Jenkins Containers: Pass Maven Proxy Settings with a Secret File

Maven’s repository proxy belongs in its settings.xml. When a Jenkins build already runs inside a Maven container, provide that file to the Maven process executing there.

Store the complete intended settings.xml as a Jenkins Secret file credential named maven-proxy-settings. Within the existing container stage’s steps:

withCredentials([
    file(credentialsId: 'maven-proxy-settings', variable: 'MAVEN_SETTINGS')
]) {
    sh 'mvn -s "$MAVEN_SETTINGS" -B verify'
}

The binding supplies a temporary file path. The single-quoted Groovy string leaves variable expansion to the shell, and the shell’s double quotes preserve the path as one argument. Maven’s -s option selects that file as its user settings; -B selects batch mode.

The credential file can contain the build’s proxy host, port, authentication and nonProxyHosts in its proxies section, together with any other required user settings. A proxy bypass list in Maven uses vertical bars between host patterns.

The file must exist where Maven runs

With Docker Pipeline, the agent and container need a compatible mounted filesystem so the bound path is readable inside the execution container. A manually launched docker run needs an explicit file mount, preferably read-only, and Maven must receive the container-side path. Passing a host path as an environment variable alone does not make the file available.

Keep any change of working directory inside the credential-binding block so the secret file is not placed under a browsable subdirectory workspace. Do not print the file into the build log or copy it into a persistent image.

This selects user settings. Maven’s global settings can still participate, so review both if an inherited mirror or other configuration continues to affect resolution.