3 ms·
I bet that 95% of all in-house CI would break if it doesn't have access to the internet. I also bet that 95% of those wouldn't need to have access if they were
by bhaak 7y ago
I bet that 95% of all in-house CI would break if it doesn't have access to the internet. I also bet that 95% of those wouldn't need to have access if they were properly designed.
We rarely hear about CI servers being taken over but it has to happen frequently enough.
- mickeyp 7y agoMost enterprises use Artifactory or something similar -- or should anyway. Once you start enforcing "no internet for CI" you start to see how poor some ecosystems are. I'm looking at you, Javascript ecosystem packages, with your hardcoded mystery URLs that you sneakily download artefacts from...
- jessaustin 7y agoSurely lots of orgs would eschew packages with such sneaky behavior? Turning off the network would be a good way to test for that...
- PopeDotNinja 7y agoWe had a situation at work where some developers really got attached to downloading npm modules at container start time to make builds fast. But then starting the containers took 15 minutes :P
- cik 7y agoYou're absolutely right. It's the reason we always use devpi for python mirrors, and firewall off CI. Ultimately you need to be able to rebuild the product when upstream goes poof.
- mst 7y agoFairly sure that was the vector for the big matrix.org breach.