The build was green but nothing worked in production. Logs were empty. Traffic never touched the app. The problem was the network. The solution was deploying the pipeline inside a VPC private subnet with a proxy that just works.
A pipeline that cannot talk to private resources is useless for anything serious. When code depends on databases, APIs, or services locked inside a VPC, public runners fail. The only way through is to run builds and deployments from inside the same secure network. That means placing your pipeline in a private subnet with direct VPC access and routing outbound through a proxy when needed.
The architecture is simple but demands precision. The pipeline runner lives inside the VPC. The subnet is private—no direct inbound from the internet. Outbound connectivity flows through a NAT gateway or proxy. DNS resolution must be correct, security groups must allow the exact traffic you need, and IAM must ensure the runner’s identity has the right permissions for every action.
A private subnet keeps your internal resources invisible. A proxy handles controlled access to public endpoints: fetching dependencies, pulling base images, posting deployment events. Without the proxy, the build gets stuck. With it, you can move fast without punching random holes in your firewall.