Back up the XML configuration files, job and build records and the plugin packages from your Jenkins home directory. Leave out workspaces, the exploded WAR and caches, which rebuild. Keep the controller key and secrets out of regular backups and store them separately in a very secure place.
Why the key is special
Jenkins encrypts stored credentials. The keys to decrypt them live in the secrets directory under Jenkins home, with restrictive file permissions. The credentials documentation says never to include that directory in backups, and to keep a separate copy of the secret so you can restore later. The backup documentation says the same about master.key: store it separately, securely.
The reasoning is simple. If a backup holds both the encrypted credentials and the key, then anyone who gets the backup gets the secrets.
Include and exclude list
| Path under Jenkins home | Back up? | Why |
|---|---|---|
config.xml and other *.xml files | Yes | Core configuration |
jobs build records | Yes | History |
| Archived artifacts | If needed | Can be very large |
plugins/*.hpi and plugins/*.jpi | Yes | Keeps the plugin versions you use |
master.key and secrets | Separately only | Decrypts credentials |
jobs/workspace | No | Do a clean checkout after restore |
war | No | Download the latest WAR |
cache and tools | No | Download and extract again |
plugins/xxx subdirectories | No | Repopulate on restart |
The simplest approach is to back up the whole directory and handle the key on its own, with the cost being more storage. Selective backups save space but make restores more work.
Steps
- Find your Jenkins home. Package installs on Linux use
/var/lib/jenkinsper the installation docs, and the Docker example uses/var/jenkins_homeinside the container. - Pick whole directory or selective backups.
- Exclude the secrets from the routine job.
- Store the key in a separate secured location with its own access list.
- Restore into a test controller at least once, and confirm credentials still decrypt.
- Encrypt and restrict the backup storage anyway.
What a test restore proves
A backup you never restored is a guess. A test restore shows whether plugins load, jobs appear and credentials decrypt with the key you stored apart. Do it before an upgrade, not during an outage.
Try it yourself
The demo shows continuous monitoring, which pairs well with a regular backup and restore check.
Click through it at your own pace, or open it full screen.
Where Safeguard fits
Safeguard offers compliance and evidence automation, useful for keeping dated proof that backup and restore checks happened. Try the free scan on a repository too.
Quick check
Should the secrets directory be in my nightly backup?
No. Jenkins documentation says to keep it out of regular backups and store the key separately and securely.
Can I skip the workspace directory?
Yes. Workspaces hold SCM checkouts, and a clean checkout after restore replaces them.
Sources
Last reviewed: 19 October 2026.
