How to Deploy Jenkins Using Docker on an Azure Linux Virtual Machine

Deploying Jenkins using Docker on an Azure Linux Virtual Machine provides a practical way to establish a self-hosted Continuous Integration and Continuous Deployment (CI/CD) environment. Docker isolates Jenkins from the host operating system, helping reduce dependency conflicts and making the deployment easier to manage and update.

This guide walks through the process of installing Docker, deploying Jenkins, configuring the required firewall and Azure network rules, and retrieving the initial Jenkins administrator password.

Prerequisites

Before starting, ensure you have:

An Azure Linux Virtual Machine, such as an Ubuntu or Debian-based server.
Administrative (sudo) access to the server through SSH.
Access to the Azure Portal to configure networking rules.
A public IP address for the VM if Jenkins needs to be accessed externally.

Step 1: Install Docker on Your Linux Server

If Docker is already installed on your virtual machine, you can skip to Step 2.

For an Ubuntu or Debian-based server, install Docker using the following commands:

# Update package list and install prerequisites
sudo apt update
sudo apt install -y apt-transport-https ca-certificates curl software-properties-common

# Add Docker's official GPG key and repository
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /usr/share/keyrings/docker-archive-keyring.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker-archive-keyring.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

# Install Docker Engine
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io

# Start and enable Docker service
sudo systemctl start docker
sudo systemctl enable docker

# Add your current user to the docker group
sudo usermod -aG docker $USER
newgrp docker

Verify the installation:

docker --version

If Docker is already configured on the server, proceed directly to the Jenkins deployment.

Step 2: Deploy Jenkins Using Docker

Jenkins stores important information such as pipelines, configurations, plugins, and build history. A persistent Docker volume ensures that this data remains available if the Jenkins container is stopped, removed, or recreated.

Create a dedicated Docker volume:

docker volume create jenkins_home

Next, start the Jenkins LTS container:

docker run -d \
  --name jenkins \
  -p 8080:8080 \
  -p 50000:50000 \
  -v jenkins_home:/var/jenkins_home \
  --restart unless-stopped \
  jenkins/jenkins:lts

Key Flag Breakdown

-d: Runs the container in detached mode.
--name jenkins: Assigns the container the name jenkins.
-p 8080:8080: Maps port 8080 on the host to Jenkins' web interface inside the container.
-p 50000:50000: Maps port 50000, which can be used for inbound Jenkins agent connections.
-v jenkins_home:/var/jenkins_home: Mounts the persistent Docker volume used to store Jenkins data.
--restart unless-stopped: Automatically restarts Jenkins after a container failure or server restart unless the container was explicitly stopped.

Verify that the container is running:

docker ps

You can also check the Jenkins container logs:

docker logs jenkins

Step 3: Configure the Linux Server Firewall

If a firewall is enabled on the Linux server, the required ports must also be allowed at the operating-system level.

For UFW on Ubuntu or Debian

sudo ufw allow 8080/tcp
sudo ufw allow 50000/tcp
sudo ufw reload

Verify the rules:

sudo ufw status

For Firewalld on RHEL, CentOS, or Fedora

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --permanent --add-port=50000/tcp
sudo firewall-cmd --reload

Verify the configuration:

sudo firewall-cmd --list-ports

If Jenkins agent connections do not use port 50000 in your configuration, you do not need to expose that port.

Step 4: Configure the Azure Network Security Group

Azure Network Security Groups (NSGs) control inbound and outbound network traffic associated with Azure resources.

To make Jenkins accessible externally, the NSG associated with the VM or its subnet must allow the required inbound traffic.

Configure the Rule Using the Azure Portal

Open the Azure Portal and navigate to your Virtual Machine.
Under Settings, select Networking.
Select Add inbound port rule.
Create a rule for Jenkins' web interface.

Use values similar to the following:

Setting	Value
Source	Your IP address or required IP range
Destination port ranges	`8080`
Protocol	`TCP`
Action	`Allow`
Priority	`300`
Name	`Allow-Jenkins-8080`

For Jenkins agent communication using port 50000, create a separate rule:

Setting	Value
Source	Required agent IP range
Destination port ranges	`50000`
Protocol	`TCP`
Action	`Allow`
Priority	`301`
Name	`Allow-Jenkins-Agent`

For security, avoid allowing Any as the source unless there is a specific requirement. Restrict access to known IP addresses, networks, VPN ranges, or other trusted sources whenever possible.

Configure the Rules Using Azure CLI

You can also create the required NSG rules using Azure CLI:

az vm open-port \
  --resource-group myResourceGroup \
  --name myVM \
  --port 8080 \
  --priority 300

If port 50000 is required for Jenkins agent communication:

az vm open-port \
  --resource-group myResourceGroup \
  --name myVM \
  --port 50000 \
  --priority 301

Make sure the specified priority values do not conflict with existing NSG rules.

Step 5: Retrieve the Jenkins Administrator Password

When Jenkins starts for the first time, it generates an initial administrator password.

Retrieve the password from the running container:

docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

Copy the generated password.

You can also retrieve it from the Jenkins container logs if necessary:

docker logs jenkins

Step 6: Access Jenkins

Open a browser and navigate to:

http://<YOUR_AZURE_VM_PUBLIC_IP>:8080

For example:

http://203.0.113.10:8080

The Jenkins setup screen should appear.

Enter the initial administrator password retrieved in the previous step.

Jenkins will then guide you through the initial configuration process. You can select Install suggested plugins or choose the plugins required for your environment.

Finally, create the administrator account credentials and complete the setup wizard.

Security Considerations

A Jenkins server can execute builds and automation tasks, so it should not be exposed to the public internet without appropriate security controls.

Consider the following measures:

Restrict Azure NSG rules to trusted IP addresses or networks.
Use HTTPS for production Jenkins deployments.
Avoid exposing port 50000 unless inbound agent communication requires it.
Use strong administrator credentials.
Keep Jenkins and its plugins updated.
Review user and agent permissions regularly.
Use least-privilege access for build agents and integrations.
Avoid storing credentials directly in Jenkinsfiles or source code.
Back up the persistent jenkins_home data.
Monitor Jenkins authentication and administrative activity.

For production environments, placing Jenkins behind a reverse proxy, VPN, private network, or other controlled access layer can provide an additional security boundary.

Conclusion

Deploying Jenkins with Docker on an Azure Linux Virtual Machine provides a manageable foundation for a self-hosted CI/CD environment.

The process involves:

Installing Docker on the Linux VM.
Creating a persistent Docker volume for Jenkins.
Running the Jenkins LTS container.
Configuring the Linux firewall where required.
Creating appropriate Azure NSG rules.
Retrieving the initial Jenkins administrator password.
Completing the Jenkins setup wizard.

Once the installation is complete, Jenkins can be configured with the required source-control systems, build tools, agents, credentials, and CI/CD pipelines.