Clarification about what can run on agents vs controller?

The general advice is don’t run anything on the controller, only run it on agents, even if the agent is on the controller itself (ideally with a different user account so a job can’t access the controller config files and stuff).

Jobs generally don’t care though, they run on an agent, the the controller by default provides a built in agent, so it just runs there just fine.

If you are doing custom groovy code and using raw groovy classes and libraries (ex import java.io.File instead of writeFile/readFile in pipeline), that’ll run on the controller not the agent.

tl;dr you are probably fine, but hard to say without more info.