Setting Up a Native ARM64 GitHub Actions Runner on Tachyon

🚀Why Use a Self-Hosted ARM64 Runner?

• Avoids QEMU emulation entirely for ARM builds.
• Massively faster npm ci and layer extraction.
• Predictable performance and no GitHub runner throttling.
• Ideal for multi-arch Docker builds using buildx.
• Perfect fit for ARM SBCs like Particle Tachyon.

✅Prerequisites

• Particle Tachyon SBC running Linux (ARM64).
• Docker installed and working.
• Outbound internet access to GitHub on port 443 (HTTPS).
• Repository admin access to register self-hosted runners.

🔒Security Considerations for Home Lab Runners

Self-hosted runners on internal networks introduce security risks that differ significantly from GitHub-hosted runners. Workflows execute arbitrary code with network access to your LAN and can persist state between runs.

Key Attack Vectors:

• Malicious PRs executing arbitrary code with LAN access.
• Compromised workflows exfiltrating repository secrets.
• Lateral movement to other devices on your network.
• Supply chain attacks via malicious npm/pip packages during builds.
• Persistent state allowing backdoors to survive across workflow runs.

Mitigation Strategies:

• Disable workflows from forks: Settings → Actions → Fork pull request workflows → Require approval for all outside collaborators.
• Use network segmentation: Place runners on an isolated VLAN with restricted egress.
• Implement firewall rules limiting runner access to only GitHub IPs and required services.
• Minimize secrets: Only grant runners access to secrets they absolutely need.
• Monitor runner activity: Log and alert on unexpected network connections.
• Regular audits: Review workflow files for suspicious commands or unexpected network calls.

Network Isolation Example (UFW):

# Allow only GitHub and DNS
sudo ufw default deny outgoing
sudo ufw allow out 443/tcp
sudo ufw allow out 53
sudo ufw enable

# Block lateral movement to common internal services
sudo ufw deny out to 192.168.0.0/16
sudo ufw deny out to 10.0.0.0/8

👤Create a Dedicated Runner User

It is strongly recommended to run the GitHub Actions runner under a dedicated non-root system user.

sudo useradd -m -s /bin/bash gha-runner
sudo usermod -aG docker gha-runner
sudo passwd gha-runner

The passwd command will prompt you to set a password for the new user, which is required to switch to this account using su - gha-runner.

🐳Install Docker & Buildx

curl -fsSL https://get.docker.com | sh
docker buildx install

Verify that Docker is functional and running natively on ARM64:

docker version
docker buildx version
uname -m

🔗Register the GitHub Actions Runner

In your GitHub repository, navigate to:

Settings → Actions → Runners → New self-hosted runner

Select Linux and ARM64, then follow the registration instructions.

su - gha-runner
mkdir actions-runner && cd actions-runner
curl -L -o actions-runner.tar.gz https://github.com/actions/runner/releases/latest/download/actions-runner-linux-arm64.tar.gz
tar xzf actions-runner.tar.gz

./config.sh \
  --url https://github.com/<org>/<repo> \
  --token <TOKEN> \
  --name tachyon-arm64 \
  --labels arm64,tachyon,self-hosted

⚙️Install Runner as a System Service

Running the runner as a service ensures it survives reboots, SSH disconnects, and runs unattended.

sudo ./svc.sh install gha-runner
sudo ./svc.sh start

sudo ./svc.sh status

🧩Using the Runner in GitHub Actions

Reference the Tachyon runner using labels in your workflow:

runs-on: [self-hosted, arm64, tachyon]

This allows ARM64 jobs to run natively, while amd64 jobs can remain on GitHub-hosted runners.

🔄Running Multiple Runners for Different Repositories

A single Tachyon can host multiple GitHub Actions runners for different repositories, enabling centralized ARM64 build infrastructure for multiple projects.

Each runner requires its own directory and systemd service. The process is identical to the initial setup, with directory and label variations:

su - gha-runner
mkdir actions-runner-repo2 && cd actions-runner-repo2
curl -L -o actions-runner.tar.gz https://github.com/actions/runner/releases/latest/download/actions-runner-linux-arm64.tar.gz
tar xzf actions-runner.tar.gz

./config.sh \
  --url https://github.com/<org>/<repo2> \
  --token <TOKEN> \
  --name tachyon-arm64-repo2 \
  --labels arm64,tachyon,self-hosted,repo2

sudo ./svc.sh install gha-runner
sudo ./svc.sh start

• Each runner gets its own directory: actions-runner-repo2, actions-runner-repo3, etc.
• Use distinct runner names and labels to identify which runner serves which repository.
• Each runner installs as a separate systemd service automatically.
• Runners share the same Docker daemon and layer cache, improving efficiency.
• No port conflicts — runners only use outbound HTTPS connections.

Resource Considerations:

• Monitor CPU and memory usage - concurrent builds can saturate resources.
• Disk space consumption scales with the number of active repositories and images.
• Consider limiting concurrent jobs per repository using GitHub Actions settings.
• Shared Docker layer cache benefits builds across all runners.

⚡Performance Notes

• First ARM64 builds will be slower due to cold Docker layer pulls.
• Subsequent builds benefit from local layer and npm cache reuse.
• Large sha256 layers represent Docker filesystem layers being extracted.
• Storage speed (eMMC vs NVMe) significantly affects extraction time.
• Monitor /var/lib/docker disk usage regularly to prevent space exhaustion.

🗑️Removing or Unregistering the Runner

If you need to decommission the runner or move it to a different repository, follow these steps:

sudo ./svc.sh stop
sudo ./svc.sh uninstall

./config.sh remove --token <REMOVAL_TOKEN>

The removal token can be generated from the same GitHub repository settings page where you initially registered the runner.