CI/CD Pipeline: Complete Training Guide
Jenkins · Azure · Docker

1. What is CI/CD?

CI/CD stands for Continuous Integration and Continuous Delivery (or Deployment). It is a set of practices and tools that automate the process of building, testing, and deploying software — reducing human error and speeding up releases.

Term	What it Means
Continuous Integration (CI)	Automatically build and test code every time a developer pushes a change
Continuous Delivery (CD)	Automatically prepare tested code for release to any environment
Continuous Deployment	Automatically deploy every passing build straight to production
Pipeline	A series of automated steps: build → test → package → deploy
Artifact	The output of a build (e.g., a Docker image, JAR file, or ZIP)
Stage	A logical group of pipeline steps (e.g., 'Build' or 'Test')
Agent/Node	The machine that actually runs the pipeline stages

1.1 Why CI/CD?

• Catch bugs early — tests run on every commit, not just at release time
• Faster feedback loop — developers know within minutes if their code broke something
• Consistent deployments — the same pipeline runs every time, eliminating 'works on my machine'
• Audit trail — every deployment is logged with who changed what and when
• Reduced risk — small, frequent releases are easier to debug than big quarterly drops

1.2 Key Players in This Guide

Tool	Role
Jenkins	Open-source automation server — the orchestrator of your pipeline
Docker	Containers — packages your app + its dependencies into a portable image
Azure	Cloud platform — hosts your container registry (ACR) and Kubernetes (AKS) or App Service
Git / GitHub	Source code management — every push can trigger a pipeline run
Jenkinsfile	A text file (Groovy DSL) checked into Git that defines your pipeline

1.3 The Big Picture Flow

2. Prerequisites Checklist

2.1 Local Machine Requirements

Requirement	Details
OS	Windows 10/11, macOS 12+, or Ubuntu 20.04+
RAM	Minimum 8 GB (16 GB recommended when running Jenkins + Docker locally)
Disk	At least 20 GB free
Internet	Required for downloading images and Azure CLI

2.2 Software to Install

Step A — Install Docker Desktop

1. Download Docker Desktop from https://www.docker.com/products/docker-desktop
2. Run the installer and follow the wizard
3. After install, open a terminal and verify:

docker --version
# Expected output: Docker version 24.x.x

Enable WSL 2 integration on Windows: Settings → Resources → WSL Integration

Step B — Install Java (required by Jenkins)

# Ubuntu/Debian
sudo apt update && sudo apt install -y openjdk-17-jdk

# macOS (Homebrew)
brew install openjdk@17

# Verify
java -version
# Expected: openjdk version "17.x.x"

Step C — Install Git

# Ubuntu
sudo apt install -y git

# macOS
brew install git

# Windows — Download from https://git-scm.com

# Verify
git --version

Step D — Install Azure CLI

# Ubuntu
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# macOS
brew install azure-cli

# Windows — Download MSI from https://aka.ms/installazurecliwindows

# Verify
az --version

Step E — Install kubectl

# Ubuntu
sudo apt-get install -y kubectl

# macOS
brew install kubectl

# Verify
kubectl version --client

2.3 Azure Account Setup

# Login
az login

# List subscriptions
az account list --output table
az account set --subscription ""

# Create a Resource Group
az group create --name cicd-demo-rg --location eastus

2.4 Create Azure Container Registry (ACR)

ACR is Azure's private Docker registry — like Docker Hub, but inside Azure.

# Create the registry
az acr create \
  --resource-group cicd-demo-rg \
  --name mycicdregistry \
  --sku Basic

# Enable admin access (so Jenkins can push images)
az acr update --name mycicdregistry --admin-enabled true

# Get credentials (save these — you'll need them in Jenkins)
az acr credential show --name mycicdregistry

3. Running Jenkins in Docker

The easiest way to start Jenkins in any environment is via Docker. This avoids polluting your host OS and makes Jenkins completely portable.

