Private execution
Private runners execute eligible ZeroQuarry scans from Docker hosts inside networks you control. Use them when the assessment must reach an internal application, clone source without moving the repository through a hosted worker, or return less scan detail to the ZeroQuarry control plane.
Private runner pools are an Enterprise capability. They support remote scans and Git-backed source scans; binary uploads and source file uploads continue to use ZeroQuarry Cloud.
Private execution starts by defining a network boundary. Setup then selects eligible scan modes and how much result detail may return to ZeroQuarry.
Choose a private runner for the right reason
| Need | Private-runner behavior |
|---|---|
| Test an internal application | Remote workers can reach RFC1918, loopback, link-local, and internal-DNS targets from the customer network. |
| Keep Git cloning on your infrastructure | Git source is cloned directly by the runner. Source uploads are rejected for private execution. |
| Reduce data returned to SaaS | A minimized pool returns allowlisted finding metadata while retaining evidence, logs, and artifacts locally. |
| Control network ingress | Runners initiate outbound HTTPS; no inbound firewall rule is required. |
| Separate trust zones | Create distinct pools for environments such as a production VPC, staging network, or lab. |
A private runner is not a standalone or air-gapped ZeroQuarry deployment. SaaS remains the control plane, while the customer-controlled host performs the scan and calls each selected LLM provider directly. Every selected scan, review, and artifact model must have an account-managed API key.
Choose where each part runs
| Component | Location |
|---|---|
| Account, project policy, job assignment, and centralized reporting | ZeroQuarry SaaS control plane |
| Git clone or active target testing | Customer-controlled runner host |
| LLM calls | Directly from the runner to the selected provider, using account-managed keys |
| Detailed results | Returned to SaaS for Standard pools; retained locally where the Minimized policy excludes them |
The runner initiates outbound HTTPS connections. ZeroQuarry does not require an inbound firewall rule into the customer network.
Standard and minimized results
New pools use Standard results by default. Standard returns detailed findings, relevant excerpts, logs, and generated artifacts to the control plane, which supports the normal report and evidence workflows.
Choose Minimized results when the approved boundary allows only normalized finding metadata, severity, score, identifiers, and safe source locations to leave the network. Evidence, remediation text, logs, errors, and runner-generated artifacts then remain on the runner.
Result minimization is not local-LLM execution and does not remove the outbound control-plane or provider connections.
Supported scans
Private pools support:
- Git-backed source scans, where the runner clones the repository directly
- authorized remote-target scans, including internal DNS and private address ranges reachable from the Docker host
Browser source uploads, archives, and binary uploads continue to use ZeroQuarry Cloud. Uploaded inputs cannot become private-runner jobs because they would pass through the SaaS control plane before execution.
Private reachability does not expand authorization. Remote scans still require explicit scope, approved test credentials, and non-destructive operating constraints.
Project assignment and failure behavior
Pools are not automatically available to every project. An owner or admin allows compatible pools under the project's Execution environments settings and chooses a default. Scan creators can select only an environment allowed for that project and scan type.
A private job remains pinned to its selected pool. If a runner or network connection fails, ZeroQuarry expires the attempt and requeues it to the same pool. It never falls back to ZeroQuarry Cloud automatically.