Real-world stories of how we’ve compromised CI/CD pipelines
We’ve been using Sysbox (<a href="https:&#x2F;&#x2F;github.com&#x2F;nestybox&#x2F;sysbox" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;nestybox&#x2F;sysbox</a>) for our Buildkite based CI&#x2F;CD setup, allows docker-in-docker without privileged containers. Paired with careful IAM&#x2F;STS design we’ve ended up with isolated job containers with their own IAM roles limited to least-privilege.