Your GitLab Runner Is a Crown Jewel—Here’s How to Guard It with Device‑Aware Networking When a build job touches production secrets or pushes a container to your registry, it runs on your self‑hosted GitLab runner. Anyone who can reach that runner holds the keys to your entire SDLC.
Credentials, SSH keys, personal‑access tokens and SSO logins do a great job proving who a user is—but they say nothing about how secure the device launching the job might be. A compromised laptop with valid keys is still a compromised laptop. EDAMAME solves that gap by fusing its real‑time device‑posture engine with overlay VPNs that developers already love: Tailscale and NetBird. The result is simple to describe yet hard to pull off without the right tooling: Only devices that meet your live security baseline can talk to the runner’s private IP. Everything else—regardless of credentials—never reaches the port.

Why credentials alone aren’t enough

Attackers increasingly steal or buy developer tokens; once inside, they pivot to your CI infrastructure. Traditional network ACLs and VPN join‑keys assume that any authenticated peer is safe. That assumption breaks the moment a laptop falls behind on patches, loses its disk‑encryption key, or picks up spyware.

Overlay VPNs such as Tailscale and NetBird are a perfect transport for secure peer‑to‑peer access, but—even with their own posture features—they still need a high‑fidelity, real‑time device trust signal. EDAMAME supplies that signal.

How EDAMAME makes the mesh device‑aware

Continuous posture scoring
The lightweight EDAMAME agent measures OS integrity, EDR presence, firewall status, encryption, breach exposure and dozens of other checks to produce a live security score.
Mapping posture to the VPN peer
Each device’s unique VPN peer identifier is published to EDAMAME Cloud. No manual correlation is required.
Policy decision & enforcement
If the score meets the corporate policies, EDAMAME flag that peer as trusted via the overlay’s API. Otherwise it is blocked.
Live revocation
Posture checks run continuously. The instant a device drifts (e.g., firewall disabled), EDAMAME flips the overlay rule and the runner becomes unreachable—connections are terminated mid‑session.

Because enforcement happens inside the mesh, it does not matter which credential or login flow the attacker tries; the packet never leaves the tunnel unless the device is pristine.

End‑to‑end protection for your CI pipeline

Without EDAMAME: Any peer that authenticates to Tailscale/NetBird can reach gitlab-runner.internal, as long as its keys or SSO token are valid.

With EDAMAME: The overlay silently drops traffic from peers whose devices fall below policy. Git pushes and build jobs only succeed from secure, up‑to‑standard machines.

Five‑minute rollout

Ask your developers to install the EDAMAME app on their laptops and workstations.
Paste a Tailscale NetBird API token into EDAMAME Hub—our integration engine speaks REST or GraphQL to virtually any control plane.
Set your posture rule (e.g., score ≥ 4 and disk encryption enabled).
Watch access flow only from compliant devices; everything else is quarantined automatically.

Bigger than one runner: a single control plane for access

The same EDAMAME posture score already feeds Microsoft Entra Conditional Access and Google Context‑Aware Access, giving you one policy to secure SaaS and your private mesh. Whether a developer pulls a repo over HTTPS, logs into Jira, or kicks off a build via Tailscale, the device must clear the same continuously‑verified standard.

Developer‑first security, zero friction

EDAMAME was born to keep builders productive and compliant: lightweight agent, no forced MDM, self‑service fixes, and privacy‑respecting telemetry. By attaching that philosophy to Tailscale and NetBird, we let you wrap industrial‑grade Zero Trust around your most sensitive CI component—without redesigning networks or slowing shipping.

Ready to protect your runner?

🔗 Get started in EDAMAME Hub and turn your existing mesh VPN into a posture‑aware shield around every build. Your code—and your customers—will thank you.

Frank Lyonnet

Share this post