Securing DNS isn’t necessarily enough to protect your CI/CD environments. An application can connect directly to an IP or talk to an outside DNS service. In this post you’ll learn use iptables and ip6tables to restrict outbound DNS and block common DNS-over-HTTPS providers on GitHub-hosted runners.

Lately I’ve seen people spin up self-hosted runners just to lock down network egress. That creates maintenance overhead – and your time is valuable. You may not realize this, but you can restrict outbound domains while still using GitHub-hosted runners. In this post you’ll learn how to use a local Unbound allowlist so only approved domains resolve.