Use a dedicated machine for pipelines, isolate the runners, use '-ephemeral', disable user registration, restrict inbound to the gitea IP
Make sure you use latest software as there were some big vulnerabilities a few months back
We use Kata and Cloud Hypervisor, don't try to use firecracker as it ...
