# @omea/runner Connect a durable machine to Omea using outbound HTTPS only. The bootstrap API key is exchanged once for a separate machine credential and is not retained. ```sh OMEA_API_KEY= npx @omea/runner connect --name my-machine npx @omea/runner run npx @omea/runner status npx @omea/runner image provision-default npx @omea/runner install ``` Linux x64 with KVM and Apple-Silicon macOS with HVF execute one test per fresh Linux VM and multiple VMs in parallel. The macOS package includes the exact signed worker paired with that Runner release. Image provisioning uses Omea's built-in OCI registry and bake pipeline. It does not require Docker or containerd. The default command selects the exact versioned multi-platform image contract bundled with Runner. Workspace preparation may reach public package registries while private and metadata targets stay blocked; every retained test then executes offline from an isolated checkpoint with only guest loopback available. Runner updates are manual. `status` reports Cloud's recommended version and prints the exact versioned command when an update is available. `install` verifies the native package, drains existing VMs without accepting new leases, switches a versioned service release atomically, and rolls back if the replacement does not report fresh health. It does not place API keys or machine credentials in the service definition.