@cloudsnorkel/cdk-github-runners 0.3.0 → 0.4.0

package/.jsii

@@ -7,7 +7,7 @@
     ]
   },
   "dependencies": {
-    "aws-cdk-lib": "^2.21.1",
+    "aws-cdk-lib": "^2.29.0",
     "constructs": "^10.0.5"
   },
   "dependencyClosure": {
@@ -1106,6 +1106,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_emrserverless": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.EMRServerless"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.emrserverless"
+            },
+            "python": {
+              "module": "aws_cdk.aws_emrserverless"
+            }
+          }
+        },
         "aws-cdk-lib.aws_events": {
           "targets": {
             "dotnet": {
@@ -1509,6 +1522,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_iottwinmaker": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.IoTTwinMaker"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.iottwinmaker"
+            },
+            "python": {
+              "module": "aws_cdk.aws_iottwinmaker"
+            }
+          }
+        },
         "aws-cdk-lib.aws_iotwireless": {
           "targets": {
             "dotnet": {
@@ -2705,6 +2731,19 @@
             }
           }
         },
+        "aws-cdk-lib.aws_voiceid": {
+          "targets": {
+            "dotnet": {
+              "namespace": "Amazon.CDK.AWS.VoiceID"
+            },
+            "java": {
+              "package": "software.amazon.awscdk.services.voiceid"
+            },
+            "python": {
+              "module": "aws_cdk.aws_voiceid"
+            }
+          }
+        },
         "aws-cdk-lib.aws_waf": {
           "targets": {
             "dotnet": {
@@ -2916,7 +2955,7 @@
       },
       "targets": {
         "dotnet": {
-          "iconUrl": "https://raw.githubusercontent.com/aws/aws-cdk/master/logo/default-256-dark.png",
+          "iconUrl": "https://raw.githubusercontent.com/aws/aws-cdk/main/logo/default-256-dark.png",
           "namespace": "Amazon.CDK",
           "packageId": "Amazon.CDK.Lib"
         },
@@ -2971,7 +3010,7 @@
     "stability": "experimental"
   },
   "homepage": "https://github.com/CloudSnorkel/cdk-github-runners.git",
-  "jsiiVersion": "1.61.0 (build abf4039)",
+  "jsiiVersion": "1.65.0 (build 7a02b7f)",
   "keywords": [
     "aws",
     "aws-cdk",
@@ -2995,7 +3034,7 @@
   },
   "name": "@cloudsnorkel/cdk-github-runners",
   "readme": {
-    "markdown": "# GitHub Self-Hosted Runners CDK Constructs\n\n[![NPM](https://img.shields.io/npm/v/@cloudsnorkel/cdk-github-runners?label=npm&logo=npm)][6]\n[![PyPI](https://img.shields.io/pypi/v/cloudsnorkel.cdk-github-runners?label=pypi&logo=pypi)][7]\n[![Maven Central](https://img.shields.io/maven-central/v/com.cloudsnorkel/cdk.github.runners.svg?label=Maven%20Central&logo=java)][8]\n[![Go](https://img.shields.io/github/v/tag/CloudSnorkel/cdk-github-runners?color=red&label=go&logo=go)][11]\n[![Nuget](https://img.shields.io/nuget/v/CloudSnorkel.Cdk.Github.Runners?color=red&&logo=nuget)][12]\n[![Release](https://github.com/CloudSnorkel/cdk-github-runners/actions/workflows/release.yml/badge.svg)](https://github.com/CloudSnorkel/cdk-github-runners/actions/workflows/release.yml)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/CloudSnorkel/cdk-github-runners/blob/main/LICENSE)\n\nUse this CDK construct to create ephemeral [self-hosted GitHub runners][1] on-demand inside your AWS account.\n\n* Easy to configure GitHub integration with a web-based interface\n* Customizable runners with decent defaults\n* Multiple runner configurations controlled by labels\n* Everything fully hosted in your account\n\nSelf-hosted runners in AWS are useful when:\n\n* You need easy access to internal resources in your actions\n* You want to pre-install some software for your actions\n* You want to provide some basic AWS API access (but [aws-actions/configure-aws-credentials][2] has more security controls)\n\nEphemeral (or on-demand) runners are the [recommended way by GitHub][14] for auto-scaling, and they make sure all jobs run with a clean image. Runners are started on-demand. You don't pay unless a job is running.\n\n## API\n\nThe best way to browse API documentation is on [Constructs Hub][13]. It is available in all supported programming languages.\n\n## Providers\n\nA runner provider creates compute resources on-demand and uses [actions/runner][5] to start a runner.\n\n|                  | CodeBuild                | Fargate        | Lambda         |\n|------------------|--------------------------|----------------|----------------|\n| **Time limit**   | 8 hours                  | Unlimited      | 15 minutes     |\n| **vCPUs**        | 2, 4, 8, or 72           | 0.25 to 4      | 1 to 6         |\n| **RAM**          | 3gb, 7gb, 15gb, or 145gb | 512mb to 30gb  | 128mb to 10gb  |\n| **Storage**      | 50gb to 824gb            | 20gb to 200gb  | Up to 10gb     |\n| **Architecture** | x86_64, ARM64            | x86_64, ARM64  | x86_64, ARM64  |\n| **sudo**         | ✔                        | ✔              | ❌              |\n| **Docker**       | ✔                        | ❌              | ❌              |\n| **Spot pricing** | ❌                        | ✔              | ❌              |\n\nThe best provider to use mostly depends on your current infrastructure. When in doubt, CodeBuild is always a good choice. Execution history and logs are easy to view, and it has no restrictive limits unless you need to run for more than 8 hours.\n\nYou can also create your own provider by implementing `IRunnerProvider`.\n\n## Installation\n\n1. Confirm you're using CDK v2\n2. Install the appropriate package\n   1. [Python][6]\n      ```\n      pip install cloudsnorkel.cdk-github-runners\n      ```\n   2. [TypeScript or JavaScript][7]\n      ```\n      npm i @cloudsnorkel/cdk-github-runners\n      ```\n   3. [Java][8]\n      ```xml\n      <dependency>\n      <groupId>com.cloudsnorkel</groupId>\n      <artifactId>cdk.github.runners</artifactId>\n      </dependency>\n      ```\n   4. [Go][11]\n      ```\n      go get github.com/CloudSnorkel/cdk-github-runners-go/cloudsnorkelcdkgithubrunners\n      ```\n   5. [.NET][12]\n      ```\n      dotnet add package CloudSnorkel.Cdk.Github.Runners\n      ```\n3. Use `GitHubRunners` construct in your code (starting with default arguments is fine)\n4. Deploy your stack\n5. Look for the status command output similar to `aws --region us-east-1 lambda invoke --function-name status-XYZ123 status.json`\n6. Execute the status command (you may need to specify `--profile` too) and open the resulting `status.json` file\n7. Open the URL in `github.setup.url` from `status.json` or [manually setup GitHub](SETUP_GITHUB.md) integration as an app or with personal access token\n8. Run status command again to confirm `github.auth.status` and `github.webhook.status` are OK\n9. Trigger a GitHub action that has a `self-hosted` label with `runs-on: [self-hosted, linux, codebuild]` or similar\n10. If the action is not successful, see [troubleshooting](#Troubleshooting)\n\n[![Demo](demo-thumbnail.jpg)](https://youtu.be/wlyv_3V8lIw)\n\n## Customizing\n\nThe default providers configured by `GitHubRunners` are useful for testing but probably not too much for actual production work. They run in the default VPC or no VPC and have no added IAM permissions. You would usually want to configure the providers yourself.\n\nFor example:\n\n```typescript\nlet vpc: ec2.Vpc;\nlet runnerSg: ec2.SecurityGroup;\nlet dbSg: ec2.SecurityGroup;\nlet bucket: s3.Bucket;\n\n// create a custom CodeBuild provider\nconst myProvider = new CodeBuildRunner(this, 'codebuild runner', {\n    label: 'my-codebuild',\n    vpc: vpc,\n    securityGroup: runnerSg,\n});\n// grant some permissions to the provider\nbucket.grantReadWrite(myProvider);\ndbSg.connections.allowFrom(runnerSg, ec2.Port.tcp(3306), 'allow runners to connect to MySQL database');\n\n// create the runner infrastructure\nnew GitHubRunners(this, 'runners', {\n    providers: [myProvider],\n});\n```\n\nAnother way to customize runners is by modifying the image used to spin them up. The image contains the [runner][5], any required dependencies, and integration code with the provider. You may choose to customize this image by adding more packages, for example.\n\n```typescript\nconst myBuilder = new CodeBuildImageBuilder(this, 'image builder', {\n   dockerfilePath: FargateProvider.LINUX_X64_DOCKERFILE_PATH,\n   runnerVersion: RunnerVersion.specific('2.291.0'),\n   rebuildInterval: Duration.days(14),\n});\nmyBuilder.setBuildArg('EXTRA_PACKAGES', 'nginx xz-utils');\n\nconst myProvider = new FargateProvider(this, 'fargate runner', {\n   label: 'my-codebuild',\n   vpc: vpc,\n   securityGroup: runnerSg,\n});\n\n// create the runner infrastructure\nnew GitHubRunners(stack, 'runners', {\n   providers: [myProvider],\n});\n```\n\nYour workflow will then look like:\n\n```yaml\nname: self-hosted example\non: push\njobs:\n  self-hosted:\n    runs-on: [self-hosted, my-codebuild]\n    steps:\n      - run: echo hello world\n```\n\n## Architecture\n\n![Architecture diagram](architecture.svg)\n\n## Troubleshooting\n\n1. Always start with the status function, make sure no errors are reported, and confirm all status codes are OK\n2. Confirm the webhook Lambda was called by visiting the URL in `troubleshooting.webhookHandlerUrl` from `status.json`\n   1. If it's not called or logs errors, confirm the webhook settings on the GitHub side\n   2. If you see too many errors, make sure you're only sending `workflow_job` events\n3. When using GitHub app, make sure there are active installation in `github.auth.app.installations`\n4. Check execution details of the orchestrator step function by visiting the URL in `troubleshooting.stepFunctionUrl` from `status.json`\n   1. Use the details tab to find the specific execution of the provider (Lambda, CodeBuild, Fargate, etc.)\n   2. Every step function execution should be successful, even if the runner action inside it failed\n\n## Other Options\n\n1. [philips-labs/terraform-aws-github-runner][3] if you're using Terraform\n2. [actions-runner-controller/actions-runner-controller][4] if you're using Kubernetes\n\n\n[1]: https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners\n[2]: https://github.com/marketplace/actions/configure-aws-credentials-action-for-github-actions\n[3]: https://github.com/philips-labs/terraform-aws-github-runner\n[4]: https://github.com/actions-runner-controller/actions-runner-controller\n[5]: https://github.com/actions/runner\n[6]: https://www.npmjs.com/package/@cloudsnorkel/cdk-github-runners\n[7]: https://pypi.org/project/cloudsnorkel.cdk-github-runners\n[8]: https://search.maven.org/search?q=g:%22com.cloudsnorkel%22%20AND%20a:%22cdk.github.runners%22\n[9]: https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps\n[10]: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token\n[11]: https://pkg.go.dev/github.com/CloudSnorkel/cdk-github-runners-go/cloudsnorkelcdkgithubrunners\n[12]: https://www.nuget.org/packages/CloudSnorkel.Cdk.Github.Runners/\n[13]: https://constructs.dev/packages/@cloudsnorkel/cdk-github-runners/\n[14]: https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling"
