How We Learned to Harden Jenkins Agents: 3 Mistakes That Cost Us
Originally published on kuryzhev.cloud Context: agents are the attack surface, not the controller We had to harden Jenkins agents after a routine security review turned into something less routine. A pull request from an external contributor triggered a build that, for a brief moment, had a live network path to an internal metadata endpoint it had no business touching. Nothing was exfiltrated.…
Jenkins agents were treated as trusted extensions of the controller, leading to a compromised pull request being able to access internal metadata endpoints. Agents were assumed to be safe due to the controller's RBAC security measures, but this led to the execution of arbitrary code. Agents were also connected over standard JNLP/Remoting, allowing compromised or malicious build steps to potentially reach controller-side objects.
Three main mistakes were identified in the process: treating agents as trusted extensions, mounting docker.sock for convenience, and keeping long-lived "pet" agents. To improve security, the team switched to ephemeral agents for each build, which eliminates leftover workspace and cached credentials. Additionally, they adopted a pod-per-build model using Kubernetes, ensuring that each build receives a fresh environment.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
