Runner Provisioner Release 0.1.2

This release lets a single provisioner deployment run many resource classes and ships a ready-to-use VM image so you can stand up a pool without building your own.

New:

• Multiple resource classes per deployment. One deployment now scales many resource classes at once, instead of needing a separate deployment per class.
• Default containerDisk image out of the box. Pool VMs boot from a maintained Ubuntu 24.04 image with Docker and common CI tooling pre-baked, so you get a working pool without building your own image first. An AlmaLinux image is also available for RHEL-family jobs.
• More flexible scaling. Time-based schedules to raise or lower capacity at set times of day, plus finer controls (headroom, scaleDownDelay, and maxSurge) grouped under a new scaling block.
• Hot-reload of resource-class config and secrets. Changes are picked up without restarting the pod.
• More per-class machine-runner options. workingDirectory, taskAgentDirectory, commandPrefix, useHomeSSHDirForCheckoutKeys, and maxRunTime are now configurable per resource class. See the machine runner 3 configuration reference.
• emptyDiskMounts to automatically format and mount extra disks on pool VMs.

Improvements:

• Runner token kept off pool VMs. A token-proxy sidecar, on by default and optional, holds the resource-class token and attaches it only on the task-claim call, so the token never reaches the VM and a job can’t read it from the machine it runs on. Jobs run as the unprivileged circleci user by default. A resource class can opt into elevated privileges with grantSudo, which relies on the proxy so even a root task still can’t reach the token.
• New operability, hardening, and log-level chart options.
• Config split into a ConfigMap and a Secret so non-sensitive settings and secrets are managed separately.
• Tuned default resource class and resized the Docker-baked containerDisk images.

See the runner provisioner guide for full setup and configuration details.