Runner isolation is a security control that separates task execution from the main application. A “runner” is the component that executes jobs, scripts, or workflow steps. By keeping it isolated in a separate process, container, VM, or restricted sandbox, a compromise in one task is less likely to expose the whole platform.
This matters because workflow engines and automation platforms often handle secrets, webhooks, and privileged actions. If an attacker can abuse a vulnerable step, malicious input, or a plugin, runner isolation helps contain the damage and limits the blast radius. In real attacks, weak isolation can let code execution spread from one workflow to shared credentials or internal services. Defenders use isolation, least privilege, network restrictions, and separate runtime identities to make task execution safer and easier to monitor.