I have some opinions in this area that may help you reduce the number of tags and optimize your runner availability and bring delight to your engineering teams. On software I don't think software tags are needed at all. You should ideally have just one (current) image for each OS/architecture and maybe some special cases for things like device farms where emulation is not practical. That image should install a baseline set of software that includes all the runtimes/versions/etc. that you need across the org. You can control the default versions through environment variables in most cases. Docker-based executors are ideal for your untagged jobs, even better if you can define your software images using image: instead of tags: where possible. Use tags: for changing major os family (e.g., linux, windows, macos) or architecture where needed. You can cache all the predefined docker images on the runner host so jobs are quick to start (doesn't matter if the images are very large!). Tagging for your 'generations' of images (again, ideally as a docker image tag instead of runner tag!) is a good idea. Examples of this practice in the wild: GitHub-hosted actions runner pre-installed software for ubuntu , windows , and macos , and appveyor preinstalled software . On security By default, all your runners should have the same baseline (unprivileged) security context. Escalating the security context should always go through authn/authz. Do not use your runners for security contexts! It will only (1) introduce security issues at worst or (2) needlessly proliferate the number of required runners at best. To access security-sensitive contexts, you should always require authentication and authorization and, ideally, log the access recording the relevant job/user responsible for triggering the access. To cover the use cases you mentioned: Code signing (and secrets, generally) Use a secrets manager instead (Hasicorp Vault, AWS Secrets Manager, Azure KeyVault, etc.) Access to secrets should require authn/authz and record access. Avoid using CI/CD variables for secrets if you can help it. Use OIDC to authenticate jobs to cloud environments and/or appropriate secrets. Most cloud providers and products support OIDC directly (i.e., use CI_JOB_JWT_V2) Use "just in time" access where applicable (example: use AWS Systems Manager sessions instead of static SSH keys) For code signing specifically, ideally use an asymmetric signing mechanism to avoid exposing your private keys to jobs directly where applicable (e.g., using something like AWS KMS ) Networking For accessing various networks, ideally, you would use a proxy (with authentication) instead of needing to place your runners in a particular subnet or whatever it is you are doing today. If you have lots of these, you would need to place a runner in each context, which is inefficient. If you use proxies, all your runners can run all the same jobs, but only jobs with appropriate needs should be able to auth to the relevant proxies. Authenticating and/or obtaining credentials for the relevant proxies should follow the above advice regarding secrets. Ideally, use scoped credentials so your proxy can log activity back to the source job. This is not always straightforward and may require significant work to implement depending on your existing network architecture and other institutional requirements, but shouldn't be a huge problem for a small org. Closing thoughts One last anecdotal note: I administer a GitLab instance for a large global 500 company. Everyone uses runners managed by my team. Our company develops software for just about everything under the sun (Windows, MacOS, iOS, Android, most Linux distributions, custom hardware, and more)... we have just a handful of tags -- one for each major OS family and architecture and a few tags for our in-house device farms and hardware racks. Beyond that, we have a few docker images (one for each OS/distro we need with various architecture variants within the same image manifest) but all the images have all the same installed software list where possible. Untagged jobs run on Linux/AMD64 (because that's what most of our development targets) and use our latest build image by default when no image: key is defined. Containers are a key part of how we make this strategy work with such little effort. Many of our teams very much enjoy the ability to create their own purpose-built docker images for GitLab CI builds. Highly recommend you use container-based executors if you are not doing so already. More on reddit.com

It depends how you're handling runner registration. Tags are initially set at registration time only and they are not part of the runner config file. After registration, tags can only be changed in the UI settings. So, if you use the same auth token of an already-registered runner, redeploying your runner container(s) with new tag parameters will not change the tags. I'm guessing that's your situation. More on reddit.com

But of course it should be universal, ... the runner, but for example let him recognize numeric values. As you can see, I'm fairly confused... If you could elaborate how exactly tags work, so I would be able to understand the concept, I would be really grateful. ... Save this answer. ... Show activity on this post. Tags for GitLab CI and tags ... More on stackoverflow.com

The documentation specifies how to set tags on the job side so it only runs on runners equipped with the right tags: osx job: stage: build tags: - osx script: - echo "Hello, $USER!& More on stackoverflow.com