The self-hosted runner

Properties: VI Bounded blast radius
Goal: TODO
Done when: TODO
Restart from: lesson 3 (the lesson whose checkpoint to reload if this one breaks)
Mode: self-paced or live · about 30 min

Watch

TODO: video

hands-on self-paced live

fountain runner runs on a machine you own. Sandboxes are directories and processes stay alive between turns.
A runner is trusted mode. It has no VM isolation and no egress policy and must be online to be reachable (ADR 0022).
Lesson 3 rerun here shows the allowlist not applying. A runner is the counterexample for bounded blast radius.

TODO: Video script or link. Optional.

TODO: Numbered steps. Imperative. One job.

TODO: What Floci or your own machine can and cannot show.

TODO: What the room sees. Timing. The line to say.