To avoid keeping (possibly malicious) state after a task has finished, we'd like to stop and remove an ephemeral container/VM we use to run cirrus worker run --token <token>. This could be done by exiting the process after a task finishes and the results are reported back to Cirrus. Having an option along the lines of cirrus worker runonce or cirrus worker run --one-task would be good. We'd make sure to spin up a new container/VM with a worker that registers for another single run after that.

I don't think this is currently supported, or am I missing something. Do you see any problems with this approach (e.g. churn on your persistent runner registration interface)?