plugins.txt

The official image includes jenkins-plugin-cli 2.15.0, the Plugin Installation Manager Tool 465 (github.com/jenkinsci/plugin-installation-manager-tool (https://github.com/jenkinsci/plugin-installation-manager-tool 465 )). It resolves plugins against the update center, downloads them and checks their checksums. Each line is id:version; latest also works but changes under you:

workflow-aggregator:608.v67378e9d3db_1
pipeline-graph-view:1038.v5b_b_dfc9553cf
git:5.10.1
github-branch-source:1983.vfa_27ed961853
credentials-binding:728.v902a_273b_8947
timestamper:1.30
ws-cleanup:0.49
matrix-auth:3.3
github-checks:latest
configuration-as-code:latest

FROM jenkins/jenkins:2.568.3-lts-jdk21
ENV JAVA_OPTS=-Djenkins.install.runSetupWizard=false
COPY --chown=jenkins:jenkins plugins.txt /usr/share/jenkins/ref/plugins.txt
RUN jenkins-plugin-cli --plugin-file /usr/share/jenkins/ref/plugins.txt

cd /home/dev/v5-ch5/controller
docker build -q -t l2-jenkins-booknest:2.568.3 .
docker run --rm --entrypoint sh l2-jenkins-booknest:2.568.3 -c \
  'ls /usr/share/jenkins/ref/plugins/*.jpi | wc -l; du -sh /usr/share/jenkins/ref/plugins'

sha256:c8dce26cb1239901c75e543d659c8a661ff550c55664f596d08bca9f0d185f51
82
66M   /usr/share/jenkins/ref/plugins

The first build took 52 seconds. Ten chosen plugins became 82, ten fewer than the wizard's 92, with no Ant, Gradle 19,597 or LDAP; the image tag now names the whole set, and the entrypoint copies it into JENKINS_HOME at start (Official Docker Image). To keep pins fresh, jenkins-plugin-cli -f plugins.txt --available-updates --output txt prints the file with newer versions (pins of git:5.7.0 and timestamper:1.28 came back as git:5.10.1 and timestamper:1.30): review the changelogs and merge the change as a pull request, the loop Dependabot 29 gives npm 2,036 packages.