A node is any machine Jenkins 8,793 builds on: the controller's own built-in node (called "master" until Jenkins 2.307) or an agent, a separate machine or container running the small agent.jar. An agent is permanent when defined once, or cloud-provisioned when a plugin creates one per build (Build Agents). Nodes carry labels, and a pipeline asks for a label, never for a machine.
agent-1 is defined in a ten-line agent-1.xml (mode NORMAL): root directory /home/jenkins/agent, one executor, labels linux booknest, and the inbound launcher, meaning the agent dials the controller. The Jenkins CLI registers it, borrowing the controller container's JVM because the 2.568.3 CLI needs Java 21 and the host has 17. The agent is the official jenkins/inbound-agent image on the network l2-jenkins-net, which the controller also joins:
docker exec -i -e JENKINS_USER_ID=admin -e JENKINS_API_TOKEN="$JENKINS_TOKEN" l2-jenkins \
java -jar /var/jenkins_home/war/WEB-INF/lib/cli-2.568.3.jar -s http://localhost:8080/ -http \
create-node agent-1 < agent-1.xml
URL=http://localhost:32080/computer/agent-1/jenkins-agent.jnlp
SECRET=$(curl -s -u "admin:$JENKINS_TOKEN" $URL | sed -E 's#.*<argument>([0-9a-f]{64})<.*#\1#')
docker run -d --name l2-agent-1 --init --network l2-jenkins-net \
-e JENKINS_URL=http://l2-jenkins:8080/ -e JENKINS_AGENT_NAME=agent-1 \
-e JENKINS_SECRET="$SECRET" -e JENKINS_AGENT_WORKDIR=/home/jenkins/agent \
jenkins/inbound-agent:latest-jdk21-http is needed because the CLI's default WebSocket mode rejected the container-internal URL as an "Unexpected request origin." The 64-hex-digit secret is an HMAC of the agent's name, so treat it like a password. Seconds later the Nodes page (Manage Jenkins, Nodes) lists agent-1 as connected beside the built-in node.
Label expressions combine labels: linux && booknest needs both, !built-in excludes the controller, and a node's name is also a label. NORMAL mode lets unlabeled work (agent any) use the agent; EXCLUSIVE reserves it for jobs that ask for its labels.