Script approval and sandbox in Jenkins - Step-by-Step Execution

Process Flow - Script approval and sandbox

User writes Groovy script

↓

Script runs in Jenkins sandbox?

No→Script requires approval

|Yes↓

Script executes safely

↓

If unapproved, admin reviews script

↓

Admin approves or rejects script

This flow shows how Jenkins checks if a Groovy script runs in a safe sandbox or needs admin approval before execution.

Execution Sample

Jenkins

node {
  def result = sh(script: 'echo Hello', returnStdout: true)
  echo(result)
}

A simple Jenkins pipeline script that runs a shell command and prints the output.

Process Table

Step	Action	Sandbox Check	Approval Needed	Result
1	Start script execution	Yes	No	Proceed to run in sandbox
2	Run shell command 'echo Hello'	Yes	No	Command runs, output 'Hello' captured
3	Print output with echo	Yes	No	Output 'Hello' printed in console
4	Script completes	Yes	No	Pipeline finishes successfully

💡 Script runs fully in sandbox, no approval needed because commands are safe

Status Tracker

Variable	Start	After Step 2	After Step 3	Final
result	undefined	'Hello\n'	'Hello\n'	'Hello\n'

Key Moments - 2 Insights

Why does Jenkins ask for script approval sometimes?

If the script uses commands or methods outside the sandbox, Jenkins blocks it until an admin approves it, as shown by 'Approval Needed' in the execution table.

What is the sandbox in Jenkins script execution?

The sandbox is a safe environment that restricts scripts to only allowed commands, preventing unsafe operations. In the table, 'Sandbox Check' shows if the script runs inside it.

Visual Quiz - 3 Questions

Look at the execution table, at which step is the shell command executed?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Check the 'Action' column in the execution table for when 'Run shell command' happens.

According to the variable tracker, what is the value of 'result' after step 3?

A undefined

B 'Hello\n'

C empty string

D null

💡 Hint

Look at the 'After Step 3' column for 'result' in the variable tracker.

If the script used an unapproved method, what would change in the execution table?

A 'Approval Needed' would be 'No'

B 'Sandbox Check' would be 'Yes'

C 'Approval Needed' would be 'Yes' and script would stop before running

D Script would run normally without interruption

💡 Hint

Refer to the 'Approval Needed' column and the exit note in the execution table.

Concept Snapshot

Jenkins runs Groovy scripts in a sandbox to keep them safe.
If a script uses unsafe commands, Jenkins blocks it and asks an admin for approval.
Approved scripts run normally next time.
Sandbox restricts scripts to safe operations only.
Admins manage script approvals in Jenkins settings.

Full Transcript

In Jenkins, when you write a Groovy script, it first checks if the script can run safely inside a sandbox. The sandbox limits what the script can do to keep the system safe. If the script uses commands or methods that are not allowed in the sandbox, Jenkins will stop the script and ask an administrator to approve it. Once approved, the script can run fully. In the example, a simple shell command runs inside the sandbox without needing approval. The variable 'result' captures the output of the shell command, which is then printed. This process helps keep Jenkins secure while allowing flexible scripting.