Jenkins: Agents, Credentials and Configuration as Code

Builds should not run on the controller. Add an agent node (a VM with Java 17 and Docker):

Manage Jenkins, Nodes, New Node, choose Permanent Agent, set a label such as docker, and connect over SSH using a credential of type SSH Username with private key.

pipeline {
  agent { label 'docker' }
  environment { REGISTRY_CREDS = credentials('registry-login') }
  stages {
    stage('Build') {
      steps { sh 'docker build -t shop-api:${BUILD_NUMBER} .' }
    }
  }
}

credentials() injects secrets and masks them in the log. Create them under Manage Jenkins, Credentials rather than in the Jenkinsfile.

The Configuration as Code (JCasC) plugin describes the controller in YAML:

jenkins:
  systemMessage: "Managed by JCasC"
  numExecutors: 0
  securityRealm:
    local:
      allowsSignup: false

Keep the file in Git and mount it with CASC_JENKINS_CONFIG. Rebuilding a lost controller then takes minutes. Update plugins on a schedule, because outdated plugins are the main source of Jenkins security advisories.