what is ez-gh-actions fr?

ez-gh-actions, also called ezgha, is a single Rust program that runs your own self-hosted GitHub Actions runners with strong isolation between jobs. Rather than leaving one long-lived runner sitting around, it spins up a fresh, ephemeral runner for every single job. GitHub registers that runner just in time, the job runs once, and then the runner deregisters itself and its container is removed, so no job leaves leftover files or state behind for the next one. Each job gets hard resource limits on memory, CPU, and process count, so a runaway or malicious job cannot take down the machine it runs on. The tool also refuses to start new jobs when disk space is running low, which avoids a common failure mode where self-hosted runners slowly fill up their disk and crash. It installs itself as a background service using systemd on Linux or launchd on a Mac, so it keeps running without manual intervention. The isolation itself is layered. At the innermost layer, each job runs in its own Docker container with strict Linux cgroup limits and a setting that blocks privilege escalation, so even a command that tries to gain root inside the container is refused by the kernel. Around that sits the Docker daemon that creates and removes these containers. On a Mac, or on a Linux setup using Colima, that daemon itself runs inside a virtual machine, adding a second boundary between the job and the real host machine. On a bare metal Linux server, the daemon runs directly on the host kernel instead, which is a somewhat weaker setup. The tool can detect which of these arrangements is actually true on your machine, and if your configured security policy demands virtual machine level isolation but the host cannot actually provide it, ezgha refuses to run jobs at all rather than silently offering less protection than requested. A future version plans to add true dedicated virtual machines per job using Tart on macOS or libvirt on Linux for even stronger isolation, though today's isolation options are Docker with or without the sysbox runtime. The design underwent what the project describes as a thirty two agent adversarial review before its first version.