Hi, I'm the founder of actuated.

We don't think that Docker in Docker is safe for CI, neither is mounting a Docker Socket.

We also think that managing runners is boring and time-consuming.

So we've automated it, and secured it with Firecracker.

This article talks about some of the challenges we've faced, and lessons we've learned working with pilot customers so far.

Alex