Drone Ports
Drone ports are the network paths that connect build runners to a central build server. You set up drone ports by opening specific web and RPC paths on your host machine. Most teams start by opening these paths across their internal network for fast testing. When network rules and runner keys are too broad, anyone on the network can run jobs. Broad permissions also let build scripts read secrets or write to production databases without a check. How drone ports work in a build pipeline A Drone
Ports: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
Drone ports are the network paths that connect build runners to a central build server. You set up drone ports by opening specific web and RPC paths on your host machine. Most teams start by opening these paths across their internal network for fast testing. When network rules and runner keys are too broad, anyone on the network can run jobs. Broad permissions also let build scripts read secrets or write to production databases without a check.
How drone ports work in a build pipeline
A Drone build setup splits work between a central server and separate runner agents. The central server watches your code repo and schedules new build jobs when code changes. The server needs an open web port to receive webhooks from your git host. It also uses that web port to show the build dashboard to your team. Runners poll the central server over a network port to ask for new work. Some setups use standard web traffic for this runner link, while others use RPC traffic. Once a runner grabs a job, it spins up isolated containers to run your test steps. Those containers also open local ports so your app can talk to test databases during builds. When the job ends, the runner sends build logs back through the server port. Then the runner tears down the temporary containers and waits for the next build.
What native network rules solve and what they miss
Host firewalls and container rules control which machines can reach your drone ports. They help you block outside traffic from hitting your central build server or runner nodes. You can also use shared secrets so only approved runners join the server pool. Still, network rules only check which machine connects when a session starts. They do not inspect the commands or database queries that run inside a build step. Once a build container starts, it often holds broad database keys or cloud role tokens. A bad script or a broken test can run drop commands against a shared database. It can also query real tables and print customer emails or phone numbers into build logs. Native port rules cannot rewrite sensitive fields or block single bad commands in flight. Teams need a way to check every query and mask card numbers or national IDs before logs save.
Steps to lock down runner and server traffic
Start by putting your central server behind TLS so all web traffic stays encrypted. Next, restrict the RPC port so only known runner IP addresses can reach it. Do not expose container daemon ports to the public internet under any circumstance. Give each runner a narrow role that matches the exact jobs it needs to run. Split your test runners from the runners that deploy code to production systems. Rotate your runner shared keys and repo webhook tokens on a regular schedule. Finally, check your build logs to make sure scripts do not print raw secrets or keys.
Ports: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
What happens if runner ports are open to the public internet?
Outside machines can try to join your build pool or flood the server with requests. Always restrict runner traffic to private networks or known IP ranges using firewall rules.
Do build runners need inbound ports open from the server?
In most setups, runners pull jobs by calling out to the central server port. This means you rarely need to open inbound network paths on the runner hosts themselves.
How can teams protect real data when builds run database checks?
Keep production data out of test builds and use data masking on shared databases. Masking rewrites matched fields like emails and card numbers in query results during the run.