+    "markdown": "# GitHub Self-Hosted Runners CDK Constructs\n\n[![NPM](https://img.shields.io/npm/v/@cloudsnorkel/cdk-github-runners?label=npm&logo=npm)][7]\n[![PyPI](https://img.shields.io/pypi/v/cloudsnorkel.cdk-github-runners?label=pypi&logo=pypi)][6]\n[![Maven Central](https://img.shields.io/maven-central/v/com.cloudsnorkel/cdk.github.runners.svg?label=Maven%20Central&logo=java)][8]\n[![Go](https://img.shields.io/github/v/tag/CloudSnorkel/cdk-github-runners?color=red&label=go&logo=go)][11]\n[![Nuget](https://img.shields.io/nuget/v/CloudSnorkel.Cdk.Github.Runners?color=red&&logo=nuget)][12]\n[![Release](https://github.com/CloudSnorkel/cdk-github-runners/actions/workflows/release.yml/badge.svg)](https://github.com/CloudSnorkel/cdk-github-runners/actions/workflows/release.yml)\n[![License](https://img.shields.io/badge/license-Apache--2.0-blue)](https://github.com/CloudSnorkel/cdk-github-runners/blob/main/LICENSE)\n\nUse this CDK construct to create ephemeral [self-hosted GitHub runners][1] on-demand inside your AWS account.\n\n* Easy to configure GitHub integration with a web-based interface\n* Customizable runners with decent defaults\n* Multiple runner configurations controlled by labels\n* Everything fully hosted in your account\n* Automatically updated build environment with latest runner version\n\nSelf-hosted runners in AWS are useful when:\n\n* You need easy access to internal resources in your actions\n* You want to pre-install some software for your actions\n* You want to provide some basic AWS API access (but [aws-actions/configure-aws-credentials][2] has more security controls)\n\nEphemeral (or on-demand) runners are the [recommended way by GitHub][14] for auto-scaling, and they make sure all jobs run with a clean image. Runners are started on-demand. You don't pay unless a job is running.\n\n## API\n\nThe best way to browse API documentation is on [Constructs Hub][13]. It is available in all supported programming languages.\n\n## Providers\n\nA runner provider creates compute resources on-demand and uses [actions/runner][5] to start a runner.\n\n|                  | CodeBuild                  | Fargate       | Lambda        |\n|------------------|----------------------------|---------------|---------------|\n| **Time limit**   | 8 hours                    | Unlimited     | 15 minutes    |\n| **vCPUs**        | 2, 4, 8, or 72             | 0.25 to 4     | 1 to 6        |\n| **RAM**          | 3gb, 7gb, 15gb, or 145gb   | 512mb to 30gb | 128mb to 10gb |\n| **Storage**      | 50gb to 824gb              | 20gb to 200gb | Up to 10gb    |\n| **Architecture** | x86_64, ARM64              | x86_64, ARM64 | x86_64, ARM64 |\n| **sudo**         | ✔                         | ✔            | ❌           |\n| **Docker**       | ✔ (Linux only)            | ❌            | ❌           |\n| **Spot pricing** | ❌                         | ✔            | ❌           |\n| **OS**           | Linux, Windows             | Linux         | Linux         |\n\nThe best provider to use mostly depends on your current infrastructure. When in doubt, CodeBuild is always a good choice. Execution history and logs are easy to view, and it has no restrictive limits unless you need to run for more than 8 hours.\n\nYou can also create your own provider by implementing `IRunnerProvider`.\n\n## Installation\n\n1. Confirm you're using CDK v2\n2. Install the appropriate package\n   1. [Python][6]\n      ```\n      pip install cloudsnorkel.cdk-github-runners\n      ```\n   2. [TypeScript or JavaScript][7]\n      ```\n      npm i @cloudsnorkel/cdk-github-runners\n      ```\n   3. [Java][8]\n      ```xml\n      <dependency>\n      <groupId>com.cloudsnorkel</groupId>\n      <artifactId>cdk.github.runners</artifactId>\n      </dependency>\n      ```\n   4. [Go][11]\n      ```\n      go get github.com/CloudSnorkel/cdk-github-runners-go/cloudsnorkelcdkgithubrunners\n      ```\n   5. [.NET][12]\n      ```\n      dotnet add package CloudSnorkel.Cdk.Github.Runners\n      ```\n3. Use `GitHubRunners` construct in your code (starting with default arguments is fine)\n4. Deploy your stack\n5. Look for the status command output similar to `aws --region us-east-1 lambda invoke --function-name status-XYZ123 status.json`\n6. Execute the status command (you may need to specify `--profile` too) and open the resulting `status.json` file\n7. Open the URL in `github.setup.url` from `status.json` or [manually setup GitHub](SETUP_GITHUB.md) integration as an app or with personal access token\n8. Run status command again to confirm `github.auth.status` and `github.webhook.status` are OK\n9. Trigger a GitHub action that has a `self-hosted` label with `runs-on: [self-hosted, linux, codebuild]` or similar\n10. If the action is not successful, see [troubleshooting](#Troubleshooting)\n\n[![Demo](demo-thumbnail.jpg)](https://youtu.be/wlyv_3V8lIw)\n\n## Customizing\n\nThe default providers configured by `GitHubRunners` are useful for testing but probably not too much for actual production work. They run in the default VPC or no VPC and have no added IAM permissions. You would usually want to configure the providers yourself.\n\nFor example:\n\n```typescript\nlet vpc: ec2.Vpc;\nlet runnerSg: ec2.SecurityGroup;\nlet dbSg: ec2.SecurityGroup;\nlet bucket: s3.Bucket;\n\n// create a custom CodeBuild provider\nconst myProvider = new CodeBuildRunner(this, 'codebuild runner', {\n    label: 'my-codebuild',\n    vpc: vpc,\n    securityGroup: runnerSg,\n});\n// grant some permissions to the provider\nbucket.grantReadWrite(myProvider);\ndbSg.connections.allowFrom(runnerSg, ec2.Port.tcp(3306), 'allow runners to connect to MySQL database');\n\n// create the runner infrastructure\nnew GitHubRunners(this, 'runners', {\n    providers: [myProvider],\n});\n```\n\nAnother way to customize runners is by modifying the image used to spin them up. The image contains the [runner][5], any required dependencies, and integration code with the provider. You may choose to customize this image by adding more packages, for example.\n\n```typescript\nconst myBuilder = new CodeBuildImageBuilder(this, 'image builder', {\n   dockerfilePath: FargateProvider.LINUX_X64_DOCKERFILE_PATH,\n   runnerVersion: RunnerVersion.specific('2.291.0'),\n   rebuildInterval: Duration.days(14),\n});\nmyBuilder.setBuildArg('EXTRA_PACKAGES', 'nginx xz-utils');\n\nconst myProvider = new FargateProvider(this, 'fargate runner', {\n   label: 'customized-fargate',\n   vpc: vpc,\n   securityGroup: runnerSg,\n});\n\n// create the runner infrastructure\nnew GitHubRunners(stack, 'runners', {\n   providers: [myProvider],\n});\n```\n\nYour workflow will then look like:\n\n```yaml\nname: self-hosted example\non: push\njobs:\n  self-hosted:\n    runs-on: [self-hosted, customized-fargate]\n    steps:\n      - run: echo hello world\n```\n\n## Architecture\n\n![Architecture diagram](architecture.svg)\n\n## Troubleshooting\n\n1. Always start with the status function, make sure no errors are reported, and confirm all status codes are OK\n2. Confirm the webhook Lambda was called by visiting the URL in `troubleshooting.webhookHandlerUrl` from `status.json`\n   1. If it's not called or logs errors, confirm the webhook settings on the GitHub side\n   2. If you see too many errors, make sure you're only sending `workflow_job` events\n3. When using GitHub app, make sure there are active installation in `github.auth.app.installations`\n4. Check execution details of the orchestrator step function by visiting the URL in `troubleshooting.stepFunctionUrl` from `status.json`\n   1. Use the details tab to find the specific execution of the provider (Lambda, CodeBuild, Fargate, etc.)\n   2. Every step function execution should be successful, even if the runner action inside it failed\n\n## Other Options\n\n1. [philips-labs/terraform-aws-github-runner][3] if you're using Terraform\n2. [actions-runner-controller/actions-runner-controller][4] if you're using Kubernetes\n\n\n[1]: https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners\n[2]: https://github.com/marketplace/actions/configure-aws-credentials-action-for-github-actions\n[3]: https://github.com/philips-labs/terraform-aws-github-runner\n[4]: https://github.com/actions-runner-controller/actions-runner-controller\n[5]: https://github.com/actions/runner\n[6]: https://pypi.org/project/cloudsnorkel.cdk-github-runners\n[7]: https://www.npmjs.com/package/@cloudsnorkel/cdk-github-runners\n[8]: https://search.maven.org/search?q=g:%22com.cloudsnorkel%22%20AND%20a:%22cdk.github.runners%22\n[9]: https://docs.github.com/en/developers/apps/getting-started-with-apps/about-apps\n[10]: https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token\n[11]: https://pkg.go.dev/github.com/CloudSnorkel/cdk-github-runners-go/cloudsnorkelcdkgithubrunners\n[12]: https://www.nuget.org/packages/CloudSnorkel.Cdk.Github.Runners/\n[13]: https://constructs.dev/packages/@cloudsnorkel/cdk-github-runners/\n[14]: https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling\n"
   },
   "repository": {
     "type": "git",
@@ -3124,7 +3163,7 @@
       "assembly": "@cloudsnorkel/cdk-github-runners",
       "base": "constructs.Construct",
       "docs": {
