> how do you install packages/pull images

You pre-build the images with packages installed beforehand, then use those image offline.

My point is it's enough of a hassle to set up that I've yet to see that level of restriction in practice (across hundreds of CI systems).

	▲	dzbarsky 14 minutes ago \| parent [-]
		Look into Bazel, a very standard build system used at many large tech companies. It splits fetches from build/test actions and allows blocking network for build/test actions with a single CLI flag. No hassle at all. The fact that you haven't come across this kind of setup suggests that your hundreds of CI systems are not representative of the industry as a whole.