Baremetal turns the Macs and Linux machines you own into a self-scaling fleet of single-use runners — so your builds run fast, isolated, and disposable, without paying for hosted CI.
curl -fsSL https://baremetal.run/install.sh | bash -s -- cjt_…
Free while in beta · no credit card · your keys stay encrypted
Hosted runners — macOS especially — are the most expensive minutes you can buy, billed at a steep multiplier you don’t control.
Persistent runners accumulate state, leak secrets between jobs, and need babysitting to scale up and down.
A Mac mini or a Linux box sitting on a shelf can outrun cloud CI — if something safely turns it into ephemeral runners.
A guided flow creates a GitHub App scoped to your org or a single repo. The private key is encrypted at rest in our backend — never on your machines, never in our database.
One command on each Apple Silicon Mac or Linux box installs the agent and joins it to your workspace. No notarization, no inbound ports — the machine dials out.
Pick an image, a size, and a warm-runner count. Baremetal keeps that many ready and scales to zero when nothing is queued.
Every job gets a fresh, single-use VM — a Tart VM on a Mac, a KVM VM on Linux. It runs your workflow, then is destroyed. No state leaks between jobs, ever.
A clean VM per job, torn down afterwards. No leftover caches, credentials, or state between builds.
Pools track queued demand and idle down to nothing. You pay for electricity, not idle cloud minutes.
Runs on the Macs and Linux machines you already own. No per-minute bill — including the priciest CI tier there is, hosted macOS.
You own the integration. We custody the key encrypted at rest and only mint short-lived, single-job registration tokens.
Agents and the runners scheduled onto them are label-fenced to your workspace. Your machines are never shared — this is not a marketplace.
Real macOS VMs on Apple Silicon via Tart, Linux VMs via QEMU/KVM, with nested virtualization for workloads like Android emulators — honouring each platform’s limits.
Keys encrypted at rest, never on disk. Single-use runners destroyed after every job. Outbound-only connections. The dashboard has zero database access — every action goes through an authenticated API. We only claim what the architecture backs.
Read the security model →You run on your own hardware, so there’s no per-minute charge. Pricing for any future paid plans hasn’t been set yet.
A machine you own — an Apple Silicon Mac (M1 or newer) with Homebrew, or any Linux box with KVM (hardware virtualization) — plus a GitHub org or repo you administer. Either way you install a tiny agent with one command.
No. Your jobs run on your own hardware, so there is no per-minute compute charge from us. Baremetal is free while we are in beta.
Encrypted at rest in our backend. They are never written to disk on your machines and never stored in our database. They are used only to mint short-lived, single-job runner registration tokens.
Never. Agents and the runners scheduled onto them are fenced to your workspace by label. Baremetal orchestrates your hardware for you — it does not rent it out.
No. Every connection is outbound: your machine dials the cloud backend. Nothing reaches into your machines, which keeps it NAT- and firewall-friendly.
The entire VM is destroyed. Each job starts from a pristine image and leaves nothing behind, so secrets and artifacts never survive into the next job.
Connect GitHub, add a machine, and watch your first ephemeral runner come online in minutes.
Get started free →