-        "remarks": "Builders can be used with runner providers.\n\nEach builder re-runs automatically at a set interval to make sure the images contain the latest versions of everything.\n\nYou can create an instance of this construct to customize the image used to spin-up runners. Each provider has its own requirements for what an image should do. That's why they each provide their own Dockerfile.\n\nFor example, to set a specific runner version, rebuild the image every 2 weeks, and add a few packages for the Fargate provider, use:\n\n```\nconst builder = new CodeBuildImageBuilder(this, 'Builder', {\n     dockerfilePath: FargateProvider.LINUX_X64_DOCKERFILE_PATH,\n     runnerVersion: RunnerVersion.specific('2.293.0'),\n     rebuildInterval: Duration.days(14),\n});\nbuilder.setBuildArg('EXTRA_PACKAGES', 'nginx xz-utils');\nnew FargateProvider(this, 'Fargate provider', {\n     label: 'customized-fargate',\n     imageBuilder: builder,\n});\n```",
+        "remarks": "Builders can be used with runner providers.\n\nEach builder re-runs automatically at a set interval to make sure the images contain the latest versions of everything.\n\nYou can create an instance of this construct to customize the image used to spin-up runners. Each provider has its own requirements for what an image should do. That's why they each provide their own Dockerfile.\n\nFor example, to set a specific runner version, rebuild the image every 2 weeks, and add a few packages for the Fargate provider, use:\n\n```\nconst builder = new CodeBuildImageBuilder(this, 'Builder', {\n     dockerfilePath: FargateProvider.LINUX_X64_DOCKERFILE_PATH,\n     runnerVersion: RunnerVersion.specific('2.293.0'),\n     rebuildInterval: Duration.days(14),\n});\nbuilder.setBuildArg('EXTRA_PACKAGES', 'nginx xz-utils');\nnew FargateRunner(this, 'Fargate provider', {\n     label: 'customized-fargate',\n     imageBuilder: builder,\n});\n```",
         "stability": "experimental",
         "summary": "An image builder that uses CodeBuild to build Docker images pre-baked with all the GitHub Actions runner requirements."
       },
@@ -3167,6 +3206,29 @@
         "line": 149
       },
       "methods": [
+        {
+          "docs": {
+            "remarks": "All first party Dockerfiles support this. Others may not.",
+            "stability": "experimental",
+            "summary": "Add extra trusted certificates. This helps deal with self-signed certificates for GitHub Enterprise Server."
+          },
+          "locationInModule": {
+            "filename": "src/providers/image-builders/codebuild.ts",
+            "line": 271
+          },
+          "name": "addExtraCertificates",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "path to directory containing a file called certs.pem containing all the required certificates."
+              },
+              "name": "path",
+              "type": {
+                "primitive": "string"
+              }
+            }
+          ]
+        },
         {
           "docs": {
             "stability": "experimental",
@@ -3271,7 +3333,7 @@
           },
           "locationInModule": {
             "filename": "src/providers/image-builders/codebuild.ts",
-            "line": 267
+            "line": 281
           },
           "name": "bind",
           "overrides": "@cloudsnorkel/cdk-github-runners.IImageBuilder",
@@ -3555,7 +3617,7 @@
           "docs": {
             "default": "no VPC",
             "stability": "experimental",
-            "summary": "VPC to launch the runners in."
+            "summary": "VPC to build the image in."
           },
           "immutable": true,
           "locationInModule": {
@@ -3586,7 +3648,7 @@
         },
         "locationInModule": {
           "filename": "src/providers/codebuild.ts",
-          "line": 133
+          "line": 138
         },
         "parameters": [
           {
@@ -3626,7 +3688,7 @@
           },
           "locationInModule": {
             "filename": "src/providers/codebuild.ts",
-            "line": 233
+            "line": 249
           },
           "name": "getStepFunctionTask",
           "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
@@ -3694,7 +3756,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/codebuild.ts",
-            "line": 273
+            "line": 289
           },
           "name": "connections",
           "overrides": "aws-cdk-lib.aws_ec2.IConnectable",
@@ -3718,6 +3780,22 @@
             "fqn": "aws-cdk-lib.aws_iam.IPrincipal"
           }
         },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Docker image in CodeBuild project."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/codebuild.ts",
+            "line": 136
+          },
+          "name": "image",
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
+          }
+        },
         {
           "docs": {
             "stability": "experimental",
@@ -3935,22 +4013,22 @@
       ],
       "symbolId": "src/providers/codebuild:CodeBuildRunnerProps"
     },
-    "@cloudsnorkel/cdk-github-runners.FargateRunner": {
+    "@cloudsnorkel/cdk-github-runners.ContainerImageBuilder": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
       "base": "constructs.Construct",
       "docs": {
-        "remarks": "Creates a task definition with a single container that gets started for each job.\n\nThis construct is not meant to be used by itself. It should be passed in the providers property for GitHubRunners.",
+        "remarks": "Builders can be used with runner providers.\n\nThe CodeBuild builder is better and faster. Only use this one if you have no choice. For example, if you need Windows containers.\n\nEach builder re-runs automatically at a set interval to make sure the images contain the latest versions of everything.\n\nYou can create an instance of this construct to customize the image used to spin-up runners. Some runner providers may require custom components. Check the runner provider documentation. The default components work with CodeBuild.\n\nFor example, to set a specific runner version, rebuild the image every 2 weeks, and add a few packages for the Fargate provider, use:\n\n```\nconst builder = new ContainerImageBuilder(this, 'Builder', {\n     runnerVersion: RunnerVersion.specific('2.293.0'),\n     rebuildInterval: Duration.days(14),\n});\nnew CodeBuildRunner(this, 'Fargate provider', {\n     label: 'windows-codebuild',\n     imageBuilder: builder,\n});\n```",
         "stability": "experimental",
-        "summary": "GitHub Actions runner provider using Fargate to execute the actions."
+        "summary": "An image builder that uses Image Builder to build Docker images pre-baked with all the GitHub Actions runner requirements."
       },
-      "fqn": "@cloudsnorkel/cdk-github-runners.FargateRunner",
+      "fqn": "@cloudsnorkel/cdk-github-runners.ContainerImageBuilder",
       "initializer": {
         "docs": {
           "stability": "experimental"
         },
         "locationInModule": {
-          "filename": "src/providers/fargate.ts",
-          "line": 229
+          "filename": "src/providers/image-builders/container.ts",
+          "line": 422
         },
         "parameters": [
           {
@@ -3967,409 +4045,442 @@
           },
           {
             "name": "props",
+            "optional": true,
             "type": {
-              "fqn": "@cloudsnorkel/cdk-github-runners.FargateRunnerProps"
+              "fqn": "@cloudsnorkel/cdk-github-runners.ContainerImageBuilderProps"
             }
           }
         ]
       },
       "interfaces": [
-        "@cloudsnorkel/cdk-github-runners.IRunnerProvider"
+        "@cloudsnorkel/cdk-github-runners.IImageBuilder"
       ],
       "kind": "class",
       "locationInModule": {
-        "filename": "src/providers/fargate.ts",
-        "line": 160
+        "filename": "src/providers/image-builders/container.ts",
+        "line": 402
       },
       "methods": [
         {
           "docs": {
-            "remarks": "Called by GithubRunners and shouldn't be called manually.",
             "stability": "experimental",
-            "summary": "Generate step function task(s) to start a new runner."
+            "summary": "Add a component to be installed."
           },
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 298
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 564
           },
-          "name": "getStepFunctionTask",
-          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "name": "addComponent",
+          "parameters": [
+            {
+              "name": "component",
+              "type": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderComponent"
+              }
+            }
+          ]
+        },
+        {
+          "docs": {
+            "remarks": "All first party Dockerfiles support this. Others may not.",
+            "stability": "experimental",
+            "summary": "Add extra trusted certificates. This helps deal with self-signed certificates for GitHub Enterprise Server."
+          },
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 581
+          },
+          "name": "addExtraCertificates",
           "parameters": [
             {
               "docs": {
-                "summary": "workflow job details."
+                "summary": "path to directory containing a file called certs.pem containing all the required certificates."
               },
-              "name": "parameters",
+              "name": "path",
               "type": {
-                "fqn": "@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters"
+                "primitive": "string"
               }
             }
-          ],
+          ]
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Called by IRunnerProvider to finalize settings and create the image builder."
+          },
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 602
+          },
+          "name": "bind",
+          "overrides": "@cloudsnorkel/cdk-github-runners.IImageBuilder",
           "returns": {
             "type": {
-              "fqn": "aws-cdk-lib.aws_stepfunctions.IChainable"
+              "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
             }
           }
+        },
+        {
+          "docs": {
+            "remarks": "Useful for required system settings like certificates or proxy settings.",
+            "stability": "experimental",
+            "summary": "Add a component to be installed before any other components."
