# Ensure Enforce Single-Use Build Worker Instances for Builds

- Source: https://support.icompaas.com/support/solutions/articles/62000235030-ensure-enforce-single-use-build-worker-instances-for-builds
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/62000112695) › [CIS GitHub Benchmark v1.0.0](https://support.icompaas.com/support/solutions/folders/62000169264)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**  
Level 1

**Description:**  
Build workers must be provisioned as ephemeral, single-use instances that are created for a specific build and destroyed immediately after completion. This practice prevents persistent state, reduces risk of contamination between builds, and enhances security and reliability of the build environment.

**Rationale:**  
Using single-use build workers eliminates leftover artifacts, credentials, or malicious changes from previous builds. It enforces a clean environment for each build, reducing the risk of supply chain attacks, configuration drift, and build inconsistencies.

**Impact:****Pros:**

-   Ensures clean, isolated build environments.  
      
    
-   Mitigates risks from persistent malicious or accidental modifications.  
      
    
-   Enhances build reproducibility and security.  
      
    
-   Simplifies troubleshooting and auditing.  
      
    

**Cons:**

-   May increase infrastructure provisioning overhead and cost.  
      
    
-   Requires automation to efficiently manage ephemeral workers.  
      
    

**Default value:**  
Some build systems reuse build workers persistently, increasing risk of contamination.

**Audit:**  
Review build infrastructure and pipeline configurations to confirm build workers are created and destroyed per build. Inspect logs for worker lifecycle events.

**Remediation:**  
Implement automation to provision and decommission build workers for each build job. Use containerization or virtual machines to enable rapid instantiation. Educate teams on benefits and management of ephemeral build environments.

**References:**

1.  Jenkins Ephemeral Agents: [https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#agent](https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#agent)
    
2.  GitLab CI Runners: [https://docs.gitlab.com/runner/](https://docs.gitlab.com/runner/)
    
3.  CIS Controls v8, Control 4 - Secure Configuration of Enterprise Assets and Software: [https://www.cisecurity.org/controls/secure-configuration-of-enterprise-assets-and-software/](https://www.cisecurity.org/controls/secure-configuration-of-enterprise-assets-and-software/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.