ShellGenius Shared Jenkins Isolation

Scenario: Many learners need authentic UI access without viewing or configuring another learner's work.

Pipeline example

// Stable proxy identity -> matching folder role
// ^u-abc123($|/.*)

Folder visibility is one layer

On a shared service, an identity gateway authenticates a stable learner ID and Jenkins authorization maps it to a private folder. Folder roles need anchored item patterns: a pattern for u-abc123 must include that folder and descendants without matching u-abc1234. Overall Read permits entry, while Item Read, Build, Configure, Workspace, and Credentials permissions control meaningful actions. Test neighboring names and nested jobs explicitly.

Folders are not complete sandboxes. Pipeline is executable code under an agent identity. Learners sharing an agent might observe processes, writable caches, files, Docker sockets, metadata services, or reachable networks even when the UI hides other folders. Ephemeral execution, distinct workspaces and service accounts, quotas, restricted egress, and removal of controller administration complement folder RBAC.

Trust the proxy precisely

Allow identity headers only from known proxy addresses, strip client-supplied copies, and prevent direct controller access that bypasses authentication. Seed folders and roles idempotently so reconnecting the same identity returns to the same scope. Audit configuration, build causes, credential binding, and administrative changes without storing token values. Never grant ordinary learners Script Console or trusted-library modification.

Test isolation adversarially: attempt to list another folder, trigger or configure its job, view its workspace, bind its credential, read shared caches, and consume all executors. Denying folder enumeration while permitting cross-tenant filesystem access is not isolation. Apply per-tenant timeouts, artifact limits, and concurrency controls so one accidental fork bomb cannot make every learner's authentic Jenkins session unusable.

Goal: Practice the concrete behavior in jenkins-credentials-binding. Learn sections have no Jenkins terminal; the Jenkins lab opens the real shared service in a new full-screen tab inside your private folder.