+          },
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 550
+          },
+          "name": "prependComponent",
+          "parameters": [
+            {
+              "name": "component",
+              "type": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderComponent"
+              }
+            }
+          ]
         }
       ],
-      "name": "FargateRunner",
+      "name": "ContainerImageBuilder",
       "properties": [
         {
-          "const": true,
           "docs": {
-            "remarks": "Use this Dockerfile unless you need to customize it further than allowed by hooks.\n\nAvailable build arguments that can be set in the image builder:\n* `BASE_IMAGE` sets the `FROM` line. This should be an Ubuntu compatible image.\n* `EXTRA_PACKAGES` can be used to install additional packages.",
-            "stability": "experimental",
-            "summary": "Path to Dockerfile for Linux ARM64 with all the requirement for Fargate runner."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 177
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 403
           },
-          "name": "LINUX_ARM64_DOCKERFILE_PATH",
-          "static": true,
+          "name": "architecture",
           "type": {
-            "primitive": "string"
+            "fqn": "@cloudsnorkel/cdk-github-runners.Architecture"
           }
         },
         {
-          "const": true,
           "docs": {
-            "remarks": "Use this Dockerfile unless you need to customize it further than allowed by hooks.\n\nAvailable build arguments that can be set in the image builder:\n* `BASE_IMAGE` sets the `FROM` line. This should be an Ubuntu compatible image.\n* `EXTRA_PACKAGES` can be used to install additional packages.",
-            "stability": "experimental",
-            "summary": "Path to Dockerfile for Linux x64 with all the requirement for Fargate runner."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 168
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 407
           },
-          "name": "LINUX_X64_DOCKERFILE_PATH",
-          "static": true,
+          "name": "description",
           "type": {
             "primitive": "string"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Whether task will have a public IP."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 212
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 417
           },
-          "name": "assignPublicIp",
+          "name": "instanceTypes",
           "type": {
-            "primitive": "boolean"
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Cluster hosting the task hosting the runner."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 182
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 420
           },
-          "name": "cluster",
+          "name": "logRemovalPolicy",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ecs.Cluster"
+            "fqn": "aws-cdk-lib.RemovalPolicy"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "The network connections associated with this resource."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 222
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 419
           },
-          "name": "connections",
-          "overrides": "aws-cdk-lib.aws_ec2.IConnectable",
+          "name": "logRetention",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ec2.Connections"
+            "fqn": "aws-cdk-lib.aws_logs.RetentionDays"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Container definition hosting the runner."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 192
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 404
           },
-          "name": "container",
+          "name": "os",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ecs.ContainerDefinition"
+            "fqn": "@cloudsnorkel/cdk-github-runners.Os"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Grant principal used to add permissions to the runner role."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 217
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 405
           },
-          "name": "grantPrincipal",
-          "overrides": "aws-cdk-lib.aws_iam.IGrantable",
+          "name": "platform",
           "type": {
-            "fqn": "aws-cdk-lib.aws_iam.IPrincipal"
+            "primitive": "string"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Label associated with this provider."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 197
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 418
           },
-          "name": "label",
-          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "name": "rebuildInterval",
           "type": {
-            "primitive": "string"
+            "fqn": "aws-cdk-lib.Duration"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Use spot pricing for Fargate tasks."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 227
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 411
           },
-          "name": "spot",
+          "name": "repository",
           "type": {
-            "primitive": "boolean"
+            "fqn": "aws-cdk-lib.aws_ecr.IRepository"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Fargate task hosting the runner."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 187
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 409
           },
-          "name": "task",
+          "name": "runnerVersion",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ecs.FargateTaskDefinition"
+            "fqn": "@cloudsnorkel/cdk-github-runners.RunnerVersion"
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "Security group attached to the task."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 207
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 416
           },
-          "name": "securityGroup",
+          "name": "securityGroupIds",
           "optional": true,
-          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+            "collection": {
+              "elementtype": {
+                "primitive": "string"
+              },
+              "kind": "array"
+            }
           }
         },
         {
           "docs": {
-            "stability": "experimental",
-            "summary": "VPC used for hosting the task."
+            "stability": "experimental"
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 202
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 415
           },
-          "name": "vpc",
+          "name": "subnetId",
           "optional": true,
-          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+            "primitive": "string"
           }
         }
       ],
-      "symbolId": "src/providers/fargate:FargateRunner"
+      "symbolId": "src/providers/image-builders/container:ContainerImageBuilder"
     },
-    "@cloudsnorkel/cdk-github-runners.FargateRunnerProps": {
+    "@cloudsnorkel/cdk-github-runners.ContainerImageBuilderProps": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
       "datatype": true,
       "docs": {
         "stability": "experimental",
-        "summary": "Properties for FargateRunner."
+        "summary": "Properties for ContainerImageBuilder construct."
       },
-      "fqn": "@cloudsnorkel/cdk-github-runners.FargateRunnerProps",
-      "interfaces": [
-        "@cloudsnorkel/cdk-github-runners.RunnerProviderProps"
-      ],
+      "fqn": "@cloudsnorkel/cdk-github-runners.ContainerImageBuilderProps",
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/providers/fargate.ts",
-        "line": 19
+        "filename": "src/providers/image-builders/container.ts",
+        "line": 27
       },
-      "name": "FargateRunnerProps",
+      "name": "ContainerImageBuilderProps",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "default": "true",
-            "remarks": "Make sure the task will have access to GitHub. A public IP might be required unless you have NAT gateway.",
+            "default": "Architecture.X86_64",
             "stability": "experimental",
-            "summary": "Assign public IP to the runner task."
+            "summary": "Image architecture."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 72
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 33
           },
-          "name": "assignPublicIp",
+          "name": "architecture",
           "optional": true,
           "type": {
-            "primitive": "boolean"
+            "fqn": "@cloudsnorkel/cdk-github-runners.Architecture"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "a new cluster",
+            "default": "m5.large",
             "stability": "experimental",
-            "summary": "Existing Fargate cluster to use."
+            "summary": "The instance type used to build the image."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 63
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 84
           },
-          "name": "cluster",
+          "name": "instanceType",
           "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_ecs.Cluster"
+            "fqn": "aws-cdk-lib.aws_ec2.InstanceType"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "1024",
-            "remarks": "For tasks using the Fargate launch type,\nthis field is required and you must use one of the following values,\nwhich determines your range of valid values for the memory parameter:\n\n256 (.25 vCPU) - Available memory values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB)\n\n512 (.5 vCPU) - Available memory values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB)\n\n1024 (1 vCPU) - Available memory values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB)\n\n2048 (2 vCPU) - Available memory values: Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB)\n\n4096 (4 vCPU) - Available memory values: Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB)",
+            "default": "RemovalPolicy.DESTROY",
+            "remarks": "If deployment fails on the custom resource, try setting this to `RemovalPolicy.RETAIN`. This way the CodeBuild logs can still be viewed, and you can see why the build failed.\n\nWe try to not leave anything behind when removed. But sometimes a log staying behind is useful.",
             "stability": "experimental",
-            "summary": "The number of cpu units used by the task."
+            "summary": "Removal policy for logs of image builds."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 91
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 102
           },
-          "name": "cpu",
+          "name": "logRemovalPolicy",
           "optional": true,
           "type": {
-            "primitive": "number"
+            "fqn": "aws-cdk-lib.RemovalPolicy"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "20",
-            "remarks": "The maximum supported value is 200 GiB.\n\nNOTE: This parameter is only supported for tasks hosted on AWS Fargate using platform version 1.4.0 or later.",
+            "default": "logs.RetentionDays.ONE_MONTH",
+            "remarks": "When updating\nthis property, unsetting it doesn't remove the log retention policy. To\nremove the retention policy, set the value to `INFINITE`.",
             "stability": "experimental",
-            "summary": "The amount (in GiB) of ephemeral storage to be allocated to the task."
+            "summary": "The number of days log events are kept in CloudWatch Logs."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 118
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 93
           },
-          "name": "ephemeralStorageGiB",
+          "name": "logRetention",
           "optional": true,
           "type": {
-            "primitive": "number"
+            "fqn": "aws-cdk-lib.aws_logs.RetentionDays"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "image builder with `FargateRunner.LINUX_X64_DOCKERFILE_PATH` as Dockerfile",
-            "remarks": "A user named `runner` is expected to exist.\n\nThe entry point should start GitHub runner. For example:\n\n```\n#!/bin/bash\nset -e -u -o pipefail\n\n/home/runner/config.sh --unattended --url \"https://${GITHUB_DOMAIN}/${OWNER}/${REPO}\" --token \"${RUNNER_TOKEN}\" --ephemeral --work _work --labels \"${RUNNER_LABEL}\" --disableupdate --name \"${RUNNER_NAME}\"\n/home/runner/run.sh\n```",
+            "default": "OS.LINUX",
             "stability": "experimental",
-            "summary": "Provider running an image to run inside CodeBuild with GitHub runner pre-configured."
+            "summary": "Image OS."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 35
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 40
           },
-          "name": "imageBuilder",
+          "name": "os",
           "optional": true,
           "type": {
-            "fqn": "@cloudsnorkel/cdk-github-runners.IImageBuilder"
+            "fqn": "@cloudsnorkel/cdk-github-runners.Os"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "'fargate'",
+            "default": "Duration.days(7)",
+            "remarks": "Useful for keeping the image up-do-date with the latest GitHub runner version and latest OS updates.\n\nSet to zero to disable.",
             "stability": "experimental",
-            "summary": "GitHub Actions label used for this provider."
+            "summary": "Schedule the image to be rebuilt every given interval."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 42
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 56
           },
-          "name": "label",
+          "name": "rebuildInterval",
           "optional": true,
           "type": {
-            "primitive": "string"
+            "fqn": "aws-cdk-lib.Duration"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "2048",
-            "remarks": "For tasks using the Fargate launch type,\nthis field is required and you must use one of the following values, which determines your range of valid values for the cpu parameter:\n\n512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available cpu values: 256 (.25 vCPU)\n\n1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available cpu values: 512 (.5 vCPU)\n\n2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available cpu values: 1024 (1 vCPU)\n\nBetween 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available cpu values: 2048 (2 vCPU)\n\nBetween 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available cpu values: 4096 (4 vCPU)",
+            "default": "latest version available",
             "stability": "experimental",
-            "summary": "The amount (in MiB) of memory used by the task."
+            "summary": "Version of GitHub Runners to install."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 109
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 47
           },
-          "name": "memoryLimitMiB",
+          "name": "runnerVersion",
           "optional": true,
           "type": {
-            "primitive": "number"
+            "fqn": "@cloudsnorkel/cdk-github-runners.RunnerVersion"
           }
         },
         {
           "abstract": true,
           "docs": {
-            "default": "a new security group",
+            "default": "default account security group",
             "stability": "experimental",
-            "summary": "Security Group to assign to the task."
+            "summary": "Security Group to assign to this instance."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 56
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 70
           },
           "name": "securityGroup",
           "optional": true,
@@ -4380,20 +4491,19 @@
         {
           "abstract": true,
           "docs": {
-            "default": "false",
-            "remarks": "* Runners may fail to start due to missing capacity.\n* Runners might be stopped prematurely with spot pricing.",
+            "default": "default VPC subnet",
             "stability": "experimental",
-            "summary": "Use Fargate spot capacity provider to save money."
+            "summary": "Where to place the network interfaces within the VPC."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 128
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 77
           },
-          "name": "spot",
+          "name": "subnetSelection",
           "optional": true,
           "type": {
-            "primitive": "boolean"
+            "fqn": "aws-cdk-lib.aws_ec2.SubnetSelection"
           }
         },
         {
@@ -4405,8 +4515,8 @@
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/fargate.ts",
-            "line": 49
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 63
           },
           "name": "vpc",
           "optional": true,
@@ -4415,24 +4525,1014 @@
           }
         }
       ],
-      "symbolId": "src/providers/fargate:FargateRunnerProps"
+      "symbolId": "src/providers/image-builders/container:ContainerImageBuilderProps"
+    },
+    "@cloudsnorkel/cdk-github-runners.FargateRunner": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "base": "constructs.Construct",
+      "docs": {
+        "remarks": "Creates a task definition with a single container that gets started for each job.\n\nThis construct is not meant to be used by itself. It should be passed in the providers property for GitHubRunners.",
+        "stability": "experimental",
+        "summary": "GitHub Actions runner provider using Fargate to execute the actions."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.FargateRunner",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/providers/fargate.ts",
+          "line": 235
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "type": {
+              "fqn": "@cloudsnorkel/cdk-github-runners.FargateRunnerProps"
+            }
+          }
+        ]
+      },
+      "interfaces": [
+        "@cloudsnorkel/cdk-github-runners.IRunnerProvider"
+      ],
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/providers/fargate.ts",
+        "line": 161
+      },
+      "methods": [
+        {
+          "docs": {
+            "remarks": "Called by GithubRunners and shouldn't be called manually.",
+            "stability": "experimental",
+            "summary": "Generate step function task(s) to start a new runner."
+          },
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 304
+          },
+          "name": "getStepFunctionTask",
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "workflow job details."
+              },
+              "name": "parameters",
+              "type": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_stepfunctions.IChainable"
+            }
+          }
+        }
+      ],
+      "name": "FargateRunner",
+      "properties": [
+        {
+          "const": true,
+          "docs": {
+            "remarks": "Use this Dockerfile unless you need to customize it further than allowed by hooks.\n\nAvailable build arguments that can be set in the image builder:\n* `BASE_IMAGE` sets the `FROM` line. This should be an Ubuntu compatible image.\n* `EXTRA_PACKAGES` can be used to install additional packages.",
+            "stability": "experimental",
+            "summary": "Path to Dockerfile for Linux ARM64 with all the requirement for Fargate runner."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 178
+          },
+          "name": "LINUX_ARM64_DOCKERFILE_PATH",
+          "static": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "const": true,
+          "docs": {
+            "remarks": "Use this Dockerfile unless you need to customize it further than allowed by hooks.\n\nAvailable build arguments that can be set in the image builder:\n* `BASE_IMAGE` sets the `FROM` line. This should be an Ubuntu compatible image.\n* `EXTRA_PACKAGES` can be used to install additional packages.",
+            "stability": "experimental",
+            "summary": "Path to Dockerfile for Linux x64 with all the requirement for Fargate runner."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 169
+          },
+          "name": "LINUX_X64_DOCKERFILE_PATH",
+          "static": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Whether task will have a public IP."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 213
+          },
+          "name": "assignPublicIp",
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Cluster hosting the task hosting the runner."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 183
+          },
+          "name": "cluster",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ecs.Cluster"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "The network connections associated with this resource."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 223
+          },
+          "name": "connections",
+          "overrides": "aws-cdk-lib.aws_ec2.IConnectable",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.Connections"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Container definition hosting the runner."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 193
+          },
+          "name": "container",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ecs.ContainerDefinition"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Grant principal used to add permissions to the runner role."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 218
+          },
+          "name": "grantPrincipal",
+          "overrides": "aws-cdk-lib.aws_iam.IGrantable",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_iam.IPrincipal"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Docker image used to start a new Fargate task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 233
+          },
+          "name": "image",
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Label associated with this provider."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 198
+          },
+          "name": "label",
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Use spot pricing for Fargate tasks."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 228
+          },
+          "name": "spot",
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Fargate task hosting the runner."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 188
+          },
+          "name": "task",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ecs.FargateTaskDefinition"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Security group attached to the task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 208
+          },
+          "name": "securityGroup",
+          "optional": true,
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "VPC used for hosting the task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 203
+          },
+          "name": "vpc",
+          "optional": true,
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        }
+      ],
+      "symbolId": "src/providers/fargate:FargateRunner"
+    },
+    "@cloudsnorkel/cdk-github-runners.FargateRunnerProps": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Properties for FargateRunner."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.FargateRunnerProps",
+      "interfaces": [
+        "@cloudsnorkel/cdk-github-runners.RunnerProviderProps"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/providers/fargate.ts",
+        "line": 20
+      },
+      "name": "FargateRunnerProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "true",
+            "remarks": "Make sure the task will have access to GitHub. A public IP might be required unless you have NAT gateway.",
+            "stability": "experimental",
+            "summary": "Assign public IP to the runner task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 73
+          },
+          "name": "assignPublicIp",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "a new cluster",
+            "stability": "experimental",
+            "summary": "Existing Fargate cluster to use."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 64
+          },
+          "name": "cluster",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ecs.Cluster"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "1024",
+            "remarks": "For tasks using the Fargate launch type,\nthis field is required and you must use one of the following values,\nwhich determines your range of valid values for the memory parameter:\n\n256 (.25 vCPU) - Available memory values: 512 (0.5 GB), 1024 (1 GB), 2048 (2 GB)\n\n512 (.5 vCPU) - Available memory values: 1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB)\n\n1024 (1 vCPU) - Available memory values: 2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB)\n\n2048 (2 vCPU) - Available memory values: Between 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB)\n\n4096 (4 vCPU) - Available memory values: Between 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB)",
+            "stability": "experimental",
+            "summary": "The number of cpu units used by the task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 92
+          },
+          "name": "cpu",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "20",
+            "remarks": "The maximum supported value is 200 GiB.\n\nNOTE: This parameter is only supported for tasks hosted on AWS Fargate using platform version 1.4.0 or later.",
+            "stability": "experimental",
+            "summary": "The amount (in GiB) of ephemeral storage to be allocated to the task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 119
+          },
+          "name": "ephemeralStorageGiB",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "image builder with `FargateRunner.LINUX_X64_DOCKERFILE_PATH` as Dockerfile",
+            "remarks": "A user named `runner` is expected to exist.\n\nThe entry point should start GitHub runner. For example:\n\n```\n#!/bin/bash\nset -e -u -o pipefail\n\n/home/runner/config.sh --unattended --url \"https://${GITHUB_DOMAIN}/${OWNER}/${REPO}\" --token \"${RUNNER_TOKEN}\" --ephemeral --work _work --labels \"${RUNNER_LABEL}\" --disableupdate --name \"${RUNNER_NAME}\"\n/home/runner/run.sh\n```",
+            "stability": "experimental",
+            "summary": "Provider running an image to run inside CodeBuild with GitHub runner pre-configured."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 36
+          },
+          "name": "imageBuilder",
+          "optional": true,
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.IImageBuilder"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "'fargate'",
+            "stability": "experimental",
+            "summary": "GitHub Actions label used for this provider."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 43
+          },
+          "name": "label",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "2048",
+            "remarks": "For tasks using the Fargate launch type,\nthis field is required and you must use one of the following values, which determines your range of valid values for the cpu parameter:\n\n512 (0.5 GB), 1024 (1 GB), 2048 (2 GB) - Available cpu values: 256 (.25 vCPU)\n\n1024 (1 GB), 2048 (2 GB), 3072 (3 GB), 4096 (4 GB) - Available cpu values: 512 (.5 vCPU)\n\n2048 (2 GB), 3072 (3 GB), 4096 (4 GB), 5120 (5 GB), 6144 (6 GB), 7168 (7 GB), 8192 (8 GB) - Available cpu values: 1024 (1 vCPU)\n\nBetween 4096 (4 GB) and 16384 (16 GB) in increments of 1024 (1 GB) - Available cpu values: 2048 (2 vCPU)\n\nBetween 8192 (8 GB) and 30720 (30 GB) in increments of 1024 (1 GB) - Available cpu values: 4096 (4 vCPU)",
+            "stability": "experimental",
+            "summary": "The amount (in MiB) of memory used by the task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 110
+          },
+          "name": "memoryLimitMiB",
+          "optional": true,
+          "type": {
+            "primitive": "number"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "a new security group",
+            "stability": "experimental",
+            "summary": "Security Group to assign to the task."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 57
+          },
+          "name": "securityGroup",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false",
+            "remarks": "* Runners may fail to start due to missing capacity.\n* Runners might be stopped prematurely with spot pricing.",
+            "stability": "experimental",
