Catalog / CI/CD & workflow orchestration

Jenkins

Automation server for CI/CD pipelines with a large plugin ecosystem

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

AWS Marketplace2.580.1↗ Azure Marketplace2.580.1↗
Availability and pricing
CloudVersionSoftware priceLast build
AWS Marketplace
EC2 AMI · all commercial regions
2.580.1$0.05/hr
Recommended instance: t3.medium · 5-day free trial
2026-10-02Listing ↗
Azure Marketplace
VM image · plan payg-gen2 · Gen2
2.580.1$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-02Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseMIT
UpstreamJenkins project (LF Charities Inc.)
Machine-readableproduct.json · catalog.json
What is Jenkins

Jenkins is the most widely deployed open-source automation server, the de facto standard for continuous integration and continuous delivery (CI/CD). It is a Java application (a single WAR run on the JVM) that orchestrates building, testing, and deploying software through freestyle jobs and scripted or declarative Pipelines (Jenkinsfile). Its defining strength is an ecosystem of well over 1,800 community plugins, installed on demand from the Jenkins update center, covering source control (Git, GitHub, GitLab), build tools, containers, cloud providers, notifications, and credentials management. Jenkins supports distributed builds across agents, role-based access, and a rich REST API. This image ships the current Jenkins LTS line on OpenJDK 21 from the official Jenkins debian-stable repository, persisting all jobs and configuration under JENKINS_HOME on disk. MIT license, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

  • Jenkins controller bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed
  • Each instance generates its own initial admin password at first boot, surfaced to /root/jenkins-credentials.txt (mode 600); you complete the setup wizard and create your own admin account - no shared admin is baked into the image
  • No per-instance secrets baked into the image - the Jenkins instance identity is regenerated on first launch
  • Anonymous usage statistics (telemetry) are disabled
  • JVM heap (-Xms/-Xmx) auto-sized to the instance RAM at first boot; temp directory kept off the noexec /tmp so builds run cleanly
  • Runs as a non-root jenkins system user with UMask 0027
  • certbot pre-installed - one command swaps the self-signed cert for a CA-signed one
  • UFW firewall pre-configured (only ports 22 and 443 open)
  • CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Jenkins is a registered trademark of LF Charities Inc. This is an independently hardened build, not affiliated with or endorsed by the Jenkins project.

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/jenkins-credentials.txt.

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-ngktrl557za6e/latest \
  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx
# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer jenkins --plan payg-gen2
az vm create -g my-rg -n jenkins --size Standard_D2s_v3 \
  --image lynxroute:jenkins:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

Jenkins 2.580.1

AWS · 2026-10-02Azure · 2026-10-02
  • Jenkins LTS updated 2.568.3 -> 2.580.1, the first release of the new 2.580 LTS line. MIT unchanged
  • Hardened deserialization: Object fields are no longer deserialized by default and persisted list elements are type-checked on load
  • jenkins.war is more than 20 MB smaller - long-detached plugins are no longer bundled and are installed from the update center when a plugin needs them
  • Refreshed build status icons and a cleaner sign-in, notification and System Log experience; the remember-me cookie lifetime is now configurable
  • Bundled Winstone updated to 8.1050.x with Eclipse Jetty 12.1.13
  • Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates