Jenkins Fundamentals & Role-Based Access

# compose.yaml
services:
  jenkins:
    image: jenkins/jenkins:lts-jdk17
    ports:
      - "8080:8080"
      - "50000:50000"      # agent port
    volumes:
      - jenkins_home:/var/jenkins_home
    environment:
      JAVA_OPTS: "-Djenkins.install.runSetupWizard=false"
 
volumes:
  jenkins_home:

docker compose up -d
docker compose exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

jenkins_home on a named volume is the whole lab in one line. Jobs, credentials, plugins and build history all live there. Without it, docker compose down destroys your CI server — which is how people end up with a Jenkins nobody dares upgrade.

Install Git and Pipeline plugins, then create a Pipeline job with:

pipeline {
  agent any
 
  triggers {
    githubPush()
  }
 
  stages {
    stage('Checkout') {
      steps { checkout scm }
    }
    stage('Build') {
      steps { sh 'echo building; ls -la' }
    }
    stage('Test') {
      steps { sh 'echo testing' }
    }
  }
 
  post {
    always  { echo "finished: ${currentBuild.currentResult}" }
    failure { echo 'notify here' }
  }
}

For the webhook, GitHub must be able to reach Jenkins. Locally that means a tunnel:

# ngrok, cloudflared, or any tunnel
ngrok http 8080
# then GitHub -> Settings -> Webhooks -> https://<tunnel>/github-webhook/

The trailing slash on /github-webhook/ is required. Without it GitHub gets a 404 and the delivery shows red in the webhook's Recent Deliveries — which is the first place to look when pushes do not trigger builds.

Install Role-based Authorization Strategy, then Manage Jenkins → Security → Authorization → Role-Based Strategy.

Manage and Assign Roles → Manage Roles:

Create two users under Manage Users, assign one to each, and then verify by logging in as the read-only user:

• The Build Now button is absent, not merely disabled.
• Manage Jenkins does not appear.

Verify by logging in, not by reading the matrix. A permissions grid that looks right and behaves differently is the normal case, and the only proof is attempting the action.

A Jenkins with jenkins_home in a container and every user an administrator will work perfectly until the day it does not — and then there is no history to consult and no way to tell who changed what. Both problems are ten minutes of configuration now and a rebuild later.