Jenkins Adopts ORAS Artifact Manager to Unify Pipeline Storage on OCI Registries

The Jenkins project has featured the ORAS Artifact Manager plugin as its September 2026 Plugin of the Month, bringing native OCI Registry as Storage (ORAS) integration to Jenkins pipelines. Authored by maintainer Valentin Delaye, the plugin allows Jenkins to store archived artifacts and pipeline stashes directly inside OCI-compliant registries—such as Harbor, Zot, Docker Registry, or GitHub Container Registry—rather than keeping them on the controller's local disk. Under the hood, the plugin relies on the CNCF ORAS Java SDK and leverages the OCI 1.1 subject descriptor standard to link archived artifact manifests directly to build root tags. For platform teams operating large Jenkins clusters, controller disk bloat from stashed workspaces and archived build artifacts remains a persistent operational vulnerability. When controllers run low on disk space, heavy cleanup routines and file I/O frequently trigger performance degradation or system instability. Offloading build artifacts to container registries decouples pipeline storage from controller compute, moving Jenkins closer to a stateless operational model. Furthermore, platform administrators who already enforce vulnerability scanning, access control, and retention policies inside their enterprise OCI registries can now bring generic CI artifacts under that same unified governance umbrella. This integration fits into a broader cloud-native industry trend: the consolidation of software distribution artifacts onto the Open Container Initiative (OCI) specification. OCI registries have expanded well beyond container images to host Helm charts, Software Bills of Materials (SBOMs), cryptographic signatures, and WebAssembly modules. Jenkins adopting the OCI 1.1 referrers specification allows every build artifact to be queried dynamically through standard registry APIs without requiring proprietary index files. By treating build outputs as first-class OCI artifacts, Jenkins bridges traditional CI workflows with modern supply chain security ecosystems. Practitioners considering the ORAS Artifact Manager should evaluate their pipeline traffic and registry capabilities. Stashing large intermediate workspaces over the network to remote registries requires sufficient bandwidth between Jenkins agents and the registry to avoid build latency. Teams should also verify that their target registry implementation fully supports the OCI Distribution and Referrers APIs. Operationally, engineers should configure registry retention rules and tag immutability policies to prevent unbounded storage costs while gaining the reliability of centralized artifact storage.