diff --git a/.gitignore b/.gitignore
index a320ce2..aae2a8d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,4 +3,5 @@ native-image.id
 swarm-client*.jar
 swarm-client
 swarm-config/
-libsunec.so
\ No newline at end of file
+libsunec.so
+jenkins.*
\ No newline at end of file
diff --git a/Makefile b/Makefile
index 03a2e9e..96a6ac9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,8 +1,12 @@
-ok: swarm-client libsunec.so
+test: swarm-client libsunec.so jenkins.cid | jenkins_up
 	echo Checking $@
-	./swarm-client -help
-	./swarm-client -master $(MASTER_URL) -retry 1
-MASTER_URL ?= https://www.google.com/
+	./swarm-client $(TEST_HELP)
+# TODO: Will fail until https://github.com/oracle/graal/issues/460 is resolved
+	timeout 15 ./swarm-client $(TEST_FULL) || [ $$? -eq 124 ]
+TEST_HELP = -help > /dev/null
+TEST_FULL = -master $(MASTER_URL) -tunnel $(TUNNEL) -username admin -password admin -retry 0
+MASTER_URL = http://$(shell cat jenkins.http_port)/
+TUNNEL = $(shell cat jenkins.jnlp_port)
 ARCH = $(shell dpkg --print-architecture)
 
 swarm-client: swarm-client.jar config/swarm-client native-image.id
@@ -10,7 +14,8 @@ swarm-client: swarm-client.jar config/swarm-client native-image.id
 	$(NATIVE_IMAGE) $(SWARM_OPTS) -jar $<
 TOCLEAN += swarm-client ./\?
 NATIVE_IMAGE = $(NATIVE_IMAGE_DOCKER) native-image --no-server --no-fallback -H:+ReportExceptionStackTraces
-NATIVE_IMAGE_DOCKER = docker run --rm  -v $(PWD):/out --user $(ID) --workdir /out $(NATIVE_IMAGE_I)
+NATIVE_IMAGE_DOCKER = $(DOCKER_RUN)  -v $(PWD):/out --user $(ID) --workdir /out $(NATIVE_IMAGE_I)
+DOCKER_RUN = docker container run --rm
 NATIVE_IMAGE_I = localhost/native-image:latest
 ID = $(shell id -u $(LOGNAME))
 SWARM_OPTS += --initialize-at-run-time=sun.awt.dnd.SunDropTargetContextPeer\$$EventDispatcher
@@ -30,27 +35,53 @@ export SWARM_CLIENT_URL = http://repo.jenkins-ci.org/releases/org/jenkins-ci/plu
 # arg4j requires heavy introspection see
 # https://github.com/oracle/graal/issues/1137 and
 # https://github.com/oracle/graal/blob/master/substratevm/CONFIGURE.md
-config/%: %.jar native-image.id
+config/%: %.jar native-image.id jenkins.cid | jenkins_up
 	echo Inspecting $^ for $@
+	rm -rvf $@
 	mkdir -p config
-	$(NATIVE_IMAGE_AGENT) -jar $< -master $(MASTER_URL) -retry 1 || true
-	$(NATIVE_IMAGE_AGENT) -jar $< -help
+	$(NATIVE_IMAGE_AGENT) -jar $< -master https://www.google.com -retry 0 || true
+# TODO: hudson.FilePath
+	: timeout 15 $(NATIVE_IMAGE_AGENT) -jar $< $(TEST_FULL) || [ $$? -eq 124 ]
+	$(NATIVE_IMAGE_AGENT) -jar $< $(TEST_HELP)
 TOCLEAN += config
 NATIVE_IMAGE_AGENT = $(NATIVE_IMAGE_DOCKER) java -agentlib:native-image-agent=config-merge-dir=$@
 
+jenkins_up: jenkins.http_port jenkins.jnlp_port
+	curl --retry 3 --retry-connrefused --retry-delay 15 $(MASTER_URL) > /dev/null
+
 native-image.id: native-image/Dockerfile
 	echo Building docker image $(NATIVE_IMAGE_I)
-	docker image build --pull --no-cache --tag $(NATIVE_IMAGE_I) native-image
-	docker image list --quiet $(NATIVE_IMAGE_I) > $@
+	docker image build --tag $(NATIVE_IMAGE_I) --iidfile $@ native-image
 TOCLEAN += native-image.id
-DOCKER_TOCLEAN += localhost/native-image:latest
+DOCKER_IMAGE_TOCLEAN += localhost/native-image:latest
 
 libsunec.so: native-image.id
 	echo Fetching $@
 	$(NATIVE_IMAGE_DOCKER) find /opt -name $@ -exec cp -v '{}' $@ ';'
 TOCLEAN += $(SUNEC)
 
+jenkins.cid jenkins.http_port jenkins.jnlp_port: jenkins.id
+	echo Starting test jenkins
+	docker container inspect $(shell cat jenkins.cid) > /dev/null || $(DOCKER_RUN) --publish-all --detach $(JENKINS_IMAGE) > jenkins.cid
+	echo $$(cat jenkins.cid)
+	docker container port $$(cat jenkins.cid) 8080/tcp | sed -e 's,0\.0\.0\.0,$(HOST),' > jenkins.http_port
+	docker container port $$(cat jenkins.cid) 50000/tcp | sed -e 's,0\.0\.0\.0,$(HOST),' > jenkins.jnlp_port
+TOCLEAN += jenkins.cid jenkins.http_port jenkins.jnlp_port
+HOST = $(shell host $$(hostname) | awk '{print $$4}')
+JENKINS_IMAGE = localhost/test-jenkins:latest
+DOCKER_CONTAINER_RM += $(shell cat jenkins.cid)
+
+jenkins.id: jenkins/Dockerfile
+	echo Building docker image $(JENKINS_IMAGE)
+	docker image build --tag $(JENKINS_IMAGE) --iidfile $@ jenkins
+TOCLEAN += jenkins.id
+DOCKER_IMAGE_TOCLEAN += $(JENKINS_IMAGE)
+
+
 clean:
 	echo Cleaning
-	docker image rm $(DOCKER_TOCLEAN) || true
+	docker container rm -f $(DOCKER_CONTAINER_RM) || true
+	docker image rm $(DOCKER_IMAGE_TOCLEAN) || true
 	rm -rvf $(TOCLEAN) || true
+realclean: clean
+	docker image rm $$(awk '$$1=="FROM"{print $$2}' native-image/Dockerfile) || true
diff --git a/jenkins/Dockerfile b/jenkins/Dockerfile
new file mode 100644
index 0000000..a3e51e2
--- /dev/null
+++ b/jenkins/Dockerfile
@@ -0,0 +1,8 @@
+# Best practice is a specific release tag
+FROM jenkins/jenkins:lts-alpine
+ENV JAVA_OPTS "-Djenkins.install.runSetupWizard=false ${JAVA_OPTS:-}"
+RUN /usr/local/bin/install-plugins.sh\
+	configuration-as-code\
+	script-security\
+	swarm
+COPY jenkins.yaml ${JENKINS_HOME}/