+            "summary": "Use Fargate spot capacity provider to save money."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 129
+          },
+          "name": "spot",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "default account VPC",
+            "stability": "experimental",
+            "summary": "VPC to launch the runners in."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/fargate.ts",
+            "line": 50
+          },
+          "name": "vpc",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        }
+      ],
+      "symbolId": "src/providers/fargate:FargateRunnerProps"
+    },
+    "@cloudsnorkel/cdk-github-runners.GitHubRunners": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "base": "constructs.Construct",
+      "docs": {
+        "remarks": "It creates a webhook, secrets, and a step function to orchestrate all runs. Secrets are not automatically filled. See README.md for instructions on how to setup GitHub integration.\n\nBy default, this will create a runner provider of each available type with the defaults. This is good enough for the initial setup stage when you just want to get GitHub integration working.\n\n```typescript\nnew GitHubRunners(this, 'runners');\n```\n\nUsually you'd want to configure the runner providers so the runners can run in a certain VPC or have certain permissions.\n\n```typescript\nconst vpc = ec2.Vpc.fromLookup(this, 'vpc', { vpcId: 'vpc-1234567' });\nconst runnerSg = new ec2.SecurityGroup(this, 'runner security group', { vpc: vpc });\nconst dbSg = ec2.SecurityGroup.fromSecurityGroupId(this, 'database security group', 'sg-1234567');\nconst bucket = new s3.Bucket(this, 'runner bucket');\n\n// create a custom CodeBuild provider\nconst myProvider = new CodeBuildRunner(\n   this, 'codebuild runner',\n   {\n      label: 'my-codebuild',\n      vpc: vpc,\n      securityGroup: runnerSg,\n   },\n);\n// grant some permissions to the provider\nbucket.grantReadWrite(myProvider);\ndbSg.connections.allowFrom(runnerSg, ec2.Port.tcp(3306), 'allow runners to connect to MySQL database');\n\n// create the runner infrastructure\nnew GitHubRunners(\n   this,\n   'runners',\n   {\n     providers: [myProvider],\n   }\n);\n```",
+        "stability": "experimental",
+        "summary": "Create all the required infrastructure to provide self-hosted GitHub runners."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.GitHubRunners",
+      "initializer": {
+        "docs": {
+          "stability": "experimental"
+        },
+        "locationInModule": {
+          "filename": "src/runner.ts",
+          "line": 140
+        },
+        "parameters": [
+          {
+            "name": "scope",
+            "type": {
+              "fqn": "constructs.Construct"
+            }
+          },
+          {
+            "name": "id",
+            "type": {
+              "primitive": "string"
+            }
+          },
+          {
+            "name": "props",
+            "optional": true,
+            "type": {
+              "fqn": "@cloudsnorkel/cdk-github-runners.GitHubRunnersProps"
+            }
+          }
+        ]
+      },
+      "kind": "class",
+      "locationInModule": {
+        "filename": "src/runner.ts",
+        "line": 120
+      },
+      "name": "GitHubRunners",
+      "properties": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Configured runner providers."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 127
+          },
+          "name": "providers",
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerProvider"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Secrets for GitHub communication including webhook secret and runner authentication."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 132
+          },
+          "name": "secrets",
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.Secrets"
+          }
+        }
+      ],
+      "symbolId": "src/runner:GitHubRunners"
+    },
+    "@cloudsnorkel/cdk-github-runners.GitHubRunnersProps": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "Properties for GitHubRunners."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.GitHubRunnersProps",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/runner.ts",
+        "line": 22
+      },
+      "name": "GitHubRunnersProps",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "default": "false",
+            "remarks": "Lambda Functions in a public subnet can NOT access the internet.",
+            "stability": "experimental",
+            "summary": "Allow management functions to run in public subnets."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 45
+          },
+          "name": "allowPublicSubnet",
+          "optional": true,
+          "type": {
+            "primitive": "boolean"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "You may also want to use custom images for your runner providers that contain the same certificates. See {@link CodeBuildImageBuilder.addCertificates}.\n\n```typescript\nconst imageBuilder = new CodeBuildImageBuilder(this, 'Image Builder with Certs', {\n     dockerfilePath: CodeBuildRunner.LINUX_X64_DOCKERFILE_PATH,\n});\nimageBuilder.addExtraCertificates('path-to-my-extra-certs-folder');\n\nconst provider = new CodeBuildRunner(this, 'CodeBuild', {\n     imageBuilder: imageBuilder,\n});\n\nnew GitHubRunners(\n   this,\n   'runners',\n   {\n     providers: [provider],\n     extraCertificates: 'path-to-my-extra-certs-folder',\n   }\n);\n```",
+            "stability": "experimental",
+            "summary": "Path to a directory containing a file named certs.pem containing any additional certificates required to trust GitHub Enterprise Server. Use this when GitHub Enterprise Server certificates are self-signed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 77
+          },
+          "name": "extraCertificates",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "default": "CodeBuild, Lambda and Fargate runners with all the defaults (no VPC or default account VPC)",
+            "remarks": "At least one provider is required. Provider will be selected when its label matches the labels requested by the workflow job.",
+            "stability": "experimental",
+            "summary": "List of runner providers to use."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 28
+          },
+          "name": "providers",
+          "optional": true,
+          "type": {
+            "collection": {
+              "elementtype": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerProvider"
+              },
+              "kind": "array"
+            }
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Use this with to provide access to GitHub Enterprise Server hosted inside a VPC.",
+            "stability": "experimental",
+            "summary": "Security group attached to all management functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 50
+          },
+          "name": "securityGroup",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Use this with GitHub Enterprise Server hosted that's inaccessible from outside the VPC.",
+            "stability": "experimental",
+            "summary": "VPC used for all management functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 33
+          },
+          "name": "vpc",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Use this with GitHub Enterprise Server hosted that's inaccessible from outside the VPC.",
+            "stability": "experimental",
+            "summary": "VPC subnets used for all management functions."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/runner.ts",
+            "line": 38
+          },
+          "name": "vpcSubnets",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.SubnetSelection"
+          }
+        }
+      ],
+      "symbolId": "src/runner:GitHubRunnersProps"
+    },
+    "@cloudsnorkel/cdk-github-runners.IImageBuilder": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "docs": {
+        "remarks": "Anything that ends up with an ECR repository containing a Docker image that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing image and nothing else.\n\nIt's important that the specified image tag be available at the time the repository is available. Providers usually assume the image is ready and will fail if it's not.\n\nThe image can be further updated over time manually or using a schedule as long as it is always written to the same tag.",
+        "stability": "experimental",
+        "summary": "Interface for constructs that build an image that can be used in {@link IRunnerProvider}."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.IImageBuilder",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/providers/common.ts",
+        "line": 136
+      },
+      "methods": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "This method can be called multiple times if the image is bound to multiple providers. Make sure you cache the image when implementing or return an error if this builder doesn't support reusing images.",
+            "returns": "image",
+            "stability": "experimental",
+            "summary": "ECR repository containing the image."
+          },
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 144
+          },
+          "name": "bind",
+          "returns": {
+            "type": {
+              "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
+            }
+          }
+        }
+      ],
+      "name": "IImageBuilder",
+      "symbolId": "src/providers/common:IImageBuilder"
+    },
+    "@cloudsnorkel/cdk-github-runners.IRunnerImageStatus": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "docs": {
+        "stability": "experimental",
+        "summary": "Interface for runner image status used by status.json."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerImageStatus",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/providers/common.ts",
+        "line": 200
+      },
+      "name": "IRunnerImageStatus",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Log group name for the image builder where history of image builds can be analyzed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 214
+          },
+          "name": "imageBuilderLogGroup",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Image repository where runner image is pushed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 204
+          },
+          "name": "imageRepository",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Tag of image that should be used."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 209
+          },
+          "name": "imageTag",
+          "optional": true,
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/providers/common:IRunnerImageStatus"
+    },
+    "@cloudsnorkel/cdk-github-runners.IRunnerProvider": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "docs": {
+        "remarks": "Implementations create all required resources and return a step function task that starts those resources from {@link getStepFunctionTask}.",
+        "stability": "experimental",
+        "summary": "Interface for all runner providers."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+      "interfaces": [
+        "aws-cdk-lib.aws_ec2.IConnectable",
+        "aws-cdk-lib.aws_iam.IGrantable"
+      ],
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/providers/common.ts",
+        "line": 220
+      },
+      "methods": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Called by GithubRunners and shouldn't be called manually.",
+            "stability": "experimental",
+            "summary": "Generate step function tasks that execute the runner."
+          },
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 248
+          },
+          "name": "getStepFunctionTask",
+          "parameters": [
+            {
+              "docs": {
+                "summary": "specific build parameters."
+              },
+              "name": "parameters",
+              "type": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters"
+              }
+            }
+          ],
+          "returns": {
+            "type": {
+              "fqn": "aws-cdk-lib.aws_stepfunctions.IChainable"
+            }
+          }
+        }
+      ],
+      "name": "IRunnerProvider",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "remarks": "Can be Docker image, AMI, or something else.",
+            "stability": "experimental",
+            "summary": "Image used to create a new resource compute."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 239
+          },
+          "name": "image",
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "GitHub Actions label associated with this runner provider."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 224
+          },
+          "name": "label",
+          "type": {
+            "primitive": "string"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Security group associated with runners."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 234
+          },
+          "name": "securityGroup",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "VPC network in which runners will be placed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 229
+          },
+          "name": "vpc",
+          "optional": true,
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+          }
+        }
+      ],
+      "symbolId": "src/providers/common:IRunnerProvider"
+    },
+    "@cloudsnorkel/cdk-github-runners.ImageBuilderAsset": {
+      "assembly": "@cloudsnorkel/cdk-github-runners",
+      "datatype": true,
+      "docs": {
+        "stability": "experimental",
+        "summary": "An asset including file or directory to place inside the built image."