3.1 Run Jenkins Container

# Create a network and volume
docker network create jenkins
docker volume create jenkins-data

# Run Jenkins (official LTS image with Docker-in-Docker support)
docker run -d \
  --name jenkins \
  --network jenkins \
  -p 8080:8080 \
  -p 50000:50000 \
  -v jenkins-data:/var/jenkins_home \
  -v /var/run/docker.sock:/var/run/docker.sock \
  jenkins/jenkins:lts-jdk17

# Wait ~30 seconds, then get the initial admin password
docker exec jenkins cat /var/jenkins_home/secrets/initialAdminPassword

3.2 Initial Jenkins Setup

1. Open http://localhost:8080 in your browser
2. Paste the initial admin password retrieved above
3. Click 'Install suggested plugins' and wait ~5 minutes
4. Create your first admin user
5. Accept the default Jenkins URL

3.3 Essential Plugins to Install

Go to: Manage Jenkins → Plugins → Available plugins

Plugin	Purpose
Docker Pipeline	Enables docker.build(), docker.withRegistry() in Jenkinsfile
Azure Credentials	Stores Azure SP credentials securely
Kubernetes CLI	Runs kubectl commands inside pipeline stages
Pipeline: Stage View	Visualises pipeline stages in the Jenkins UI
GitHub Integration	Enables webhooks from GitHub to trigger builds
Blue Ocean	Modern UI for visualising pipelines (optional)
Credentials Binding	Injects secrets as environment variables into pipeline steps

3.4 Configuring Jenkins Credentials

Credentials are stored securely in Jenkins and referenced by ID in the Jenkinsfile — never hardcode passwords!

1. Go to: Manage Jenkins → Credentials → System → Global Credentials → Add Credentials
2. Kind: Username with password
3. Username: (ACR admin username)
4. Password: (ACR password)
5. ID: acr-credentials ← this exact ID is used in the Jenkinsfile

# Create a service principal for Azure deployment
az ad sp create-for-rbac \
  --name jenkins-cicd-sp \
  --role Contributor \
  --scopes /subscriptions/

# This outputs: appId, password, tenant — save all three!

4. Docker Fundamentals for CI/CD

Docker packages your application into a self-contained unit called a container. In a CI/CD pipeline, Docker solves the classic 'it works on my machine' problem — if it runs in a container on your laptop, it runs exactly the same in Azure.

4.1 Writing a Dockerfile

# Stage 1: Build
FROM node:20-alpine AS builder
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .

# Stage 2: Production image (smaller — only what's needed)
FROM node:20-alpine AS production
WORKDIR /app
COPY --from=builder /app/node_modules ./node_modules
COPY --from=builder /app/dist ./dist
EXPOSE 3000
CMD ["node", "dist/index.js"]

Instruction	Meaning
FROM	Base image to start from
WORKDIR	Set the working directory inside the container
COPY	Copy files from your local machine into the image
RUN	Execute a command during image build
EXPOSE	Documents which port the app listens on
CMD	The command that runs when a container starts

4.2 Essential Docker Commands

# Build an image
docker build -t myapp:1.0 .

# Run a container
docker run -d -p 3000:3000 --name myapp-container myapp:1.0

# View running containers
docker ps

# View logs
docker logs myapp-container

# Tag for ACR
docker tag myapp:1.0 mycicdregistry.azurecr.io/myapp:1.0

# Push to ACR
az acr login --name mycicdregistry
docker push mycicdregistry.azurecr.io/myapp:1.0

5. Azure Services Used in This Pipeline

Azure Service	Role in Pipeline
Azure Container Registry (ACR)	Private registry for Docker images built by Jenkins
Azure Kubernetes Service (AKS)	Managed Kubernetes cluster to run your containers (Option A)
Azure App Service	Simpler PaaS option — deploy containers without Kubernetes (Option B)

5.1 Option A — Deploy to Azure Kubernetes Service (AKS)

# Create cluster (takes 5–10 minutes)
az aks create \
  --resource-group cicd-demo-rg \
  --name cicd-demo-aks \
  --node-count 2 \
  --node-vm-size Standard_B2s \
  --generate-ssh-keys \
  --attach-acr mycicdregistry

