{
 "slug": "jenkins",
 "name": "Jenkins",
 "tagline": "Automation server for CI/CD pipelines with a large plugin ecosystem",
 "category": "workflow-cicd",
 "use_cases": [
  "ci-cd",
  "build-automation",
  "ci-pipelines"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Jenkins project (LF Charities Inc.)",
  "url": "https://www.jenkins.io",
  "license": "MIT",
  "license_url": "https://github.com/jenkinsci/jenkins/blob/master/LICENSE.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "live",
   "version": "2.580.1",
   "last_build": "2026-10-02",
   "entity_id": "prod-ngktrl557za6e",
   "ami_alias": "/aws/service/marketplace/prod-ngktrl557za6e/latest",
   "listing_url": "https://aws.amazon.com/marketplace/pp/prodview-67q2zm4c36mrw",
   "recommended_instance_type": "t3.medium",
   "price_usd_per_hour": 0.05,
   "free_trial_days": 5,
   "unit": "instance-hour"
  },
  "azure": {
   "status": "live",
   "version": "2.580.1",
   "last_build": "2026-10-02",
   "offer_id": "jenkins",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:jenkins:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.jenkins?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/jenkins/",
  "json": "https://lynxroute.com/products/jenkins/product.json"
 },
 "release_notes": [
  {
   "version": "2.580.1",
   "title": "Jenkins 2.580.1",
   "notes": "* Jenkins LTS updated 2.568.3 -> 2.580.1, the first release of the new 2.580 LTS line. MIT unchanged\n* Hardened deserialization: Object fields are no longer deserialized by default and persisted list elements are type-checked on load\n* jenkins.war is more than 20 MB smaller - long-detached plugins are no longer bundled and are installed from the update center when a plugin needs them\n* Refreshed build status icons and a cleaner sign-in, notification and System Log experience; the remember-me cookie lifetime is now configurable\n* Bundled Winstone updated to 8.1050.x with Eclipse Jetty 12.1.13\n* Rebuilt on the current CIS Level 1 hardened Ubuntu 24.04 LTS base for the latest Ubuntu security updates\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-10-02",
    "azure": "2026-10-02"
   }
  },
  {
   "version": "2.568.3",
   "title": "Jenkins 2.568.3",
   "notes": "* Jenkins LTS updated to 2.568.3 - security release closing 13 advisories in Jenkins core (2026-09-02), led by CVE-2026-84645, a high-severity deserialization flaw allowing remote code execution through crafted nested objects\n* Also closes session fixation in the remember-me feature (CVE-2026-84652), stored XSS in the system log viewer (CVE-2026-84648), cross-origin exposure of the CSRF token (CVE-2026-84649), and several further unsafe-deserialization and missing-permission-check issues\n* Bundled Winstone updated to 8.1047.x with Eclipse Jetty 12.1.12\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base, picking up every operating-system security update published since the previous build\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-09-03",
    "azure": "2026-09-03"
   }
  },
  {
   "version": "2.568.1",
   "title": "Jenkins 2.568.1",
   "notes": "* Jenkins LTS 2.568.1 on Ubuntu 24.04 LTS (OpenJDK 21) - version update from 2.555.3. MIT unchanged\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Rebuilt on the latest CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-07-11",
    "azure": "2026-07-11"
   }
  },
  {
   "version": "2.555.3",
   "title": "Jenkins 2.555.3 - Initial release (June 2026)",
   "notes": "* Jenkins LTS 2.555.3 on Ubuntu 24.04 LTS (OpenJDK 21)\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* CVE-scanned before every release\n* Jenkins controller bound to 127.0.0.1:8080; nginx terminates TLS on port 443\n* Per-instance initial admin password generated at first boot; you create your own admin via the setup wizard - no shared admin baked into the image\n* No per-instance secrets baked into the AMI; instance identity regenerated on first launch\n* Anonymous usage statistics (telemetry) disabled\n* JVM heap auto-sized to the instance RAM at first boot; temp kept off noexec /tmp\n* Runs as non-root jenkins user (UMask 0027)\n* certbot pre-installed for CA-signed TLS certificates\n* UFW firewall pre-configured (ports 22, 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "aws": "2026-06-22"
   }
  }
 ],
 "release_history": [
  {
   "version": "2.580.1",
   "aws": "2026-10-02",
   "azure": "2026-10-02"
  },
  {
   "version": "2.568.3",
   "aws": "2026-09-03",
   "azure": "2026-09-03"
  },
  {
   "version": "2.568.2",
   "aws": "2026-08-18",
   "azure": "2026-08-18"
  },
  {
   "version": "2.568.1",
   "aws": "2026-07-11",
   "azure": "2026-07-11"
  },
  {
   "version": "2.555.3",
   "aws": "2026-06-22"
  }
 ],
 "deploy": {
  "aws_cli": "# subscribe once on the AWS Marketplace listing, then:\naws ec2 run-instances \\\n  --image-id resolve:ssm:/aws/service/marketplace/prod-ngktrl557za6e/latest \\\n  --instance-type t3.medium --key-name my-key --security-group-ids sg-xxxxxxxx",
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer jenkins --plan payg-gen2\naz vm create -g my-rg -n jenkins --size Standard_D2s_v3 \\\n  --image lynxroute:jenkins:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "Jenkins is the most widely deployed open-source automation server, the de facto standard for continuous integration and continuous delivery (CI/CD). It is a Java application (a single WAR run on the JVM) that orchestrates building, testing, and deploying software through freestyle jobs and scripted or declarative Pipelines (Jenkinsfile). Its defining strength is an ecosystem of well over 1,800 community plugins, installed on demand from the Jenkins update center, covering source control (Git, GitHub, GitLab), build tools, containers, cloud providers, notifications, and credentials management. Jenkins supports distributed builds across agents, role-based access, and a rich REST API. This image ships the current Jenkins LTS line on OpenJDK 21 from the official Jenkins debian-stable repository, persisting all jobs and configuration under JENKINS_HOME on disk. MIT license, no vendor lock-in.",
  "image_adds": "Security hardening:\n* Jenkins controller bound to 127.0.0.1:8080 (loopback only); nginx terminates TLS on port 443 and reverse-proxies to it - port 8080 is never exposed\n* Each instance generates its own initial admin password at first boot, surfaced to /root/jenkins-credentials.txt (mode 600); you complete the setup wizard and create your own admin account - no shared admin is baked into the image\n* No per-instance secrets baked into the image - the Jenkins instance identity is regenerated on first launch\n* Anonymous usage statistics (telemetry) are disabled\n* JVM heap (-Xms/-Xmx) auto-sized to the instance RAM at first boot; temp directory kept off the noexec /tmp so builds run cleanly\n* Runs as a non-root jenkins system user with UMask 0027\n* certbot pre-installed - one command swaps the self-signed cert for a CA-signed one\n* UFW firewall pre-configured (only ports 22 and 443 open)\n* CVE scan - every image is scanned for vulnerabilities before release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, fail2ban, AppArmor, SSH key-only, kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md\n\nJenkins is a registered trademark of LF Charities Inc. This is an independently hardened build, not affiliated with or endorsed by the Jenkins project."
 },
 "generated_at": "2026-10-31T09:36:34Z"
}