+      },
+      "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderAsset",
+      "kind": "interface",
+      "locationInModule": {
+        "filename": "src/providers/image-builders/container.ts",
+        "line": 147
+      },
+      "name": "ImageBuilderAsset",
+      "properties": [
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Asset to place in the image."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 156
+          },
+          "name": "asset",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_s3_assets.Asset"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Path to place asset in the image."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 151
+          },
+          "name": "path",
+          "type": {
+            "primitive": "string"
+          }
+        }
+      ],
+      "symbolId": "src/providers/image-builders/container:ImageBuilderAsset"
     },
-    "@cloudsnorkel/cdk-github-runners.GitHubRunners": {
+    "@cloudsnorkel/cdk-github-runners.ImageBuilderComponent": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
-      "base": "constructs.Construct",
+      "base": "aws-cdk-lib.Resource",
       "docs": {
-        "remarks": "It creates a webhook, secrets, and a step function to orchestrate all runs. Secrets are not automatically filled. See README.md for instructions on how to setup GitHub integration.\n\nBy default, this will create a runner provider of each available type with the defaults. This is good enough for the initial setup stage when you just want to get GitHub integration working.\n\n```typescript\nnew GitHubRunners(stack, 'runners', {});\n```\n\nUsually you'd want to configure the runner providers so the runners can run in a certain VPC or have certain permissions.\n\n```typescript\nconst vpc = ec2.Vpc.fromLookup(stack, 'vpc', { vpcId: 'vpc-1234567' });\nconst runnerSg = new ec2.SecurityGroup(stack, 'runner security group', { vpc: vpc });\nconst dbSg = ec2.SecurityGroup.fromSecurityGroupId(stack, 'database security group', 'sg-1234567');\nconst bucket = new s3.Bucket(stack, 'runner bucket');\n\n// create a custom CodeBuild provider\nconst myProvider = new CodeBuildRunner(\n   stack, 'codebuild runner',\n   {\n      label: 'my-codebuild',\n      vpc: vpc,\n      securityGroup: runnerSg,\n   },\n);\n// grant some permissions to the provider\nbucket.grantReadWrite(myProvider);\ndbSg.connections.allowFrom(runnerSg, ec2.Port.tcp(3306), 'allow runners to connect to MySQL database');\n\n// create the runner infrastructure\nnew GitHubRunners(\n   stack,\n   'runners',\n   {\n     providers: [myProvider],\n   }\n);\n```",
+        "remarks": "Components are the building blocks of images built by Image Builder.\n\nExample:\n\n```\nnew ImageBuilderComponent(this, 'AWS CLI', {\n   platform: 'Windows',\n   displayName: 'AWS CLI',\n   description: 'Install latest version of AWS CLI',\n   commands: [\n     '$ErrorActionPreference = \\'Stop\\'',\n     'Start-Process msiexec.exe -Wait -ArgumentList \\'/i https://awscli.amazonaws.com/AWSCLIV2.msi /qn\\'',\n   ],\n}\n```",
         "stability": "experimental",
-        "summary": "Create all the required infrastructure to provide self-hosted GitHub runners."
+        "summary": "Components are a set of commands to run and optional files to add to an image."
       },
-      "fqn": "@cloudsnorkel/cdk-github-runners.GitHubRunners",
+      "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderComponent",
       "initializer": {
         "docs": {
           "stability": "experimental"
         },
         "locationInModule": {
-          "filename": "src/runner.ts",
-          "line": 83
+          "filename": "src/providers/image-builders/container.ts",
+          "line": 221
         },
         "parameters": [
           {
@@ -4449,199 +5549,174 @@
           },
           {
             "name": "props",
-            "optional": true,
             "type": {
-              "fqn": "@cloudsnorkel/cdk-github-runners.GitHubRunnersProps"
+              "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderComponentProperties"
             }
           }
         ]
       },
       "kind": "class",
       "locationInModule": {
-        "filename": "src/runner.ts",
-        "line": 65
+        "filename": "src/providers/image-builders/container.ts",
+        "line": 208
       },
-      "name": "GitHubRunners",
+      "methods": [
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Grants read permissions to the principal on the assets buckets."
+          },
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 313
+          },
+          "name": "grantAssetsRead",
+          "parameters": [
+            {
+              "name": "grantee",
+              "type": {
+                "fqn": "aws-cdk-lib.aws_iam.IGrantable"
+              }
+            }
+          ]
+        },
+        {
+          "docs": {
+            "stability": "experimental"
+          },
+          "locationInModule": {
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 114
+          },
+          "name": "version",
+          "parameters": [
+            {
+              "name": "type",
+              "type": {
+                "primitive": "string"
+              }
+            },
+            {
+              "name": "name",
+              "type": {
+                "primitive": "string"
+              }
+            },
+            {
+              "name": "data",
+              "type": {
+                "primitive": "any"
+              }
+            }
+          ],
+          "protected": true,
+          "returns": {
+            "type": {
+              "primitive": "string"
+            }
+          }
+        }
+      ],
+      "name": "ImageBuilderComponent",
       "properties": [
         {
           "docs": {
             "stability": "experimental",
-            "summary": "Configured runner providers."
+            "summary": "Component ARN."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/runner.ts",
-            "line": 72
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 212
           },
-          "name": "providers",
+          "name": "arn",
           "type": {
-            "collection": {
-              "elementtype": {
-                "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerProvider"
-              },
-              "kind": "array"
-            }
+            "primitive": "string"
           }
         },
         {
           "docs": {
             "stability": "experimental",
-            "summary": "Secrets for GitHub communication including webhook secret and runner authentication."
+            "summary": "Supported platform for the component."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/runner.ts",
-            "line": 77
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 217
           },
-          "name": "secrets",
+          "name": "platform",
           "type": {
-            "fqn": "@cloudsnorkel/cdk-github-runners.Secrets"
+            "primitive": "string"
           }
         }
       ],
-      "symbolId": "src/runner:GitHubRunners"
+      "symbolId": "src/providers/image-builders/container:ImageBuilderComponent"
     },
-    "@cloudsnorkel/cdk-github-runners.GitHubRunnersProps": {
+    "@cloudsnorkel/cdk-github-runners.ImageBuilderComponentProperties": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
       "datatype": true,
       "docs": {
         "stability": "experimental",
-        "summary": "Properties for GitHubRunners."
+        "summary": "Properties for ImageBuilderComponent construct."
       },
-      "fqn": "@cloudsnorkel/cdk-github-runners.GitHubRunnersProps",
+      "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderComponentProperties",
       "kind": "interface",
       "locationInModule": {
-        "filename": "src/runner.ts",
-        "line": 16
+        "filename": "src/providers/image-builders/container.ts",
+        "line": 162
       },
-      "name": "GitHubRunnersProps",
+      "name": "ImageBuilderComponentProperties",
       "properties": [
         {
           "abstract": true,
           "docs": {
-            "default": "CodeBuild, Lambda and Fargate runners with all the defaults (no VPC or default account VPC)",
-            "remarks": "At least one provider is required. Provider will be selected when its label matches the labels requested by the workflow job.",
+            "remarks": "On Linux, these are bash commands. On Windows, there are PowerShell commands.",
             "stability": "experimental",
-            "summary": "List of runner providers to use."
+            "summary": "Shell commands to run when adding this component to the image."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/runner.ts",
-            "line": 22
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 183
           },
-          "name": "providers",
-          "optional": true,
+          "name": "commands",
           "type": {
             "collection": {
               "elementtype": {
-                "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerProvider"
+                "primitive": "string"
               },
               "kind": "array"
             }
           }
-        }
-      ],
-      "symbolId": "src/runner:GitHubRunnersProps"
-    },
-    "@cloudsnorkel/cdk-github-runners.IImageBuilder": {
-      "assembly": "@cloudsnorkel/cdk-github-runners",
-      "docs": {
-        "remarks": "Anything that ends up with an ECR repository containing a Docker image that runs GitHub self-hosted runners can be used. A simple implementation could even point to an existing image and nothing else.\n\nIt's important that the specified image tag be available at the time the repository is available. Providers usually assume the image is ready and will fail if it's not.\n\nThe image can be further updated over time manually or using a schedule as long as it is always written to the same tag.",
-        "stability": "experimental",
-        "summary": "Interface for constructs that build an image that can be used in {@link IRunnerProvider}."
-      },
-      "fqn": "@cloudsnorkel/cdk-github-runners.IImageBuilder",
-      "kind": "interface",
-      "locationInModule": {
-        "filename": "src/providers/common.ts",
-        "line": 129
-      },
-      "methods": [
-        {
-          "abstract": true,
-          "docs": {
-            "remarks": "This method can be called multiple times if the image is bound to multiple providers. Make sure you cache the image when implementing or return an error if this builder doesn't support reusing images.",
-            "returns": "image",
-            "stability": "experimental",
-            "summary": "ECR repository containing the image."
-          },
-          "locationInModule": {
-            "filename": "src/providers/common.ts",
-            "line": 137
-          },
-          "name": "bind",
-          "returns": {
-            "type": {
-              "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
-            }
-          }
-        }
-      ],
-      "name": "IImageBuilder",
-      "symbolId": "src/providers/common:IImageBuilder"
-    },
-    "@cloudsnorkel/cdk-github-runners.IRunnerProvider": {
-      "assembly": "@cloudsnorkel/cdk-github-runners",
-      "docs": {
-        "remarks": "Implementations create all required resources and return a step function task that starts those resources from {@link getStepFunctionTask}.",
-        "stability": "experimental",
-        "summary": "Interface for all runner providers."
-      },
-      "fqn": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
-      "interfaces": [
-        "aws-cdk-lib.aws_ec2.IConnectable",
-        "aws-cdk-lib.aws_iam.IGrantable"
-      ],
-      "kind": "interface",
-      "locationInModule": {
-        "filename": "src/providers/common.ts",
-        "line": 193
-      },
-      "methods": [
+        },
         {
           "abstract": true,
           "docs": {
-            "remarks": "Called by GithubRunners and shouldn't be called manually.",
             "stability": "experimental",
-            "summary": "Generate step function tasks that execute the runner."
+            "summary": "Component description."
           },
+          "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/common.ts",
-            "line": 216
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 176
           },
-          "name": "getStepFunctionTask",
-          "parameters": [
-            {
-              "docs": {
-                "summary": "specific build parameters."
