A Runner is a lightweight execution agent that carries out the actions defined in your Blink workflows. Every runner belongs to a runner group, which determines its deployment location and operational scope.

By default, runners are hosted on Blink’s secure cloud infrastructure. However, for organizations that require tighter control over execution, Blink also supports self-hosted runners, which can be deployed within your own environment. This option provides enhanced flexibility, privacy, and security—allowing workflows to interact with internal systems, private networks, or on-prem services while keeping sensitive data fully contained.

​

How a Runners Works

Action Execution Flow:

1. The runner is given an action from the controller and determines the specific plugin needed for the action.
2. The runner establishes an http communication with an existing plugin. If no plugin is currently running, the runner deploys a new plugin of the correct type.
3. The plugin receives information about the specific action, executes the action, and sends the resulting output back to the runner.
4. The runner than returns this output back to controller via a secure websocket connection.

​

The Communication of a Runner

The runner establishes communication with Blink’s Controller to receive actions for execution. The controller will never be the one who initiates the communication

​

Secret Credentials

Runners may retrieve the secret credentials required to execute actions from either of the following sources:

• Blink’s Cloud Secret Store – A secure, managed store provided by Blink.

• Customer-Managed Secret Stores – Currently supported options include:

  1. HashiCorp Vault
  2. GCP Secret Manager

​

Object Storage

Runners may temporarily store intermediate execution data in object storage. This data is automatically removed after the execution completes.

Supported storage options include:

1. Blink Cloud Object Storage (default)
2. Customer-Managed Object Storage – We currently support any S3-compatible storage solution,

​

Traffic from Blink to Your Environment

This refers to traffic originating from Blink’s cloud services—either the Controller or hosted Runners—toward your internal systems or third-party APIs.

Action Required: To ensure Blink services can successfully reach your endpoints, configure your firewall or security groups to allow inbound connections from the following Blink public IP addresses.

​

Traffic from Your Runner to Blink

This refers to traffic originating from your self-hosted Runner and entering Blink’s platform (app.blinkops.com, eu1.blinkops.com, or us2.blinkops.com).

Action Required: Ensure your network’s egress rules allow outbound connections to Blink’s public endpoints, including the relevant CloudFront IP ranges:

​

Related Articles