# Get credentials so kubectl can talk to your cluster
az aks get-credentials \
  --resource-group cicd-demo-rg \
  --name cicd-demo-aks

# Verify cluster is running
kubectl get nodes

6. The Jenkinsfile

A Jenkinsfile is a text file written in Groovy DSL, checked into your Git repo. It defines every stage of your pipeline — Jenkins reads it automatically when a build triggers.

pipeline {
  agent any

  environment {
    ACR_NAME        = 'mycicdregistry'
    ACR_LOGIN_SERVER = "${ACR_NAME}.azurecr.io"
    IMAGE_NAME      = 'myapp'
    IMAGE_TAG       = "${BUILD_NUMBER}"
    AKS_RG          = 'cicd-demo-rg'
    AKS_CLUSTER     = 'cicd-demo-aks'
  }

  stages {

    stage('Checkout') {
      steps {
        checkout scm
        echo "Building commit: ${env.GIT_COMMIT}"
      }
    }

    stage('Build') {
      steps {
        sh 'npm ci'
        sh 'npm run build'
      }
    }

    stage('Test') {
      steps {
        sh 'npm run test -- --coverage'
      }
      post {
        always {
          junit 'test-results/**/*.xml'
        }
      }
    }

    stage('Docker Build & Push') {
      steps {
        withCredentials([usernamePassword(
          credentialsId: 'acr-credentials',
          usernameVariable: 'ACR_USER',
          passwordVariable: 'ACR_PASS'
        )]) {
          sh """
            docker login ${ACR_LOGIN_SERVER} -u ${ACR_USER} -p ${ACR_PASS}
            docker build -t ${ACR_LOGIN_SERVER}/${IMAGE_NAME}:${IMAGE_TAG} .
            docker push  ${ACR_LOGIN_SERVER}/${IMAGE_NAME}:${IMAGE_TAG}
          """
        }
      }
    }

    stage('Deploy to AKS') {
      steps {
        withCredentials([azureServicePrincipal('azure-service-principal')]) {
          sh """
            az login --service-principal \
              -u ${AZURE_CLIENT_ID} \
              -p ${AZURE_CLIENT_SECRET} \
              --tenant ${AZURE_TENANT_ID}

            az aks get-credentials \
              --resource-group ${AKS_RG} \
              --name ${AKS_CLUSTER} \
              --overwrite-existing

            kubectl set image deployment/myapp \
              myapp=${ACR_LOGIN_SERVER}/${IMAGE_NAME}:${IMAGE_TAG} \
              --record

            kubectl rollout status deployment/myapp
          """
        }
      }
    }
  }

  post {
    success {
      echo "Pipeline succeeded — Build ${BUILD_NUMBER} deployed to AKS"
    }
    failure {
      echo "Pipeline FAILED — check Stage View for details"
    }
  }
}

7. End-to-End Walkthrough

7.1 Set Up the Sample Application

# Create project structure
mkdir cicd-demo && cd cicd-demo
git init

# Minimal Node.js app (index.js)
# const http = require('http');
# const server = http.createServer((req, res) => {
#   res.end(`Hello from CI/CD Pipeline! Build: ${process.env.BUILD_NUMBER || 'local'}\n`);
# });
# server.listen(3000);

git add .
git commit -m "Initial commit with Jenkinsfile and Dockerfile"
git push origin main

7.2 Create a Jenkins Pipeline Job

1. Open Jenkins at http://localhost:8080
2. Click 'New Item' → enter name: cicd-demo-pipeline → select 'Pipeline'
3. Under 'Pipeline Definition' → select 'Pipeline script from SCM'
4. SCM: Git → Repository URL: your GitHub repo URL
5. Branch: */main → Script Path: Jenkinsfile
6. Click Save

7.3 Set Up GitHub Webhook

A webhook tells GitHub to notify Jenkins whenever code is pushed — no manual clicking needed.

