Import from derivation, or IFD, occurs when evaluation needs the contents of a path that must first be built, for example import (runCommand "gen" {} "...") or any generator that converts a lockfile into Nix expressions at evaluation time. Nix must stop evaluating, build that derivation, and resume.
The cost is that evaluation becomes sequential and cannot be parallelized or fully cached, and it makes the whole evaluation depend on a working builder for the current system, which breaks cross-compilation and remote evaluation. Hydra and several CI setups disable IFD outright with allow-import-from-derivation = false, so a flake that evaluates fine locally fails there with cannot build ... during evaluation because the option allow-import-from-derivation is disabled.
The standard alternative is to generate the Nix expressions ahead of time and commit them, which is what tools in the node2nix and cabal2nix family do. Where a language ecosystem's Nix support offers both a committed-output mode and an IFD mode, prefer the committed one for anything that must build in CI.