Question 1

initialAdminPassword is missing

Accepted Answer

Check: Has the setup wizard already been completed?. Fix: Jenkins deletes it when the wizard finishes — sign in with the administrator you created. If Jenkins is still starting, watch journalctl -u jenkins -f.

Question 2

A Declarative pipeline fails: No such DSL method 'pipeline'

Accepted Answer

Check: Manage Jenkins → Plugins → Installed: is Pipeline: Declarative (pipeline-model-definition) there?. Fix: Declarative Pipeline is held back on this image (jackson2-api findings, Configuration page). Install it from the Plugin Manager if you accept that, or use Scripted Pipeline.

Question 3

Anonymous requests get 403

Accepted Answer

Check: Expected behaviour. Fix: Anonymous users cannot read anything; sign in, or call the API with a user's API token.

Question 4

Jenkins is unreachable from another machine

Accepted Answer

Check: JENKINS_LISTEN_ADDRESS in /etc/jenkins/jenkins.env; ss -tln | grep 8080; the tcp:8080 firewall rule. Fix: Loopback by design: put HTTPS in front, or change the listen address, restart and allow your users' range.

Troubleshoot DCA Hardened CI Server — for Jenkins®

Logs & useful commands

Symptom	Check	Fix
initialAdminPassword is missing	Has the setup wizard already been completed?	Jenkins deletes it when the wizard finishes — sign in with the administrator you created. If Jenkins is still starting, watch journalctl -u jenkins -f.
A Declarative pipeline fails: No such DSL method 'pipeline'	Manage Jenkins → Plugins → Installed: is Pipeline: Declarative (pipeline-model-definition) there?	Declarative Pipeline is held back on this image (jackson2-api findings, Configuration page). Install it from the Plugin Manager if you accept that, or use Scripted Pipeline.
Anonymous requests get 403	Expected behaviour	Anonymous users cannot read anything; sign in, or call the API with a user's API token.
Jenkins is unreachable from another machine	JENKINS_LISTEN_ADDRESS in /etc/jenkins/jenkins.env; ss -tln \| grep 8080; the tcp:8080 firewall rule	Loopback by design: put HTTPS in front, or change the listen address, restart and allow your users' range.