5 ms·

Isn't it really common for build machines to have outbound internet access? Millions of developers use GitHub Actions for building artifacts and the public runn

Isn't it really common for build machines to have outbound internet access? Millions of developers use GitHub Actions for building artifacts and the public runners definitely have outbound internet access

arccy 2y ago
A few decades ago, it was also really common to smoke. Common != good, github actions isn't a true build tool, it's an arbitrary code runtime platform with a few triggers tied to your github.
tomjakubowski 2y ago
Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.
- gtirloni 2y ago
  So this friend escaped from the ephemeral container VM into the build host which happened to have a private SSH on it that allowed it to connect to a bastion host to... go back to the build host and debug a failed build that should be self-contained inside the container VM which they already had access in the first place by the means of, you know, running a build on it? Interesting.
- TheDong 2y ago
  > probably against GitHub's ToS, but Why would running code on a github action runner that's built to run code be against ToS? If it was, I'm sure they'd ban the marketplace extensions that make it absolutely trivial to do this: https://github.com/marketplace/actions/debugging-with-ssh https://github.com/marketplace/actions/debugging-with-ssh
  - deleted 2y ago
    [deleted]
- pulkitsh1234 2y ago
  could have just used https://github.com/mxschmitt/action-tmate https://github.com/mxschmitt/action-tmate
selfhoster 2y ago
It is and regardless a few other commenters saying or hinting it isn't...it is. An air gapped build machine wouldn't work for most software built today.
- fc417fc802 2y ago
  Strange. How do things like Nix work then? The nix builders are network isolated. Most (all?) Gentoo packages can also be built without network access. That seems like it should cover a decent proportion of modern software. Instances where an air gapped build machine doesn't work are examples of developer laziness, not bothering to properly document dependencies.
- ok_dad 2y ago
  Sounds like a problem with modern software build practices to me.
  - pixl97 2y ago
    Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak. The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.
    - turtlebits 2y ago
      People don't think it's a great idea. In general, its just too much additional work/process - for very little benefit. You're far more likely to encounter a security issue from adding/upgrading a dependency than your build process requiring internet access.

arccy 2y ago

A few decades ago, it was also really common to smoke. Common != good, github actions isn't a true build tool, it's an arbitrary code runtime platform with a few triggers tied to your github.

tomjakubowski 2y ago

Indeed, you can indeed punch out from an actions runner. Such a thing is probably against GitHub's ToS, but I've heard from my third cousin twice removed that his friend once ssh'ed out from an action to a bastion host, then used port forwarding to get herself a shell on the runner in order to debug a failing build.

gtirloni 2y ago
So this friend escaped from the ephemeral container VM into the build host which happened to have a private SSH on it that allowed it to connect to a bastion host to... go back to the build host and debug a failed build that should be self-contained inside the container VM which they already had access in the first place by the means of, you know, running a build on it? Interesting.
TheDong 2y ago
> probably against GitHub's ToS, but Why would running code on a github action runner that's built to run code be against ToS? If it was, I'm sure they'd ban the marketplace extensions that make it absolutely trivial to do this: https://github.com/marketplace/actions/debugging-with-ssh https://github.com/marketplace/actions/debugging-with-ssh
- deleted 2y ago
  [deleted]
pulkitsh1234 2y ago
could have just used https://github.com/mxschmitt/action-tmate https://github.com/mxschmitt/action-tmate

selfhoster 2y ago

It is and regardless a few other commenters saying or hinting it isn't...it is. An air gapped build machine wouldn't work for most software built today.

fc417fc802 2y ago
Strange. How do things like Nix work then? The nix builders are network isolated. Most (all?) Gentoo packages can also be built without network access. That seems like it should cover a decent proportion of modern software. Instances where an air gapped build machine doesn't work are examples of developer laziness, not bothering to properly document dependencies.
ok_dad 2y ago
Sounds like a problem with modern software build practices to me.
- pixl97 2y ago
  Ya too many people think it's a great idea to raw dog your ci/cd on the net and later get newspaper articles written about the data leak. The number of packages that is malicious is high enough, then you have typo packages, and packages that get compromised at a later date. Being isolated from the net with proper monitoring gives a huge heads up when your build system suddenly tries to contact some random site/IP.
  - turtlebits 2y ago
    People don't think it's a great idea. In general, its just too much additional work/process - for very little benefit. You're far more likely to encounter a security issue from adding/upgrading a dependency than your build process requiring internet access.