1

I read that Facebook's continuous integration environments are cut off from the internet for security and reliability reasons.

What would these reasons be? Is this a common practice?

3
  • 3
    If some hacker got access to the Facebook build system, they could deploy a trojan to billions of users. It makes sense to be a bit paranoid. Downloading npm packages from the internet is pretty risky.
    – JacquesB
    Oct 25, 2019 at 17:05
  • 1
    The best way to prevent someone on the Internet from hacking a system is to disconnect that system from the Internet. No access, no hacking. Oct 25, 2019 at 17:07
  • 2
    @RobertHarvey Even safer would be to turn the servers off at FB
    – Peter M
    Oct 25, 2019 at 18:02

3 Answers 3

3

Our reasons were:

  • the CI server was part of an environment, which had strict security rules. Direct access to the internet may have been possible somehow under these rules, but was not worth the hassle
  • there wasn’t really a need for direct Internet access, e.g. packages would be installed/updated via a local package mirror or manually
2
  • Thanks! What was the reasoning for the strict security rules? Didn't it take months to build Yarn meaning that interpreting or changing the rules at Facebook is a really difficult process? Also, would you know if other companies do this?
    – Gwater17
    Oct 25, 2019 at 17:39
  • @Gwater17: The reasoning for the strict security rules is... It's the Internet. Security is always a tradeoff between safety and costs. You can deal with the massive security apparatus, or you can just unplug. Oct 25, 2019 at 18:29
2

Many popular build systems "download the internet" by default, java with maven, JavaScript with npm based packages, docker with base images to name few.

The downloaded dependencies are often expressed as ranges - resulting on not reproducible build - dependent on state of external repositories at the time of build. Moreover the external dependencies may be compromised.

By cutting the build system from the internet one can ensure that only packages used in build are those explicitly added to local mirror. And the process of adding package may include security checks.

1

First of all, security scanning is a common feature of artifact repositories, but usually has to be manually tacked onto CI servers. Also scanning for things like open source license compliance.

Second, it makes it easier to prevent accidentally uploading your private packages to the public Internet.

Third, it ensures you have a local cached copy of every package you depend on. If a package (leftpad anyone?) suddenly disappears from the Internet, you can still build your code. You just can't upgrade.

Unrelated to security and reliability, it generally speeds up your builds considerably.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.