Guides

How to Build and Push a Docker Image from Jenkins

By Ravindra Bagale, DevOps trainer · LinkedIn · Published: 28 October 2026 · Last updated: 28 October 2026

Jenkins builds, tags with BUILD_NUMBER, logs in with credentials, pushes, and records the digest.

Language: English · मराठी · हिंदी

Why Jenkins builds images

Same Dockerfile every commit; humans forget flags.

Why: Laptop-only builds drift from prod. What: Jenkinsfile: build, tag, login, push. How: Declarative stages on an agent with Docker.

Example 1: Minimal Dockerfile

Type this:

mkdir -p /tmp/jdock && printf '%s\n' 'FROM public.ecr.aws/docker/library/alpine:3.20' 'CMD ["echo","hello-from-image"]' > /tmp/jdock/Dockerfile && cat /tmp/jdock/Dockerfile

You will see:

FROM public.ecr.aws/docker/library/alpine:3.20

What it means: Known base — avoid random unverified images.

Example 2: Build like Jenkins will

Type this:

docker build -t demo-app:local /tmp/jdock && docker images demo-app:local --format '{{.Repository}}:{{.Tag}}'

You will see:

demo-app:local

What it means: Local failure means the agent will fail the same way.

Example 9: Agent needs Docker

Type this:

printf '%s\n' 'Jenkins agent must run docker: socket mount or DinD.'

You will see:

Jenkins agent must run docker: socket mount or DinD.

What it means: Fix the agent before blaming the Dockerfile.

Concept 1: Build and tag

Numbered tags beat latest-only.

Why: Rollback needs an exact tag. What: BUILD_NUMBER in the tag. How: docker build && docker tag.

Example 2: Build like Jenkins will

Type this:

docker build -t demo-app:local /tmp/jdock && docker images demo-app:local --format '{{.Repository}}:{{.Tag}}'

You will see:

demo-app:local

What it means: Local failure means the agent will fail the same way.

Example 3: Tag with build number

Type this:

docker tag demo-app:local demo-app:42 && docker images demo-app --format '{{.Tag}}' | sort

You will see:

42
local

What it means: BUILD_NUMBER becomes the rollback tag.

Example 8: latest plus numbered

Type this:

docker tag demo-app:local demo-app:latest && docker images demo-app --format '{{.Tag}}' | sort | tr '\n' ' '

You will see:

42 latest local

What it means: Keep numbered tags; latest is only a pointer.

Concept 2: Login and push

Bot user via Jenkins credentials.

Why: Password in console logs is an incident. What: login --password-stdin then push. How: withCredentials → login → push.

Example 4: Jenkinsfile sketch

Type this:

printf '%s\n' 'pipeline { agent any; stages { stage("Build") { steps { sh "docker build -t demo-app:${BUILD_NUMBER} ." } } } }' > /tmp/jdock/Jenkinsfile && wc -l /tmp/jdock/Jenkinsfile

You will see:

1 /tmp/jdock/Jenkinsfile

What it means: Declarative: build then tag for your registry.

Example 5: Login via stdin

Type this:

printf '%s\n' 'echo "$REGISTRY_PASSWORD" | docker login registry.example.internal -u ci-bot --password-stdin' > /tmp/jdock/login.sh && chmod 750 /tmp/jdock/login.sh && head -1 /tmp/jdock/login.sh

You will see:

echo "$REGISTRY_PASSWORD" | docker login registry.example.internal -u ci-bot --password-stdin

What it means: Never echo the password into the console log.

Example 6: Push command

Type this:

printf '%s\n' 'docker push registry.example.internal/demo-app:42'

You will see:

docker push registry.example.internal/demo-app:42

What it means: Second push of same layers is fast.

Example 10: Credentials binding size

Type this:

printf '%s\n' 'withCredentials([usernamePassword(credentialsId: "reg-bot", usernameVariable: "U", passwordVariable: "P")]) { sh "echo P | docker login" }' > /tmp/jdock/cred.txt && wc -c /tmp/jdock/cred.txt

You will see:

120 /tmp/jdock/cred.txt

What it means: Binding injects env vars for one step only.

Concept 3: Prove the digest

Record image id for auditors.

Why: Without a digest you cannot prove what shipped. What: inspect / imagetools. How: inspect after push; set -e.

Example 7: Inspect image id

Type this:

docker image inspect demo-app:local --format '{{.Id}}' | cut -c1-19

You will see:

sha256:

What it means: Infosys auditors ask for the digest after release.

Example 11: Digests format

Type this:

docker images --digests demo-app:local --format '{{.Repository}}:{{.Tag}}' | head -1

You will see:

demo-app:local

What it means: On a real registry, imagetools inspect shows the remote digest.

Example 12: Fail fast

Type this:

printf '%s\n' 'set -e' 'docker build -t x /tmp/missing || echo BUILD_FAILED_AS_EXPECTED' > /tmp/jdock/fail.sh && bash /tmp/jdock/fail.sh

You will see:

BUILD_FAILED_AS_EXPECTED

What it means: set -e stops the pipeline on non-zero docker build.

Jenkins Docker card

1 Dockerfile 2 build 3 tag BUILD_NUMBER 4 login 5 push 6 digest

Suppose: permission denied docker.sock

Fix agent group or DinD.

Suppose: denied access on push

Bot user needs push rights on that repository.

Check yourself (quiz)

build → tag → login → push → digest. Did you understand? Let us try it once more.