Isolation

Isolation describes where IaC commands run relative to the agent process. It is stored on the group’s internal default pool and chosen when you generate a registration command (Linux/Windows: Process vs Container). Docker and Kubernetes lock the mode.

▤

Modes

Mode	UI label	Where IaC runs	Compatible platforms
PROCESS	Process	CLIs on the runner host PATH	Linux, Windows
CONTAINER	Container	Engine Docker images (DooD or a Docker platform host)	Linux, Windows, Docker
KUBERNETES_POD	Kubernetes pod	Short-lived Jobs in the cluster	Kubernetes
NONE	None (shared host)	Shared host (legacy / API)	Linux, Windows
MICROVM	MicroVM	Reserved; treat like process for platform allow-lists	Linux, Windows

i

Setup only offers Process and Container for VM registration. Kubernetes and Docker set pod / container isolation automatically.

⚙

Setup options for registration

When you generate a registration command on a Linux or Windows VM, choose the isolation mode:

›_

Process

IaC CLIs on the runner host (Linux or Windows VM).

LinuxWindows

◇

Container

IaC in engine Docker images (VM with Docker, or Docker platform).

LinuxWindowsDocker

✥

Kubernetes pod

IaC runs as Jobs in the cluster.

Kubernetes

▣

MicroVM

Reserved; treat like process for platform allow-lists.

LinuxWindows

▣

What each mode is for

›_

Process

Install Terraform, OpenTofu, Pulumi, or the AWS CLI on the VM. Fastest path for a dedicated Linux box.

Agent ⟶ ⚙   IaC CLI
(on host)

◇

Container

The agent pulls official engine images and runs stages in containers. Use runner-agent (docker.sock) or a VM that already has Docker. runner-core alone cannot run Terraform in this mode.

Agent ⟶ ◈   IaC CLI
(in container)

✥

Kubernetes pod

Each IaC stage is a Job. The agent needs cluster RBAC, workspace volume/checkout, and HTTPS egress for provider registries.

Agent ⟶ ◈   IaC Job
(in cluster)

●

Immutability

Execution isolation cannot be changed after the internal pool is created. The product message is:

!

“Execution isolation cannot be changed after a pool is created. Create a new pool with the desired isolation instead.”

In the UI that means: create a new runner group (which gets a new internal pool) and register agents there, or use the runner-platform API to create another pool.

If you pick the wrong isolation, the platform cards on a later registration against that group are disabled with:

!

“This group uses <isolation> isolation — choose <allowed platforms>.”

▢

Helper text in Setup

Isolation	Setup helper
Process	IaC CLIs on the runner host (Linux or Windows VM).
Container	IaC in engine Docker images (VM with Docker, or Docker platform).
Kubernetes pod	IaC runs as Jobs in the cluster.

☁

Hosted fleet

Provider groups also set isolation when the operator creates the hosted group. Default system labels follow isolation (axio-linux, axio-docker, axio-kubernetes).

i

See hosted-fleet for more details.