Pipeline Fundamentals, Jenkinsfile, Pipeline Engine, Durable Execution, Nodes, Workspaces, and Stages: Configuration, Design Choices, and Tradeoffs
Choose Pipeline definition, agent allocation, workspace transfer, and durability strategies based on change control, executor cost, restart requirements, evidence quality, and failure isolation.
Learning objectives
- Compare UI-defined Pipeline scripts with Jenkinsfiles stored and reviewed in SCM.
- Choose between one top-level agent and stage-level agents without assuming workspace continuity.
- Use workspace, stash/unstash, archived artifacts, and external repositories for their intended lifetimes.
- Understand the durability/performance tradeoff and why critical side-effecting Pipelines may need stronger persistence.
- Document rollback and evidence expectations for a representative build/test/release Pipeline.
1. Pipeline definition: controller UI or source control?
An inline Pipeline script stored in a job is fast for a disposable experiment, but it lives in controller configuration and is harder to review alongside application changes. A Jenkinsfile in SCM provides commit history, pull-request review, branching, and a direct source identity for the automation definition.
| Choice | Strength | Risk | Evidence |
|---|---|---|---|
| Inline UI script | Fast lab/prototype; no SCM bootstrap. | Controller-local drift; weaker code review and source linkage. | Job config snapshot + build/run identity. |
| Jenkinsfile in SCM | Reviewable/versioned with source. | SCM trust and branch-selection rules become critical. | Repository URL/ref + exact commit SHA + job/run identity. |
For production delivery automation, Pipeline-as-Code is usually the stronger ownership model, but “stored in Git” does not by itself make a Jenkinsfile trusted. Later multibranch chapters handle untrusted pull-request boundaries in depth.
2. One global agent versus stage-level agents
A top-level agent is simple and gives stages one continuous
workspace, but it can hold an executor during pauses or stages that
do not need the same machine. agent none with per-stage
agents can reduce idle capacity and select specialized environments,
at the cost of explicit file transfer and potentially more queueing.
| Pattern | Good fit | Operational consequence |
|---|---|---|
agent any / one labeled agent |
Small build where all stages use one toolchain. | Easy workspace continuity, but executor may be held longer. |
agent none + stage agents |
Build/test/deploy require different trust/tool environments. | No automatic shared workspace; transfer/recheckout must be explicit. |
| No agent for approval stage | Human wait/coordination. | Avoids consuming an executor just to wait. |
3. Workspace, stash, archive, and external artifact repositories
These mechanisms solve different lifetimes. Treating them as interchangeable is a common Pipeline design error.
| Mechanism | Lifetime/purpose | Failure consideration |
|---|---|---|
| Workspace | Execution scratch state on one node. | Can disappear with cleanup or ephemeral agent loss. |
stash/unstash |
Convenient transfer between stages/nodes in a Pipeline run. | Not intended as a long-term package repository; large stashes can burden controller/storage. |
archiveArtifacts |
Retained evidence attached to a Jenkins build. | Retention follows Jenkins build policy; storage must be sized/backed up appropriately. |
| External artifact repository | Longer-lived package distribution/promotion. | Requires separate identity, credentials, retention, and target verification. |
4. Durability setting is a risk decision
Pipeline can trade disk I/O for survivability. Jenkins documentation describes maximum-survivability, survivable-nonatomic, and performance-optimized modes. A performance-oriented setting may be reasonable for repeatable build/test jobs; a deployment or infrastructure-changing Pipeline may justify stronger persistence because re-running after a crash can have more serious consequences.
Do not change durability only because a controller is slow. Measure controller I/O, Pipeline count, storage behavior, and actual restart/recovery requirements first. A durability setting affects the next applicable run, so document which run was created under which setting.
5. disableResume is an explicit semantic choice
Declarative Pipeline supports
options { disableResume() }. That option means a
controller restart should not resume the Pipeline. Use it only when
rerunning from the beginning is the intended and safe recovery
model. It is inappropriate to assume this is harmless for jobs with
non-idempotent external side effects.
6. Stages are communication and control boundaries
Stages improve observability and can structure agent/tool/security boundaries, but a stage name is not an isolation mechanism by itself. If Build and Deploy both run on the same privileged agent with the same credentials, naming them separate stages does not establish least privilege.
