Backing Up JENKINS_HOME

Everything that matters is in JENKINS_HOME (Controller and JENKINS_HOME): config.xml and the other XML files, jobs/ with build history, users/, credentials.xml, the plugin archives and secrets/. Some of it can be rebuilt and need not be saved: the unpacked web application (war/), workspaces, caches and the unpacked plugin folders. Of this controller's 387 MB, war/ and plugins/ alone took 374 MB. A short-lived container with the same image does the copy, while the controller is in quiet-down mode so no build starts halfway through:

A compressed backup of l2-jenkins-homeShell

mkdir -p ~/v5-ch5/backup && cd ~/v5-ch5/backup
IMG=jenkins/jenkins:2.568.3-lts-jdk21
curl -s -u "$AUTH" -X POST $J/quietDown
docker run --rm --entrypoint tar -v l2-jenkins-home:/var/jenkins_home:ro -v "$PWD":/backup $IMG \
  -czf /backup/jenkins-home-2026-09-26.tgz -C /var/jenkins_home \
  --exclude=./war --exclude=./workspace --exclude=./caches --exclude='./plugins/*/*' .
curl -s -u "$AUTH" -X POST $J/cancelQuietDown
ls -lh *.tgz | awk '{print $5, $NF}'
tar -tzf jenkins-home-2026-09-26.tgz | grep -cE '^\./jobs/[^/]+/config\.xml$'

Output

109M jenkins-home-2026-09-26.tgz
47

A backup counts only once it has been restored. This one went into a new volume and a fresh container on another port; a Script Console check (verify.groovy: version, counts, and a SHA-256 prefix of a decrypted demo secret) then ran on both controllers:

Restoring into a fresh container, then comparingShell

docker run --rm --entrypoint tar -v l2-jenkins-restore-home:/var/jenkins_home -v "$PWD":/backup:ro \
  $IMG -xzf /backup/jenkins-home-2026-09-26.tgz -C /var/jenkins_home
docker run -d --name l2-jenkins-restore -p 127.0.0.1:32083:8080 \
  -v l2-jenkins-restore-home:/var/jenkins_home $IMG
sleep 30
for port in 32080 32083; do
  curl -s -u "$AUTH" --data-urlencode script@verify.groovy http://localhost:$port/scriptText
done

Output

2acdde47397a64b427f81e29c9ba45fd3ec4138645175b59ccf1c49d7dbd46d2
version 2.568.3, 99 plugins, 49 jobs, users [SYSTEM, admin, developer, sam, viewer]
booknest-demo-token: 26 chars, sha256 9ba9cd92d898
version 2.568.3, 99 plugins, 49 jobs, users [admin, developer, sam, viewer]
booknest-demo-token: 26 chars, sha256 9ba9cd92d898

Jobs, users, the admin's API token and the credentials all came back, and Jenkins 8,793 unpacked the 99 plugins again on first start. (SYSTEM, the internal user builds run as, has no folder in users/, so only the running original lists it.) Leave out secrets/ and the restore fails quietly: Test Yourself! shows how. Schedule the copy, and store it encrypted off the machine: it holds every credential and the key to them. The ThinBackup plugin schedules backups from inside Jenkins; keep it current, as the 2 September 2026 advisory fixed a high-severity flaw in version 2.1.4 and earlier.

MENU