Looks like there's a Docker Pipeline plugin that might provide what we need for this.

I played with this a bit today, needs some more refinement but the Dockerfile plugin made it pretty easy. The docker pipeline plugin also supports pushing to private registries which we could add as a stage in the pipeline.

Here's what I got working:

node {
    def jobName = "${JOB_NAME}:${BUILD_ID}".toLowerCase()
    def jobImg

    stage('Setup') {
        git url: 'https://github.com/wikimedia/scap'
        if (! fileExists('Dockerfile.ci')) {
            error('No Dockerfile.ci found in repo root!')
        }
    }

    stage('Build') {
        jobImg = docker.build("${jobName}", '-f Dockerfile.ci .')
    }

    stage('Test') {
        sh "docker run --rm -t ${jobName}"
    }

}

The default jobImg.run() uses docker run -d so you don't see the shell output. I suppose this mostly leaves the phab wrangling to replace differential-docker-test.

You can see the job in action here: http://ci-staging-jenkins.wmflabs.org/ci/job/Jenkinsfile.docker/