JFrog Artifactory

Artifactory is a polyglot artifact host — a single Artifactory instance can expose many Docker repositories side by side, plus Maven, npm, Helm, and so on. The non-obvious part is the URL layout: every Docker repository is its own registry, and you'll connect each one separately.

URL layouts

Artifactory supports two configurations for Docker registries; both work with HarborGuard.

The wizard auto-detects *.jfrog.io as JFrog. For self-hosted Artifactory (artifactory.example.com), pick JFrog Artifactory manually.

Auth options

Add the registry

1. Registries → Connect Registry.
2. Registry URL — exactly as docker login would expect. For subdomain layout, just the host. For path layout, host + repo path.
3. Cloud mode: enter username + identity token.
4. Save.

If you have five Docker repos and want to scan all of them, create five HarborGuard registry connections.

Required permissions

The user / token needs:

• Read on the Docker repository.
• Annotate is not needed.
• Manage is not needed.

For an admin-issued access token: scope applied-permissions/groups:readers (or a custom group) and audience covering the Artifactory base URL.

Push-event sync

Artifactory webhooks live under Administration → General → Webhooks.

1. Create a webhook with event domain Docker and event Pushed.
2. URL: https://<your-harborguard-host>/api/webhooks/jfrog.
3. Filter to the specific repository or repositories you want.
4. Add a custom header for the shared secret (HarborGuard validates HMAC).
5. Set the registry's schedule to on_push.

Common pitfalls

• Path-style URL with a trailing slash. mycompany.jfrog.io/docker-prod/ and mycompany.jfrog.io/docker-prod are treated as different registries by HarborGuard's URL match — the wizard normalizes by stripping the trailing slash, but pre-existing connections may differ.
• Virtual repositories. A Docker virtual repo aggregates local + remote repos. HarborGuard scans whatever resolves at pull time. If a virtual repo points at a remote (proxy) repo, you're scanning Docker Hub through Artifactory; see Docker Hub's rate limits.
• artifactory/api/docker/<repo> is the API path, not the registry path. That path appears in JFrog REST docs but is wrong for docker login. Use the layouts in the table above.
• Onboarding a token without the matching user. Identity tokens carry an implied subject. Putting an unrelated username in the wizard alongside the token will succeed at the /v2/ probe but fail with 403 on first pull.
• Cloud-hosted vs self-hosted. SaaS Artifactory (*.jfrog.io) is reachable from cloud mode. Self-hosted often isn't — deploy a sensor.

Troubleshooting