Jenkins is still the most widely used open-source automation server for CI/CD, and installing it correctly on Ubuntu is a rite of passage for every DevOps engineer. By the end of this guide you will have Jenkins LTS 2.580 running on Ubuntu 24.04, unlocked, secured behind a firewall, and executing its first pipeline. This guide is for developers and sysadmins who have a fresh VPS and want a private build server they fully control.
Prerequisites
- Ubuntu 24.04 (or 22.04) server, fresh or cleaned
- A non-root user with
sudoaccess - At least 2 GB RAM (4 GB recommended; Jenkins plus Java is memory-hungry)
- Port 8080 reachable from your machine (or use an SSH tunnel if you locked it down)
- About 20 minutes
Step 1: Update the system
Always start from a clean package index so the Jenkins repository resolves cleanly later.
sudo apt update && sudo apt upgrade -yapt update refreshes the package lists; upgrade applies pending security patches so nothing underneath Jenkins is stale.
Step 2: Install Java 21
Since Jenkins LTS 2.568, Jenkins requires Java 21 or newer — it will refuse to start on Java 17. Ubuntu 24.04 ships OpenJDK 21 in its default repositories, so this is one command:
sudo apt install -y fontconfig openjdk-21-jreopenjdk-21-jre provides the runtime Jenkins needs (no full JDK required for the controller). fontconfig is a Jenkins dependency for rendering graphs and charts in the UI. Verify the install:
java -versionYou should see openjdk version "21.x.x". If you already have an older Java installed, switch the default with sudo update-alternatives --config java and pick the 21 entry.
Step 3: Add the official Jenkins GPG key
Never install Jenkins from a random PPA. Use the project's own signed repository so apt can verify every package:
curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | sudo tee /usr/share/keyrings/jenkins-keyring.asc > /dev/nullcurl -fsSL downloads the signing key silently but fails loudly on errors; tee writes it into the system keyring directory where apt looks for it.
Step 4: Add the Jenkins apt repository
echo "deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] https://pkg.jenkins.io/debian-stable binary/" | sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/nullThis registers the debian-stable feed, which always serves the latest LTS release (currently the 2.580.x line) rather than the weekly builds. The signed-by option pins verification to the key you just added.
Step 5: Install Jenkins
sudo apt update && sudo apt install -y jenkinsThe package creates a jenkins system user, installs the WAR under /usr/share/java/jenkins.war, and registers a systemd service. Home directory /var/lib/jenkins (JENKINS_HOME) holds all jobs, plugins, and configuration — this is what you back up later.
Step 6: Start and enable the Jenkins service
sudo systemctl enable --now jenkinsenable makes Jenkins start on boot; --now starts it immediately. Check it came up healthy:
sudo systemctl status jenkins --no-pagerLook for active (running). Give it 30-60 seconds on a small VPS — the first start unpacks the WAR and initializes plugins.
Step 7: Open port 8080 in the firewall
If UFW is active (it should be), allow Jenkins' default HTTP port:
sudo ufw allow 8080/tcp
sudo ufw reloadLater, once you put Nginx in front with HTTPS, you can restrict 8080 to localhost only. For the initial setup, direct access is fine.
Step 8: Unlock Jenkins with the initial admin password
Open http://YOUR-SERVER-IP:8080 in your browser. Jenkins shows the "Unlock Jenkins" screen asking for the initial admin password. Retrieve it from the server:
sudo cat /var/lib/jenkins/secrets/initialAdminPasswordPaste the output into the browser and click Continue. This one-time password exists precisely so only someone with server access can claim the fresh install.
Step 9: Install the suggested plugins
On the "Customize Jenkins" screen, choose Install suggested plugins. This pulls in the standard set (Git, Pipeline, GitHub integration, build tools) and takes 2-5 minutes. Don't cherry-pick individual plugins on a first install — the suggested bundle is curated to cover 90% of CI/CD setups.
Step 10: Create the admin user and confirm the URL
Fill in the "Create First Admin User" form with a real username and a strong password — this replaces the initial admin password permanently. On the next screen, confirm the Jenkins URL (it defaults to http://YOUR-SERVER-IP:8080/). Click Save and Finish, then Start using Jenkins. You are now in the dashboard.
Step 11: Run your first pipeline
Let's prove the install works with a minimal declarative pipeline. Click New Item, name it hello-jenkins, select Pipeline, and click OK. In the pipeline definition box, paste:
pipeline {
agent any
stages {
stage('Hello') {
steps {
echo 'Hello from Jenkins on Ubuntu!'
}
}
stage('System info') {
steps {
sh 'java -version'
sh 'uname -a'
}
}
}
}Click Save, then Build Now. Open the build number on the left, then Console Output — you should see your echo lines and the java -version output. Congratulations: Jenkins is executing pipelines on your server.
Step 12 (recommended): Put Nginx in front with HTTPS
Exposing port 8080 directly is fine for testing, but production Jenkins should sit behind HTTPS. If you already have Nginx installed, add this location block inside your server block:
location / {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}The X-Forwarded-Proto header is the important one — without it Jenkins generates http:// redirect URLs even when you arrived over HTTPS. Then issue a certificate with Certbot for your domain and close port 8080 to the world:
sudo ufw delete allow 8080/tcp
sudo ufw allow 'Nginx Full'Also set the Jenkins URL under Manage Jenkins → System → Jenkins URL to your https:// domain so webhooks and email links are correct.
Verify it worked
sudo systemctl is-active jenkinsprintsactive.curl -s -o /dev/null -w "%{http_code}" http://localhost:8080/loginreturns200.- The
hello-jenkinsbuild shows green (success) in the dashboard. - Manage Jenkins → About Jenkins shows version 2.580.x — the current LTS line.
- After the Nginx step,
https://your-domain/loads Jenkins with a valid certificate.
Common issues and fixes
1. Jenkins fails to start: "Jenkins requires Java 21 or newer"
You installed an older JRE, or an old Java is still the default. Install openjdk-21-jre and run sudo update-alternatives --config java to select 21, then sudo systemctl restart jenkins.
2. "This site can't be reached" on port 8080
Usually the firewall. Run sudo ufw status — if 8080 isn't listed, add it with sudo ufw allow 8080/tcp. On cloud providers, also check the provider's security group / firewall panel, which sits outside the VM.
3. Port 8080 is already in use
Another service grabbed the port. Change Jenkins' port by creating a systemd override: sudo systemctl edit jenkins, add [Service]\nEnvironment="JENKINS_PORT=8081", then sudo systemctl daemon-reload && sudo systemctl restart jenkins.
4. Lost or never copied the initial admin password
It's a file, not a secret you must remember: sudo cat /var/lib/jenkins/secrets/initialAdminPassword. If you already completed setup, the file is deleted and you just log in with the admin user you created.
5. Plugin installation hangs or fails with "No valid crumb"
This is almost always a proxy or TLS interception issue between Jenkins and updates.jenkins.io. Check Manage Jenkins → Plugin Manager → Advanced for proxy settings, verify the server can reach the update site (curl -I https://updates.jenkins.io), then retry. A service restart clears stale update-center metadata.
Conclusion
You now have a production-grade Jenkins LTS controller on Ubuntu 24.04: Java 21 installed from official packages, the signed Jenkins repository, firewall rules, an admin user, suggested plugins, and a first green pipeline. From here, connect your Git repositories, add build agents, and store the pipeline in a Jenkinsfile so your CI/CD lives in version control next to your code.
Need Jenkins set up, hardened, or migrated for your team? XpertBees configures CI/CD pipelines, secure Jenkins controllers, and full DevOps automation for businesses — reach out and we'll handle the server side while you ship code.
