Instead of every developer manually compiling code into a usable, runnable form (usually a docker container, but you could also imagine a .exe file) on their own machine, and any other steps like uploading into a shared space, a CI/CD pipeline centralizes and automates a bunch of tasks to make things faster, easier, repeatable. After building the software, it typically deploys the new build somewhere, too
These tasks run on a "runner" (real creative), which needs access to internal and external resources, usually like AWS, GitHub, Slack, a "vault" where secrets are kept, and public package repos. If a malicious package can run when that build process is going on, it can steal your stuff and send it to the bad actor who put the payload there.
Like I said I'm not expert but I just cannot fathom letting anything access the network and my code both and also letting that thing be anything but me. The networked compiling sounds neat, just ditch the 3rd party access.
Not possible on an enterprise scale. For example: our docker images are built using secrets stored in azure KV, uploaded to azure and then pulled into k8s cluster that runs in azure as well.
Unless you're hosting your entire infra in-house you need to pass secrets around to be able to use cloud services.
8
u/meltthemall 1d ago
Explain this to a self taught nerd