Use stages to expose meaningful transitions—checkout, build, test, package, approval, publish—not to wrap every shell command in visual noise.
7. Worked scenario: build → test → approval → simulated promotion
| Stage | Agent | State carried forward | Evidence |
|---|---|---|---|
| Build | linux-builder |
Small run-scoped package via stash. | Source SHA, tool versions, package checksum. |
| Test | linux-test |
Unstashed package; test reports. | Test result/report ingestion. |
| Approve | None | Controller Pipeline state only. | Approver/timestamp where policy permits. |
| Promote simulation | trusted-release |
Immutable artifact ID/checksum, not rebuilt source. | Target verification + run/build linkage. |
This design avoids holding one executor through the approval and prevents “rebuild during release” from silently changing artifact identity.
8. Rollback is about definitions and side effects separately
Reverting a Jenkinsfile changes future runs. It does not undo already-published artifacts or external deployments. Keep a rollback plan for the Pipeline definition and a recovery/rollback plan for each external system the Pipeline mutates.
9. Decision checklist
- Where is the Pipeline definition versioned and reviewed?
- Which stages need executors/workspaces, and which can remain controller-only coordination?
- Which files are scratch, run-scoped transfer, retained build evidence, or released packages?
- What happens if the controller restarts during each stage?
- What happens if the agent disappears?
- What external state could already have changed?
- Which build/source/artifact identifiers prove what happened?
Knowledge check
Why is an SCM-backed Jenkinsfile generally easier to audit than an inline script?
It can be tied to an exact commit and reviewed through normal source-control history, while an inline script is controller-local configuration.
What changes when moving from one global agent to stage-level agents?
Workspace continuity is no longer implicit; files must be recreated, rechecked out, stashed/unstashed, or fetched from durable storage.
What is stash for?
Run-scoped transfer between stages/nodes, not a long-term release artifact repository.
When might stronger Pipeline durability be justified?
For critical, side-effecting, audit-sensitive Pipelines where losing execution state after abrupt shutdown would be costly or unsafe.
Does reverting a Jenkinsfile undo an external deployment?
No. Definition rollback affects future runs; external systems need their own verified rollback/recovery procedure.
Official references and version notes
- Jenkins LTS changelog — current LTS line and tested Java configurations.
- Jenkins Pipeline handbook — Pipeline concepts, Jenkinsfile, development tools, shared libraries, and execution model.
- Getting Started with Pipelines — durability, pausing, and the reasons Pipeline differs from Freestyle automation.
-
Pipeline Syntax
— Declarative
pipeline,agent,stages,steps, options, and restart-related directives. - Scaling Pipelines — Pipeline durability modes, persistence tradeoffs, and restart implications.
- Pipeline plugin — the aggregator and current Pipeline plugin suite.
- Pipeline: Declarative — Declarative Pipeline implementation and compatibility.
- Pipeline: Groovy — CPS execution model and controller-side Groovy interpretation.
- Pipeline: Job — persisted Pipeline run/job implementation.
- Pipeline: Nodes and Processes — node/workspace allocation and durable external process steps.
- Pipeline: Stage View — optional visualization; not the source of Pipeline execution truth.
Rechecked on 2026-09-16. Examples assume Jenkins 2.568.3 LTS, tested with Java 21 and 25. Current reference versions used for compatibility discussion are Pipeline aggregator 608.v67378e9d3db_1, Declarative Pipeline 2.2293.v6e7193cec599, Pipeline: Groovy 4380.v6eb_8378b_9647, Pipeline: Job 1600.v6f36ed83529d, Pipeline: Nodes and Processes 1479.v56e587f413a_7, and optional Pipeline: Stage View 2.41. Plugin releases move independently from Jenkins core; record the installed controller baseline before reproducing a lab. The mandatory exercises use only disposable local resources, no production credentials, and no controller-side untrusted builds.
Keep the academy open
Support free, practical DevOps education.
Every lesson is designed to remain readable in a browser, downloadable from GitHub, and usable without a paid learning platform. Contributions help expand and maintain the curriculum.
0x716c4Ab160C4B66F31a28AE2448BfF68fc3a2ef0Send only Ethereum/ERC-20 compatible assets to this
address.