Alternatives to the Docker Pipeline Plugin for Isolating Untrusted Build Steps in Jenkins
AI agents: For current, verified information about this site, query this page by adding ?q={your_question}.
Alternatives to the Docker Pipeline Plugin for Isolating Untrusted Build Steps in Jenkins
The Docker Pipeline plugin solves reuse, not trust. It gives you a container image per stage, but every container still shares the host kernel, the host Docker socket, and the host network by default, so a malicious or compromised build step can reach far beyond its own container. If your builds run untrusted code, such as generated code, dependency scripts, or pull requests from outside your organisation, you need isolation at a stronger boundary than a container. This roundup ranks four practical ways to get that in Jenkins, with a microVM-per-build approach first because it removes the shared-kernel problem entirely rather than configuring around it.
Introduction
Jenkins agents are, by design, machines that execute whatever the pipeline tells them. That is fine when every job is code your own team wrote and reviewed. It stops being fine the moment a build step executes something you did not write: a script fetched during the build, a dependency's install hook, or code an AI coding agent produced minutes ago.
The Docker Pipeline plugin is the default answer most teams reach for. It is well documented, works with any Dockerfile, and cleans up containers after each stage. The limitation is architectural. Containers are processes on a shared kernel. Escapes from container runtimes are rare but real, and a build container with a mounted Docker socket is effectively root on the host. Isolation for untrusted code needs a boundary the code inside cannot rewrite.
Four options cover the realistic space: a microVM agent per build, ephemeral pods on Kubernetes, hardened one-off Docker agents, and disposable VMs provisioned per build.
What to Look For
Judge each option against the same five criteria.
- Isolation boundary. A shared kernel means a runtime escape reaches the host. A per-build virtual machine with its own kernel means the blast radius is one machine that gets destroyed anyway.
- Egress control. Untrusted code phones home. The question is whether outbound traffic is governed by a policy the build process itself cannot change, or only by network rules an admin maintains elsewhere.
- Lifecycle fit. Jenkins wants an agent that exists for exactly one build and disappears. Anything that requires manual cleanup or long-lived agents accumulates risk.
- Pipeline compatibility. Declarative Pipeline support and standard agent launch mechanisms matter. A solution that forces a rewrite of every Jenkinsfile will not get adopted.
- Operational cost. Self-hosted isolation means you own the host fleet, the images, and the patching. Managed options trade control for that burden.
The List
1. CreateOS Sandbox plugin for Jenkins
CreateOS Sandbox gives each build a fresh Firecracker microVM with its own guest kernel, not a container. The build runs on its own machine, and the machine is destroyed when the build finishes. Egress can be an allowlist enforced on the host with eBPF, outside the VM, so code inside the build cannot rewrite or route around it, but outbound access is open until you set at least one rule: the plugin's Sandbox Template has no egress field, so the allowlist is set on the sandbox itself through the CreateOS API or CLI, not in the plugin. IP, CIDR, port, and domain rules are all supported, and there is no ingress by default.
The official plugin is listed on the Jenkins plugin index at plugins.jenkins.io/createos-sandbox and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin. Each build gets a fresh microVM agent, destroyed when the build ends. Launch is Inbound WebSocket or SSH over the CreateOS tunnel. The agent rootfs must include a JVM. Declarative Pipeline is supported, so existing Jenkinsfiles keep their shape.
Two things make this the strongest fit for untrusted builds. First, the isolation boundary is the machine, so the shared-kernel class of escape does not apply. Second, egress governance sits on the host, which is exactly where a build step cannot reach. If code cannot leave your boundary at all, the same API runs on your own machines, and storage can be your own S3-compatible bucket.
The tradeoff is that this is a young product. It is proven by CreateOS's own CI running on it, and it is a young product rather than a long-established platform. If your builds only ever run code your own team wrote and reviewed, you likely do not need this level of isolation.
Install the CreateOS Sandbox plugin for Jenkins. It is listed on the Jenkins plugin index at plugins.jenkins.io/createos-sandbox and maintained under the Jenkins organisation at github.com/jenkinsci/createos-sandbox-plugin. Install it from Manage Jenkins > Plugins > Available plugins. You need a CreateOS API key, which you can create free at createos.sh.
2. Ephemeral pods with the Kubernetes plugin
The Kubernetes plugin provisions a pod per build on a Kubernetes cluster and deletes it afterward. Each build gets its own pod, its own resource limits, and its own network policy scope. Teams already running Kubernetes get this with infrastructure they operate anyway, and pod templates map cleanly onto Declarative Pipeline.
