spam from inside a job, matched by the same rules as any sandbox.

Example (runner-77 · rules): cryptomining = MATCH; port scanning = no match.

### 3. Link: Back to the account.

The case names the account that queued the job, so repeat offenders link up.

Example (CASE #0440): account = free plan; repos, same pattern = 6.

## For hosted CI.

Fits runners as they are.

- **Abuse.** Inside jobs. cryptomining, scanning, spam.
- **Runtimes.** Runner isolation. Firecracker, containers, Kata.
- **Outputs.** Into your tools. case queue, API, webhooks.

## Related

- [Cryptomining](https://ataris.dev/use-cases/cryptomining.md): Miners on free and paid accounts
- [Scanning and spam](https://ataris.dev/use-cases/network-abuse.md): Port scans, spam, egress abuse
- [Case queue](https://ataris.dev/product/case-queue.md): Ranked, evidence-backed, report-only

## Keep free CI minutes for builds.

Book a demo and we'll show runner abuse detection on your setup.

[Book a demo](https://ataris.dev/contact)