diff --git a/ci/Dockerfile b/ci/Dockerfile
new file mode 100644
index 0000000..b3c35c1
--- /dev/null
+++ b/ci/Dockerfile
@@ -0,0 +1,15 @@
+FROM fedora:29
+
+RUN useradd -l -u 3000018 jenkins
+
+RUN dnf install -y \
+	ansible \
+	krb5-workstation \
+	openssh-clients \
+	python3-dns \
+	python3-netaddr \
+	--
+
+COPY default-realm.krb5.conf /etc/krb5.conf.d/default-realm.conf
+
+ENV LANG=en_US.UTF-8
diff --git a/ci/dch-vpn.jenkinsfile b/ci/dch-vpn.jenkinsfile
index e372bce..21bcda7 100644
--- a/ci/dch-vpn.jenkinsfile
+++ b/ci/dch-vpn.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {
diff --git a/ci/default-realm.krb5.conf b/ci/default-realm.krb5.conf
new file mode 100644
index 0000000..90f0fff
--- /dev/null
+++ b/ci/default-realm.krb5.conf
@@ -0,0 +1,2 @@
+[libdefaults]
+default_realm = PYROCUFFLINK.BLUE
diff --git a/ci/koji.jenkinsfile b/ci/koji.jenkinsfile
index 792da1c..10042a0 100644
--- a/ci/koji.jenkinsfile
+++ b/ci/koji.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {
diff --git a/ci/ntp.jenkinsfile b/ci/ntp.jenkinsfile
index 7972fdf..bba5e0d 100644
--- a/ci/ntp.jenkinsfile
+++ b/ci/ntp.jenkinsfile
@@ -2,7 +2,17 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
diff --git a/ci/pyrocufflink.jenkinsfile b/ci/pyrocufflink.jenkinsfile
index 23b0386..f33624c 100644
--- a/ci/pyrocufflink.jenkinsfile
+++ b/ci/pyrocufflink.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {
diff --git a/ci/radius.jenkinsfile b/ci/radius.jenkinsfile
index aa3b752..52bf9bf 100644
--- a/ci/radius.jenkinsfile
+++ b/ci/radius.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {
diff --git a/ci/samba-dc.jenkinsfile b/ci/samba-dc.jenkinsfile
index efcd9b0..7125527 100644
--- a/ci/samba-dc.jenkinsfile
+++ b/ci/samba-dc.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {
diff --git a/ci/smtp.jenkinsfile b/ci/smtp.jenkinsfile
index 4e56896..bad51a5 100644
--- a/ci/smtp.jenkinsfile
+++ b/ci/smtp.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {
diff --git a/ci/zabbix.jenkinsfile b/ci/zabbix.jenkinsfile
index 2f3f9d4..7b89bad 100644
--- a/ci/zabbix.jenkinsfile
+++ b/ci/zabbix.jenkinsfile
@@ -2,13 +2,27 @@
 
 pipeline {
     agent {
-        label 'ansible'
+        dockerfile {
+            dir 'ci'
+            args '''\
+            -v /etc/ssh/ssh_known_hosts:/etc/ssh/ssh_known_hosts:ro
+            '''
+        }
+    }
+
+    options {
+        lock 'cfgpol'
+        timeout(time: 1, unit: 'HOURS')
     }
 
     triggers {
         cron 'H H * * *'
     }
 
+    environment {
+        KRB5CCNAME = "${WORKSPACE}/.krb5cc"
+    }
+
     stages {
         stage('kinit') {
             steps {