Use a dedicated machine for pipelines, isolate the runners, use '-ephemeral', disable user registration, restrict inbound to the gitea IP

Make sure you use latest software as there were some big vulnerabilities a few months back

We use Kata and Cloud Hypervisor, don't try to use firecracker as it doesn't allow the mount for the cache server