Security
How Celesto protects your workloads.
Built around clear security boundaries.
- MicroVM isolation
- Workspace access controls
- Scoped credentials
GitHub integration
It all starts with our GitHub integration
Choose the repositories Celesto can access. We receive job events and start your runners.
Review the permissions we request
microVM 1
Own guest
kernel
microVM 2
Own guest
kernel
microVM 3
Own guest
kernel
Workload isolation
Your workloads run with microVM isolation.
Access controls
Access stays scoped to your workspace.
Choose repository access in GitHub. Within Celesto, workspace roles and organization-bound API keys control who can read, execute, or delete resources.
GitHub App permissions
| Permission | Reason |
|---|---|
| Repository metadata — Read | Identify connected repositories. |
| Actions — Read | Track workflow jobs and status. |
| Administration — Read and write | Manage personal-account repository runners. |
| Checks — Read and write | Publish runner setup checks. |
| Organization self-hosted runners — Read and write | Manage organization runners and restricted groups. |
1
job per JIT runner
- Startup configuration encrypted
- Saved configuration cleared after startup
Short-lived credentials
Credentials issued just in time.
Just-in-time (JIT) credentials are created when needed. Each JIT runner accepts at most one job.
Stored GitHub tokens are encrypted. Runtime credentials have scoped access and limited lifetimes.
Data lifecycle
CI machines are always ephemeral
Runner filesystems and caches have separate lifecycles.
Cache access stays scoped to your organization and repository. Jobs can also restore caches from base/default branches allowed by GitHub.
| Resource | Lifecycle |
|---|---|
| CI machines | Removed during cleanup. |
| Caches | Expire after 7 idle days. |
| Account records | Privacy-policy retention. |
Security in practice.
Automated checks validate changes. Runner images are versioned.
Start with 20,000 free CI minutes
Up to 20,000 Micro runtime minutes. No credit card required.
$5 one-time credit. Expires in 30 days. Runtime includes preparation and cleanup.