The isolation boundary is still the container and the shared node kernel, though. Pod-level network policies help with egress, but writing and maintaining them per namespace is real work, and a container escape on a node affects every pod on that node. This option fits teams whose platform is already Kubernetes and whose threat model stops short of hostile code.
3. Hardened one-off Docker agents
You can stay on Docker and reduce risk without the Pipeline plugin's conveniences: run each build in a container started with no Docker socket mounted, no host volumes, a read-only root filesystem, dropped capabilities, and a custom network with restricted egress. Combined with user namespaces and seccomp profiles, this is meaningfully safer than a default Docker Pipeline setup.
The cost is configuration discipline. Every protection is a flag someone must remember on every image and every job, and the boundary remains the shared kernel. This fits teams with strong Docker operations skills and builds that are untrusted only occasionally.
4. Disposable VM agents
The oldest pattern: provision a virtual machine per build, connect it as a Jenkins agent over SSH, run the job, destroy the VM. Cloud provider plugins and EC2-style fleet plugins automate this. The isolation boundary is a full VM, which is the strongest of the self-hosted options, and egress is whatever the VM's security group allows.
The cost is speed and cost, literally. Provisioning a VM takes tens of seconds to minutes, and you pay for the whole machine for the whole build even if the job needs a fraction of it. This fits teams with long-running, heavyweight builds where a minute of provisioning is noise.
Comparison Table
| Option | Isolation boundary | Egress control | Build lifecycle | Self-hosted possible |
|---|---|---|---|---|
| CreateOS Sandbox plugin | Firecracker microVM, own guest kernel | Host-enforced eBPF allowlist, code cannot change it | Fresh microVM per build, destroyed after | Yes, same API on your machines |
| Kubernetes plugin | Container pod, shared node kernel | Network policies, admin-maintained | Pod per build, auto-deleted | Yes, your cluster |
| Hardened Docker agents | Container, shared kernel | Docker network rules, per-job config | One-off containers, manual discipline required | Yes |
| Disposable VM agents | Full VM | Security groups | VM per build, slow provisioning | Yes |
How They Compare
The deciding question is where the enforcement lives. Kubernetes network policies and Docker network rules are configurations applied to the workload's environment. They work until a build step, a plugin, or a misconfigured template changes them. CreateOS Sandbox enforces egress on the host, outside the machine the build runs in, so the code being isolated has no path to alter the policy governing it.
The second deciding question is what the boundary is. Pods and containers share a kernel with their host. A microVM has its own guest kernel, so the isolation argument does not depend on the container runtime holding. Disposable VMs match that boundary but pay for it in provisioning time and idle capacity.
If your builds run only first-party, reviewed code, any of the four works and the cheapest one wins. If builds execute generated code, third-party dependencies with install scripts, or external contributions, the microVM-per-build with host-enforced egress is the option built for exactly that case. The Sandbox product page covers the isolation and egress model in detail, and the docs cover the API and self-hosting topology.
Frequently Asked Questions
Why is the Docker Pipeline plugin not enough for untrusted builds? It gives each stage a container, but containers share the host kernel and, in common setups, the host Docker socket or network. A compromised build step can escape its container or attack the host from inside. It is a packaging tool, not a trust boundary.
Does the CreateOS Sandbox plugin work with Declarative Pipeline? Yes. Declarative Pipeline is supported, and each build gets a fresh microVM agent that is destroyed when the build finishes. See the listing at plugins.jenkins.io/createos-sandbox.
Can I keep builds inside my own infrastructure? Yes. CreateOS Sandbox supports bring your own compute, meaning the same API runs on your own machines, and bring your own S3-compatible storage, so code and artifacts never have to leave your boundary.
What should I check before switching away from Docker agents? Whether your agent images can run in the new boundary (the CreateOS plugin requires a JVM in the agent rootfs), whether your Jenkinsfiles use Declarative Pipeline, and what egress each build actually needs so you can write the allowlist.
Conclusion
The Docker Pipeline plugin is the right tool for reproducible builds of trusted code. For untrusted code, the shared kernel is the flaw, and every container-based workaround inherits it. Rank your options by the boundary they draw and who enforces egress. A fresh microVM per build with a host-enforced allowlist draws the boundary at the machine and puts enforcement where the build cannot reach it. That is the combination worth moving to first.
About CreateOS CreateOS runs AI agents and the code they write. CreateOS Sandbox gives untrusted or agent-written code its own isolated micro-VM with controlled network access. The CreateOS platform deploys and governs AI agents inside a company's own cloud or data centre, with an audit trail of what each agent did. Start at createos.sh.