AZ-400 Question 131
Select 2Your organization hosts containerized applications in a private data center. You plan to introduce GitHub Actions for CI/CD and need to design a self-hosted runner infrastructure. Due to strict security policies, all outbound traffic must flow through a corporate proxy, and you need a solution that is both cost-effective and simple to maintain. You also must adhere to your existing licensing agreements. Which two approaches would best address these design requirements?
- A
Deploy permanent self-hosted runners on VMs with no integration to the corporate proxy
- B
Use self-hosted runners in ephemeral containers running on-premises with a standardized base image
- C
Configure self-hosted runners to use your corporate proxy for external traffic and package downloads
- D
Purchase GitHub-hosted runners to minimize all maintenance tasks
- E
Set up dedicated on-premises VM runners with specialized software pre-installed and no on-demand scaling
Show answer and explanation
Correct answers: B, C
Explanation
In high-security or private data center scenarios, self-hosted runners must integrate with existing network requirements, such as using a corporate proxy. Ephemeral container-based runners simplify maintainability and can be spun up and removed on demand, controlling costs. Ensuring your runner setup respects the proxy requirement is also crucial to meeting compliance standards. For more details, refer to GitHub documentation on self-hosted runners (https://docs.github.com/actions/hosting-your-own-runners) and best practices for containerized DevOps environments.
- A. Incorrect.
Explanation for Option 1: This approach ignores the requirement to route outbound traffic through the corporate proxy, violating the organization's security policy. Additionally, simply hosting permanent VM-based runners may not be cost-effective if they remain idle.
- B. Correct.
Explanation for Option 2: Using ephemeral container-based runners on-premises with a standardized base image can reduce maintenance overhead, ensure a consistent environment, and let you control resource usage efficiently. This addresses cost and simplifies updates for specialized tools.
- C. Correct.
Explanation for Option 3: Configuring the runners to use your corporate proxy ensures compliance with security policies and properly handles connectivity for external dependencies or package downloads. This is essential in a locked-down environment.
- D. Incorrect.
Explanation for Option 4: While GitHub-hosted runners reduce maintenance for many use cases, they do not address your requirement to funnel traffic through a corporate proxy within a private data center. Also, they might not align with certain licensing or specialized tool requirements.
- E. Incorrect.
Explanation for Option 5: Dedicated on-premises runners with specialized software can quickly become costly and difficult to maintain if you do not implement automated scaling or ephemeral usage. They might also be underutilized between builds.