A self-hosted runner is a machine on your network

A self-hosted runner solves the problem of reaching a private network by putting a machine that executes arbitrary workflow files inside it.

$ ./config.sh --url https://github.com/org/shop 
    --token "$REG_TOKEN" --labels self-hosted,deploy --unattended

# ExecStart=/opt/runner/run.sh --once
#   → process ONE job, then exit. systemd re-registers,
#     so no job can leave state for the next one.

# and never on a public repository: a fork's PR can
# run on it.

The ephemeral mode is what makes this defensible — a job that installs something, writes a file or leaves a credential in the environment cannot affect the next job, because the process exits. Running a persistent runner is convenient and means every workflow shares a filesystem with every other. The prohibition on public repositories is absolute rather than a recommendation: a pull request from a fork runs on the runner, on your network.