Hardened build agents. Provable, not promised.
CI/CD runner images hardened against CIS Benchmark Level 1 controls — with the scan evidence and a deviations register baked into the image, not just claimed in a datasheet.
What you get
89.4%
OpenSCAP-weighted CIS Benchmark Level 1 posture on Ubuntu 24.04 — up from 67.92% on stock Ubuntu, a documented +21.5-point improvement. Every excluded control is logged in a deviations register, not silently dropped.
Real tooling
Built by forking and curating Microsoft's actions/runner-images — the
same install layer GitHub-hosted runners use — instead of hand-rolling installers
nobody maintains.
BYOL
Bring your own license. Deploys from Azure Compute Gallery / Marketplace.
Windows Server 2025 image
Hardening in progress
We're not publishing a CIS score for Windows yet. The raw scanner grade available today isn't a fair number to advertise. Check back, or ask us for status.
Compliance posture — a disclaimer, not a certification
This image supports a CIS Benchmark Level 1 hardening posture as measured by OpenSCAP. It is not CIS-certified — we don't use CIS's own "CIS Hardened" branding or claim third-party certification, because we haven't paid for CIS SecureSuite membership. What we do provide: a transparent, per-control scan report and a documented list of every control we didn't apply and why, baked into the image itself so you can verify it rather than take our word for it.
Evaluating this for a regulated environment — CMMC, HIPAA-adjacent, GovCon? See how audit-evidence needs map to what we actually provide on the GovCon consulting page →