-              },
-              "name": "parameters",
-              "type": {
-                "fqn": "@cloudsnorkel/cdk-github-runners.RunnerRuntimeParameters"
-              }
-            }
-          ],
-          "returns": {
-            "type": {
-              "fqn": "aws-cdk-lib.aws_stepfunctions.IChainable"
-            }
+          "name": "description",
+          "type": {
+            "primitive": "string"
           }
-        }
-      ],
-      "name": "IRunnerProvider",
-      "properties": [
+        },
         {
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "GitHub Actions label associated with this runner provider."
+            "summary": "Component display name."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/common.ts",
-            "line": 197
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 171
           },
-          "name": "label",
+          "name": "displayName",
           "type": {
             "primitive": "string"
           }
@@ -4649,39 +5724,44 @@
         {
           "abstract": true,
           "docs": {
+            "remarks": "Must match the builder platform.",
             "stability": "experimental",
-            "summary": "Security group associated with runners."
+            "summary": "Component platform."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/common.ts",
-            "line": 207
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 166
           },
-          "name": "securityGroup",
-          "optional": true,
+          "name": "platform",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ec2.ISecurityGroup"
+            "primitive": "string"
           }
         },
         {
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "VPC network in which runners will be placed."
+            "summary": "Optional assets to add to the built image."
           },
           "immutable": true,
           "locationInModule": {
-            "filename": "src/providers/common.ts",
-            "line": 202
+            "filename": "src/providers/image-builders/container.ts",
+            "line": 188
           },
-          "name": "vpc",
+          "name": "assets",
           "optional": true,
           "type": {
-            "fqn": "aws-cdk-lib.aws_ec2.IVpc"
+            "collection": {
+              "elementtype": {
+                "fqn": "@cloudsnorkel/cdk-github-runners.ImageBuilderAsset"
+              },
+              "kind": "array"
+            }
           }
         }
       ],
-      "symbolId": "src/providers/common:IRunnerProvider"
+      "symbolId": "src/providers/image-builders/container:ImageBuilderComponentProperties"
     },
     "@cloudsnorkel/cdk-github-runners.LambdaRunner": {
       "assembly": "@cloudsnorkel/cdk-github-runners",
@@ -4698,7 +5778,7 @@
         },
         "locationInModule": {
           "filename": "src/providers/lambda.ts",
-          "line": 135
+          "line": 141
         },
         "parameters": [
           {
@@ -4727,7 +5807,7 @@
       "kind": "class",
       "locationInModule": {
         "filename": "src/providers/lambda.ts",
-        "line": 91
+        "line": 92
       },
       "methods": [
         {
@@ -4738,7 +5818,7 @@
           },
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 198
+            "line": 215
           },
           "name": "getStepFunctionTask",
           "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
@@ -4772,7 +5852,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 108
+            "line": 109
           },
           "name": "LINUX_ARM64_DOCKERFILE_PATH",
           "static": true,
@@ -4790,7 +5870,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 99
+            "line": 100
           },
           "name": "LINUX_X64_DOCKERFILE_PATH",
           "static": true,
@@ -4806,7 +5886,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 187
+            "line": 204
           },
           "name": "connections",
           "overrides": "aws-cdk-lib.aws_ec2.IConnectable",
@@ -4822,7 +5902,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 113
+            "line": 114
           },
           "name": "function",
           "type": {
@@ -4837,7 +5917,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 133
+            "line": 134
           },
           "name": "grantPrincipal",
           "overrides": "aws-cdk-lib.aws_iam.IGrantable",
@@ -4845,6 +5925,22 @@
             "fqn": "aws-cdk-lib.aws_iam.IPrincipal"
           }
         },
+        {
+          "docs": {
+            "stability": "experimental",
+            "summary": "Docker image used to start Lambda function."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/lambda.ts",
+            "line": 139
+          },
+          "name": "image",
+          "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
+          "type": {
+            "fqn": "@cloudsnorkel/cdk-github-runners.RunnerImage"
+          }
+        },
         {
           "docs": {
             "stability": "experimental",
@@ -4853,7 +5949,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 118
+            "line": 119
           },
           "name": "label",
           "overrides": "@cloudsnorkel/cdk-github-runners.IRunnerProvider",
@@ -4869,7 +5965,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 128
+            "line": 129
           },
           "name": "securityGroup",
           "optional": true,
@@ -4886,7 +5982,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 123
+            "line": 124
           },
           "name": "vpc",
           "optional": true,
@@ -4911,7 +6007,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/providers/lambda.ts",
-        "line": 18
+        "line": 19
       },
       "name": "LambdaRunnerProps",
       "properties": [
@@ -4925,7 +6021,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 51
+            "line": 52
           },
           "name": "ephemeralStorageSize",
           "optional": true,
@@ -4945,7 +6041,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 27
+            "line": 28
           },
           "name": "imageBuilder",
           "optional": true,
@@ -4963,7 +6059,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 34
+            "line": 35
           },
           "name": "label",
           "optional": true,
@@ -4982,7 +6078,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 44
+            "line": 45
           },
           "name": "memorySize",
           "optional": true,
@@ -5000,7 +6096,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 74
+            "line": 75
           },
           "name": "securityGroup",
           "optional": true,
@@ -5018,7 +6114,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 81
+            "line": 82
           },
           "name": "subnetSelection",
           "optional": true,
@@ -5037,7 +6133,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 60
+            "line": 61
           },
           "name": "timeout",
           "optional": true,
@@ -5055,7 +6151,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/lambda.ts",
-            "line": 67
+            "line": 68
           },
           "name": "vpc",
           "optional": true,
@@ -5183,7 +6279,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 112
+            "line": 114
           },
           "name": "architecture",
           "type": {
@@ -5193,16 +6289,31 @@
         {
           "abstract": true,
           "docs": {
-            "remarks": "WARNING: the digest might change when the builder automatically rebuilds the image on a schedule. Do not expect for this digest to stay the same between deploys.",
             "stability": "experimental",
-            "summary": "Image digest for providers that need to know the digest like Lambda."
+            "summary": "ECR repository containing the image."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 107
+            "line": 95
           },
-          "name": "imageDigest",
+          "name": "imageRepository",
+          "type": {
+            "fqn": "aws-cdk-lib.aws_ecr.IRepository"
+          }
+        },
+        {
+          "abstract": true,
+          "docs": {
+            "stability": "experimental",
+            "summary": "Static image tag where the image will be pushed."
+          },
+          "immutable": true,
+          "locationInModule": {
+            "filename": "src/providers/common.ts",
+            "line": 100
+          },
+          "name": "imageTag",
           "type": {
             "primitive": "string"
           }
@@ -5211,30 +6322,32 @@
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "ECR repository containing the image."
+            "summary": "OS type of the image."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 95
+            "line": 119
           },
-          "name": "imageRepository",
+          "name": "os",
           "type": {
-            "fqn": "aws-cdk-lib.aws_ecr.IRepository"
+            "fqn": "@cloudsnorkel/cdk-github-runners.Os"
           }
         },
         {
           "abstract": true,
           "docs": {
+            "remarks": "If the digest is not specified, imageTag must always point to a new tag on update. If not, the build may try to use the old image.\n\nWARNING: the digest might change when the builder automatically rebuilds the image on a schedule. Do not expect for this digest to stay the same between deploys.",
             "stability": "experimental",
-            "summary": "Static image tag where the image will be pushed."
+            "summary": "Image digest for providers that need to know the digest like Lambda."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 100
+            "line": 109
           },
-          "name": "imageTag",
+          "name": "imageDigest",
+          "optional": true,
           "type": {
             "primitive": "string"
           }
@@ -5243,16 +6356,17 @@
           "abstract": true,
           "docs": {
             "stability": "experimental",
-            "summary": "OS type of the image."
+            "summary": "Log group where image builds are logged."
           },
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 117
+            "line": 124
           },
-          "name": "os",
+          "name": "logGroup",
+          "optional": true,
           "type": {
-            "fqn": "@cloudsnorkel/cdk-github-runners.Os"
+            "fqn": "aws-cdk-lib.aws_logs.LogGroup"
           }
         }
       ],
@@ -5269,7 +6383,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/providers/common.ts",
-        "line": 143
+        "line": 150
       },
       "name": "RunnerProviderProps",
       "properties": [
@@ -5284,7 +6398,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 151
+            "line": 158
           },
           "name": "logRetention",
           "optional": true,
@@ -5307,7 +6421,7 @@
       "kind": "interface",
       "locationInModule": {
         "filename": "src/providers/common.ts",
-        "line": 163
+        "line": 170
       },
       "name": "RunnerRuntimeParameters",
       "properties": [
@@ -5321,7 +6435,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 177
+            "line": 184
           },
           "name": "githubDomainPath",
           "type": {
@@ -5337,7 +6451,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 182
+            "line": 189
           },
           "name": "ownerPath",
           "type": {
@@ -5353,7 +6467,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 187
+            "line": 194
           },
           "name": "repoPath",
           "type": {
@@ -5370,7 +6484,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 172
+            "line": 179
           },
           "name": "runnerNamePath",
           "type": {
@@ -5386,7 +6500,7 @@
           "immutable": true,
           "locationInModule": {
             "filename": "src/providers/common.ts",
-            "line": 167
+            "line": 174
           },
           "name": "runnerTokenPath",
           "type": {
@@ -5623,7 +6737,7 @@
           },
           "locationInModule": {
             "filename": "src/providers/image-builders/static.ts",
-            "line": 44
+            "line": 43
           },
           "name": "fromDockerHub",
           "parameters": [
@@ -5740,6 +6854,6 @@
       "symbolId": "src/providers/image-builders/static:StaticRunnerImage"
     }
   },
-  "version": "0.3.0",
-  "fingerprint": "BbcPeU/UMTYhijuLgnABdbWc76bh1KhE/IYBv9sCMz8="
-}
+  "version": "0.4.0",
+  "fingerprint": "OnQ8gp6EqMIbSnMbq8KwwAQg4rS47KAGjpDJMeE1XEA="
+}