1. In GitHub: repo → Settings → Webhooks → Add webhook
2. Payload URL: http://<JENKINS_PUBLIC_IP>:8080/github-webhook/
3. Content type: application/json
4. Events: Just the push event → Add webhook

7.4 Verify the Deployment

# Check pods are running
kubectl get pods -n default

# Get the external IP of your service
kubectl get service myapp-service -n default

# Test the app
curl http://
# Expected: Hello from CI/CD Pipeline! Build: 1

8. Best Practices

8.1 Security

• Never hardcode passwords, tokens, or keys in the Jenkinsfile or Dockerfile
• Always use Jenkins Credentials Store for secrets — reference by ID in the pipeline
• Rotate ACR credentials regularly: az acr credential renew
• Use a dedicated Service Principal for Jenkins — grant only minimum permissions needed
• Add .dockerignore to prevent secrets and node_modules from leaking into images
• Scan images for vulnerabilities before pushing: docker scout quickview

8.2 Performance

• Use multi-stage Dockerfiles to keep production images small
• Order COPY instructions so infrequently-changing files come first (leverages Docker layer cache)
• Pin base image versions (node:20.11-alpine, not node:latest) for reproducibility
• Parallelize independent stages using the parallel block in Jenkinsfile

// Parallel stage example
stage('Tests') {
  parallel {
    stage('Unit Tests')        { steps { sh 'npm run test:unit' } }
    stage('Integration Tests') { steps { sh 'npm run test:integration' } }
    stage('Lint')              { steps { sh 'npm run lint' } }
  }
}

8.3 Branching Strategy

Branch	Pipeline Action
feature/*	Build + test only — no Docker push, no deploy
develop	Build + test + Docker push to ACR with :dev tag — deploy to dev
main	Full pipeline — push :latest and :<build> tags — deploy to production
release/*	Full pipeline — deploy to staging for UAT

8.4 Troubleshooting Reference

Error / Symptom	Fix
docker: command not found in pipeline	Bind mount the host socket and install Docker CLI inside the container, or use a Jenkins agent with Docker pre-installed
unauthorized: authentication required on docker push	The ACR credential ID in Jenkinsfile doesn't match what you saved in Jenkins Credentials — check spelling exactly
Webhook not triggering build	Verify the webhook URL is accessible from the internet (use ngrok locally). Check Jenkins → Manage Jenkins → System Log
AKS pod stuck in ImagePullBackOff	AKS can't pull from ACR. Ensure you ran az aks update --attach-acr to link them
kubectl: command not found in Jenkins	Install the Kubernetes CLI plugin in Jenkins, or add kubectl to the Jenkins agent PATH
Permission denied on /var/run/docker.sock	Add jenkins user to docker group: usermod -aG docker jenkins then restart Jenkins

8.5 Useful Diagnostic Commands

# View Jenkins container logs
docker logs jenkins -f

# Shell into Jenkins container for debugging
docker exec -it jenkins bash

# Check ACR images
az acr repository list --name mycicdregistry --output table
az acr repository show-tags --name mycicdregistry --repository myapp

# AKS diagnostics
kubectl describe pod  -n default
kubectl logs  -n default
kubectl get events -n default --sort-by='.lastTimestamp'

# Rollback a failed deployment
kubectl rollout undo deployment/myapp -n default

9. Learning Checkpoints

After Parts 1–2

• Can you explain what CI and CD stand for and the difference between them?
• Can you list the four tools used in this guide and the role of each?
• Is Docker Desktop installed and does docker --version work?

After Parts 3–4

• Can you start Jenkins in Docker and access the UI at port 8080?
• Can you build a Docker image from a Dockerfile and run it locally?
• Have you added ACR credentials to Jenkins with the correct ID?

After Parts 5–6

• Can you push a Docker image to Azure Container Registry using the CLI?
• Can you explain each block in the Jenkinsfile (agent, environment, stages, post)?
• Can you identify where in the Jenkinsfile secrets are injected?

After Parts 7–8

• Did a code push trigger an automatic Jenkins build via webhook?
• Did the build successfully push an image to ACR and deploy to AKS?
• Can you use kubectl to verify the deployed pod is running?
• Can you find and fix at least one error from the troubleshooting table?