[CI] Run jobs on ubuntu-slim instead of ubuntu-latest

[giordano]

ubuntu-slim is a new runner type for running short-lived (max 15 minutes) non-expensive tasks like linting, labelling, and such.

[giordano]

Uhm, this fails because yogevbd/enforce-label-action needs to build a Docker container, but ubuntu-slim itself runs inside a container, this is probably a nested container problem. Ok, will revert this one (but also, the upstream workflow looks quite inefficient...)

[DilumAluthge]

In theory it sounds fine, but are these containers running on the same VM as other customers? How is that secure?

[DilumAluthge]

In theory it sounds fine, but are these containers running on the same VM as other customers? How is that secure?

Are they doing this, maybe?

[giordano]

Quoting from the link I shared above:

Each container provides hypervisor level 2 isolation, and the container is automatically decommissioned when a job is completed.

[DilumAluthge]

Each container provides hypervisor level 2 isolation

Yeah, my question is more along the lines of: how exactly are they doing that?