DCA Hardened CI Server — for Jenkins® — documentation & support card

At a glance

Type	Hardened VM image
Upstream / license	Jenkins (MIT) — see licenses
Version	Jenkins® LTS 2.580.1 (upstream jenkins.war, sha256- and signature-verified) on Ubuntu's OpenJDK 21, Ubuntu 24.04 LTS, with 70 pinned plugins; Google Cloud image built 2026-10-07. Exact image version: see the listing. Current builds: release notes.
Architecture	x86-64
Sizing	Any current-generation instance with ≥ 4 vCPU (pay-as-you-go floor); 8 vCPU recommended for production.

Marketplaces

• Google Cloud Marketplace — listing in preparation — Compute Engine image and deployment package built and verified on booted VMs; not yet public (base: Ubuntu 24.04 LTS)

Network ports

Port	Purpose	State
22	SSH — key-only, OS Login (IAM); the deployment package adds no SSH rule	your VPC's firewall rules
8080	Jenkins web UI and API — bound to 127.0.0.1 (listen address in /etc/jenkins/jenkins.env)	customer-must-open (config + firewall toggle)

"customer-must-open" means a cloud firewall rule and, where noted, an in-image configuration change — both deliberate. Closed by default is the design.

Access & credentials

No shared or default credentials are included in this image. Access uses the SSH key you supply at launch; any application credential is generated uniquely on your instance at first boot and stored only there — we never know it.

Log in: SSH in with OS Login and forward port 8080 (gcloud compute ssh INSTANCE_NAME --zone ZONE --tunnel-through-iap -- -L 8080:127.0.0.1:8080), then open http://localhost:8080/ and unlock Jenkins.

The setup wizard's unlock password, which Jenkins itself generates on its first start on THIS VM in /var/lib/jenkins/secrets/initialAdminPassword (owned by jenkins, not world-readable), together with secret.key, secrets/master.key and the instance identity. JENKINS_HOME ships with nothing but the pinned plugin archives.

sudo cat /var/lib/jenkins/secrets/initialAdminPassword

Rotation: Finish the setup wizard: create your own administrator (Jenkins then deletes initialAdminPassword). Afterwards manage users and their API tokens from Manage Jenkins.

Step-by-step: first login / credentials.

Data & dependencies

• Data locations: /var/lib/jenkins (JENKINS_HOME: jobs, builds, configuration, secrets, plugins); /var/cache/jenkins/war (unpacked WAR) — all data stays on your instance and volumes.
• Does any data leave your tenant? No. Telemetry: none. Our images contain no phone-home, no usage beacons, no license servers. The only parties that know you deployed our software are you and your cloud provider's billing system.
• We have no access to your deployment. Your instance runs in your tenancy under your IAM; remote access for a support session exists only if you explicitly grant it, and you can revoke it at any time.
• External dependencies at deploy/runtime: None — the image is fully self-contained at deploy time; no internet access is required to boot and run.

Operate

• First boot: Jenkins generates its unlock password, keys and instance identity on its first start; jenkins-verify-firstboot.service then proves the unlock password signs in as admin, a wrong one gets 401 and anonymous access 403, the version is 2.580.1, every pinned plugin is active at its pinned version and every Jenkins listener is loopback-only, and writes /var/lib/dca-firstboot/jenkins.verified.
• Update / patch: Core: back up JENKINS_HOME, replace /opt/jenkins/jenkins.war with a newer verified LTS WAR and restart (it is root-owned and not an apt package, so neither Jenkins' own updater nor unattended-upgrades replaces it). Plugins: Manage Jenkins → Plugins → Updates. Or deploy the newest image version and move /var/lib/jenkins across.
• Backup / restore: Stop jenkins and copy /var/lib/jenkins (keep secrets/ with it — master.key decrypts every stored credential), or snapshot the boot disk.
• Uninstall: delete the VM/deployment and its volumes — nothing else persists, and software billing stops with the instance under your cloud's marketplace terms.
• Logs: systemd journal: journalctl -u jenkins -f (also Manage Jenkins → System Log)
• Health check: curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8080/login → 200

Known limitations

Single controller with no agents configured; Declarative Pipeline and the other held-back plugins are not preinstalled (see Configuration). Plain HTTP on loopback until you put HTTPS in front.

Support

Email support@dcassociatesgroup.com — first response within 1 business day (US Eastern), most tickets same-day. To escalate an open ticket, reply "ESCALATE"; it is reviewed by the founder within 1 business day. Security reports: vulnerability disclosure.

Privacy: policy · Terms: terms · Security practices: security & trust · Vulnerability reports: disclosure policy

Jenkins® is a registered trademark of LF Charities Inc.