jenkins-fips

A minimal, Wolfi-based container image for Jenkins - an open-source CI/CD server that enables developers to build, test, and deploy their software.

Download this Image

The image is available on cgr.dev:

docker pull cgr.dev/chainguard/jenkins-fips:latest

Use It

The following example runs a local instance of Jenkins, specifying a local volume as the jenkins_home for data persistence:

docker run --rm -v jenkins_home:/var/jenkins_home \
  -p 8080:8080 -it \
  cgr.dev/chainguard/jenkins:latest

In the console output, the initial admin password will be logged. Use this to login to the Jenkins UI:

• http://localhost:8080/

Refer to the upstream documentation for full instructions on running and configuring Jenkins.

FIPS Mode

To run Jenkins in FIPS enabled mode, this image runs with the -Djenkins.security.FIPS140.COMPLIANCE=true property set. This variable must be set to true to inform Jenkins that it should attempt to use compliant algorithms only. However the Jenkins FIPS-140 documentation notes that if "any code from the JVM, servlet container, Jenkins, or any plugin requests a non-compliant algorithm, this will still be the case, and the request may be honoured."

Also note that if you are providing JAVA_OPTS via environment variables, you will need to include the -Djenkins.security.FIPS140.COMPLIANCE=true property since user supplied options will override the image's defaults.

To check that Jenkins is running with FIPS enabled, you can run the following Groovy script via the script console:

import jenkins.security.FIPS140
println (new FIPS140().useCompliantAlgorithms())

The result will be true if Jenkins is configured to use FIPS, and false if it is not.