After the CI system (with network access) pulls down the code, including submodules, this code is then placed into a container with no network access to perform the actual build.