Jenkins ORAS Plugin Brings Native OCI Registry Storage to CI Artifacts

The Jenkins project spotlighted the ORAS Artifact Manager Plugin as its September 2026 Plugin of the Month. Maintained within the Jenkins ecosystem and built on top of the CNCF ORAS (OCI Registry As Storage) Java SDK and OCI Distribution specifications, the plugin fundamentally alters how Jenkins manages pipeline artifacts and stashes. Instead of writing build outputs to the Jenkins controller's local filesystem or relying on custom object storage abstractions, the plugin automatically pushes archived files and stashes into any standard OCI-compliant registry. Each Jenkins job maps to an OCI repository, anchoring builds via root manifests and attaching individual artifacts using OCI 1.1 referrers and subject descriptors. For Jenkins administrators managing high-throughput CI/CD environments, controller disk exhaustion and remoting overhead are chronic operational pain points. Historically, storing large binaries, test reports, and intermediate stashes on controller nodes bloated backups, complicated failovers, and introduced severe I/O contention. By delegating artifact lifecycle management to OCI registries—such as Harbor, Zot, GitHub Packages, or cloud provider registries—teams decouple stateful artifact storage from the compute layer. Jenkins UI views remain identical for end-user developers, but the infrastructure team gains native artifact deduplication, automated registry garbage collection, and consolidated governance under existing registry access controls. This development reflects a broader convergence across modern cloud-native architectures toward using OCI registries as universal artifact stores. Over recent years, OCI registries have evolved beyond container images to host Helm charts, WebAssembly binaries, Software Bills of Materials (SBOMs), and security attestations via the OCI 1.1 spec. Jenkins adopting ORAS brings legacy and enterprise CI pipelines into alignment with this cloud-native paradigm. Rather than running fragmented storage silos for build artifacts, container images, and security metadata, platform teams can now standardize the entire post-build artifact supply chain on a single OCI distribution layer. Adopting the ORAS Artifact Manager Plugin enables DevOps teams to design leaner, truly ephemeral Jenkins controllers. However, practitioners must evaluate network topology and registry authentication before rolling it out across production clusters. High-frequency pipelines pushing multi-gigabyte build outputs will generate substantial network traffic to the registry, necessitating dedicated registry bandwidth and robust caching strategies on agent nodes. Furthermore, teams should ensure their OCI registry fully supports the OCI 1.1 Referrers API to take advantage of fast artifact lookups without metadata overhead. Jenkins administrators should test the plugin on pilot pipelines to validate credential delegation across distributed agents before replacing legacy local storage.