Changelog

New

Machine Runner Orchestrator (previously Machine Provisioner), which automatically scales self-hosted machine runner VMs to match CI demand, is now generally available (GA).

Machine Runner Orchestrator adds:

• Multi-resource-class support: CPU, GPU, and ARM workloads can all autoscale from a single deployment, removing the single-resource-class limit from the preview release.
• CLI and API controls for queue pause/resume and graceful agent draining before scale-down.
• A Prometheus-compatible metrics endpoint, so you can wire fleet health into monitoring you already run.
• Support for GKE, AKS, and EKS, in addition to any KubeVirt-based Kubernetes cluster.

Runner Provisioner is included with self-hosted runners on every CircleCI plan, at no additional cost.

Breaking

The product was fully renamed from runner-provisioner to machine-runner-orchestrator: Helm chart name, container image repository, and Packagecloud package repository all changed to reflect that. Existing deployments must be uninstalled and reinstalled under the new name.

helm list -n <k8s_namespace>
helm uninstall runner-provisioner -n <k8s_namespace>
helm repo add circleci_machine-runner-orchestrator https://packagecloud.io/circleci/machine-runner-orchestrator/helm
helm repo update
helm install machine-runner-orchestrator circleci_machine-runner-orchestrator/machine-runner-orchestrator \
  --namespace <k8s_namespace> \
  --version 1.0.0 \
  --values my-values.yaml

Keep in mind that Runners for the configured resource classes will be offline between uninstalling the old chart and installing the new one.

Security

This version patches two high-severity gRPC-Go denial-of-service vulnerabilities: heap memory exhaustion via HTTP/2 frame fragmentation (CVE-2026-84304) and a crash on requests missing :authority/Host headers (CVE-2026-84445).

New:

• Added support for SSH reruns on KubeVirt VM runners: you can now SSH directly into the exact VM that ran a job, over the public internet, for debugging. Off by default.

Improvements:

• runner-provisioner can now poll task counts using each resource class’s own token instead of a separate global CircleCI API token, so that token no longer needs to be provisioned as a secret. Existing configurations using the old token keep working.
• Added HTTP/HTTPS proxy support, so runner-provisioner and the VMs it provisions can operate in environments with restricted outbound internet access.
• Renamed the chart’s tokenProxy sidecar setting to sidecar for clarity; the old tokenProxy.enabled value is still honored.

Security:

• Patched a high-severity vulnerability in a bundled compression library (CVE-2026-63209).

This release lets a single provisioner deployment run many resource classes and ships a ready-to-use VM image so you can stand up a pool without building your own.

New:

• Multiple resource classes per deployment. One deployment now scales many resource classes at once, instead of needing a separate deployment per class.
• Default containerDisk image out of the box. Pool VMs boot from a maintained Ubuntu 24.04 image with Docker and common CI tooling pre-baked, so you get a working pool without building your own image first. An AlmaLinux image is also available for RHEL-family jobs.
• More flexible scaling. Time-based schedules to raise or lower capacity at set times of day, plus finer controls (headroom, scaleDownDelay, and maxSurge) grouped under a new scaling block.
• Hot-reload of resource-class config and secrets. Changes are picked up without restarting the pod.
• More per-class machine-runner options. workingDirectory, taskAgentDirectory, commandPrefix, useHomeSSHDirForCheckoutKeys, and maxRunTime are now configurable per resource class. See the machine runner 3 configuration reference.
• emptyDiskMounts to automatically format and mount extra disks on pool VMs.

Improvements:

• Runner token kept off pool VMs. A token-proxy sidecar, on by default and optional, holds the resource-class token and attaches it only on the task-claim call, so the token never reaches the VM and a job can’t read it from the machine it runs on. Jobs run as the unprivileged circleci user by default. A resource class can opt into elevated privileges with grantSudo, which relies on the proxy so even a root task still can’t reach the token.
• New operability, hardening, and log-level chart options.
• Config split into a ConfigMap and a Secret so non-sensitive settings and secrets are managed separately.
• Tuned default resource class and resized the Docker-baked containerDisk images.

See the runner provisioner guide for full setup and configuration details.

New:

• The provisioner now supports high-availability deployments: with multiple replicas, one is elected leader and standbys take over automatically on failover.
• Uninstalling the Helm release now scales the VM pool down to zero before deletion, so runner VMs are cleaned up automatically.
• Runner logs are now forwarded to each VM’s serial console, making runner output visible through the virtualization layer for troubleshooting.
• AWS EKS now supports nested virtualization, and runner-provisioner has been validated against it. Bare metal nodes are no longer required to run runner VMs.

Improvements:

• Pool VMs now install the circleci-runner packages from a bundled containerDisk image at boot instead of fetching from packagecloud each time. This speeds up boots once the image is cached and enables air-gapped clusters, since the bundle can be rehosted on an internal registry. Configurable via runnerBundle.image; enabled by default.
• Provisioned VMs now default to masquerade networking.
• The container image pull policy now defaults to Always.
• imagePullSecrets is no longer set by default on the provisioner deployment.

Dependency updates: routine dependency and security bumps, including a moderate-severity HTTP/3 fix in quic-go (CVE-2026-40898).

Runner Provisioner, a new Kubernetes controller that automatically scales CircleCI runner VMs using KubeVirt, is now available in preview. The controller polls the CircleCI API for pending and running tasks and adjusts a VirtualMachinePool replica count to match demand — giving teams elastic, on-demand self-hosted runner capacity inside their own Kubernetes clusters.

Preview version 0.1.0 includes:

• A Helm chart for installation into any Kubernetes cluster with KubeVirt v1.8+
• Automatic scaling of runner VMs based on real-time CircleCI task demand
• Support for CircleCI Cloud and Server v4+
• Setup guidance for GKE, AKS, and EKS, including nested-virtualization and tainted-node-pool configurations
• Externally managed secrets via provisioner.existingSecret (e.g., Vault, Sealed Secrets)
• Customizable VirtualMachineInstanceSpec per resource class

Configuration schema and APIs may change before GA.

Read the docs →

Container Runner SSH Rerun (Preview)

Container runner now supports SSH Rerun. Visit our documentation on setup and usage.

For more information on SSH rerun please see the following documentation.