Azure private networking for GitHub-hosted runners reaches general availability

GitHub has announced that Azure private networking for GitHub-hosted runners on GitHub Actions is now generally available. The feature, which was previously in public beta, lets organizations run workflows on GitHub-hosted runners connected to their own Azure virtual network, so those runners can reach private resources without exposure to the public internet.

Enterprises with strict networking or security policies have often been locked out of using fully managed hosted runners. Azure private networking addresses those constraints directly by provisioning runners inside a customer-selected Azure virtual network and subnet. Once deployed, the runners inherit all existing network policies — including Network Security Group (NSG) and firewall rules — and can access private services such as storage accounts, databases, or on-premises resources via pre-configured VPN gateways or ExpressRoutes. Platform administrators retain control over outbound traffic and network monitoring in a single place.

Screenshot of the page for creating a new network configuration. The fields of the form are "configuration name," "Azure Virtual Network," and "services allowed." GitHub Actions is selected under "Services allowed."

At Deutsche Vermögensberatung (DVAG), we always focus on delivering great products to our customers. By executing our CI/CD workflows on GitHub-hosted runners, the burden of managing our own infrastructure has been lifted. This shift has provided our developers and DevOps administrators with precious time to dedicate to innovation, thus ultimately accelerating our products' time to market. One of the standout features of GitHub Actions is the ability to securely and privately integrate with Azure networking, which empowers us to establish secure and private connections from GitHub-hosted runners to our internal resources. With minimal administrative overhead we can effectively manage many resources including Kubernetes clusters, databases, and virtual machines.
- Florian Koch, Lead Developer IT Platform // Deutsche Vermögensberatung

The rollout to general availability includes two notable expansions:

  • GitHub Team plan support: Organization administrators on the Team plan can now create and manage network configurations for their hosted runners, not just Enterprise Cloud customers.
  • New Azure regions: Beyond the original East US, East US2, and West US2, support now extends to Central US, West US, Norway East, France Central, Switzerland North, UK South, North Europe, Australia East, Southeast Asia, and South India.

New runner SKUs: smaller machines, Apple silicon, and GPUs

GitHub also introduced several additions to its hosted runner fleet. The new 2 vCPU Linux and 4 vCPU Windows runners bring auto-scaling and private networking to smaller machine sizes, which had previously only been available starting at 4 vCPU for Linux. These smaller SKUs are designed for workloads where full-sized compute is unnecessary, but security and managed infrastructure still matter.

Meanwhile, Apple silicon (M1) hosting has moved from public beta to general availability. The macOS L (12-core Intel) and macOS XL (M1 with GPU hardware acceleration) larger runners are now production-ready across GitHub Team and Enterprise plans.

Also announced was a new GPU runner SKU, available in public beta starting today. This SKU targets teams building machine learning models — such as large language models — or those needing GPU acceleration for graphics-heavy workloads like game development. The GPU runner allows full application testing, including ML components, directly within GitHub Actions. The initial offering is a 4-core SKU on both Linux and Windows with 1 T4 GPU, equipped with auto-scaling and private networking. Additional GPU variants are planned later in the year.

Screenshot of the page displaying different runner specifications.

On the roadmap

GitHub has outlined several areas of focus for GitHub-hosted runners in the near term:

  • Reliability improvements: Ongoing work to enhance the scalability and reliability of the Actions platform overall.
  • Broader Azure private networking: Support for network configurations spanning multiple virtual networks, streamlined setup via scripting, and best-practice guidance for VNET peering in unsupported Azure regions.
  • Multi-cloud support: Private networking solutions for customers not using Azure, targeting AWS and GCP.
  • Custom VM images: The ability to build custom images natively in GitHub Actions, bundling necessary software for complex build and test pipelines.
  • Expanded SKU lineup: Additional GPU, ARM, and other runner variants based on customer demand.

How to get started

Azure private networking for GitHub-hosted runners is generally available today on both GitHub Team and Enterprise Cloud plans. To configure it, navigate to the 'Hosted Compute Networking' section within your Enterprise or Organization settings. Note that Azure private networking for GitHub Codespaces remains in beta.

The new smaller SKUs (2-core Linux, 4-core Windows) are also generally available immediately across Team and Enterprise plans; select the '2-core' or '4-core' size option when creating a runner. macOS L and macOS XL runners can be used by updating the runs-on key to a GitHub-defined macOS runner label. GPU hosted runners are available in public beta across Team and Enterprise plans.

GitHub is soliciting feedback on all of these features, particularly around additional Azure regions and GPU SKU priorities, via its Community Discussion forum.