Build · CI server
Jenkins
Jenkins runs declarative or scripted pipelines from a Jenkinsfile on distributed agents. Widely deployed in enterprises, it requires deliberate hardening of the controller, plugins and credential handling.
On this page
What it does
Schedules builds defined in a Jenkinsfile, distributes them to agents (VMs, containers, Kubernetes pods) and stores artifacts and logs.
Where it fits
Build stage, hosting the Secure-stage gates (Gitleaks, Semgrep, Trivy) as pipeline stages.
Quick start
pipeline {
agent { label 'linux-ephemeral' }
stages {
stage('Scan') { steps { sh 'trivy fs --exit-code 1 --severity HIGH,CRITICAL .' } }
}
}Common pitfalls
- Builds executing on the controller (
executors > 0). - Plugins installed and never updated; check the advisory feed.
- Docker socket mounted into agents for image builds.
Articles about Jenkins
CI/CD intermediate
Building a Secure CI/CD Pipeline with Jenkins
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.