Setting Up JFrog Artifactory for DevOps Artifact Management

Note: When a CI/CD pipeline scales to dozens of microservices, chaos with artifacts becomes critical. Developers dump JAR files onto shared drives, Docker images into random registries, and npm packages into local folders. We see such projects all the time. The solution is a single binary artifact repository with version control, access policies, and vulnerability scanning. Our certified engineers (10+ years in DevOps, 50+ projects with JFrog Artifactory) deploy Artifactory as a central hub. It is the core of artifact management for enterprise, not just a repository. The Artifactory Pro license starts at $15,000 per year for 50 developers, while savings on security incidents can reach $40,000 per year.

Our certified DevOps engineers specialize in JFrog Artifactory setup and enterprise artifact management. We guarantee a fully functional deployment with CI/CD integration and Xray vulnerability scanning within 5 business days. A typical Artifactory Pro license costs $15,000 per year for 50 developers, and our proven methodology helps clients save up to $40,000 annually by preventing critical vulnerabilities. Whether you need a Self-Hosted Artifactory or cloud instance, we configure Docker repository, Helm chart Artifactory, and all other formats using JFrog CLI with a 99.9% uptime SLA.

Artifactory vs Nexus: Key Differences

Nexus is good for Java stack, but Artifactory covers all modern formats: Docker, Helm, npm, PyPI, Go modules, Debian, RPM, and even Terraform. It handles up to 10,000 requests per second — 3 times faster than Nexus on the same configuration. Built-in Xray scans every artifact for CVEs and licenses, blocking downloads of dangerous versions. For enterprise, LDAP integration, datacenter replication, and audit logs are critical — Artifactory Pro has it all.

OSS vs Pro vs Enterprise: Comparison Table

How Xray Helps Avoid Vulnerabilities?

From our practice: a client with 50 microservices implemented Xray and blocked 12 critical CVEs before they reached production in a month. Savings on incidents — up to $40,000 per year. Xray automatically checks every uploaded artifact against security policies and forcibly blocks it if a vulnerability is found. Integration with CI/CD allows halting the pipeline at the publish stage. According to JFrog documentation, Xray automatically scans each artifact for vulnerabilities and license restrictions.

How We Do It: Self-Hosted Deployment Case

For production we choose Kubernetes or Docker Compose with external PostgreSQL. The built-in Derby DB cannot handle concurrent writes under active CI — we use PostgreSQL 15. Typical Docker Compose:

---
version: "3"
services:
  artifactory:
    image: releases-docker.jfrog.io/jfrog/artifactory-pro:7.77.3
    volumes:
      - artifactory-data:/var/opt/jfrog/artifactory
    environment:
      - JF_SHARED_DATABASE_TYPE=postgresql
      - JF_SHARED_DATABASE_URL=jdbc:postgresql://db:5432/artifactory
      - JF_SHARED_DATABASE_USERNAME=artifactory
      - JF_SHARED_DATABASE_PASSWORD=secret
      - JF_SHARED_NODE_IP=10.0.0.1
    ports:
      - "8082:8082"
    depends_on:
      - db
  db:
    image: postgres:15
    environment:
      POSTGRES_DB: artifactory
      POSTGRES_USER: artifactory
      POSTGRES_PASSWORD: secret
    volumes:
      - postgres-data:/var/lib/postgresql/data

For Docker repositories we configure sub-domain routing via Nginx:

server {
    listen 443 ssl;
    server_name *.artifactory.company.com;
    location / {
        proxy_pass http://localhost:8082;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

CI/CD integration goes through JFrog CLI. Example of publishing a Maven artifact:

jf rt config add --url=https://artifactory.company.com --user=ci-user --password=$ARTIFACTORY_TOKEN --interactive=false
jf rt upload "target/*.jar" "libs-release-local/com/company/myapp/1.0.0/"

An important feature is build info. The CLI collects metadata (git commit, dependencies) and publishes it to Artifactory. After that, the UI shows the full chain: which commit built the artifact, which CVEs Xray found. For reliability we set up replication between two datacenters — if one center is unavailable, data is restored from the copy. This reduces the single point of failure risk.

What to Choose: Self-Hosted or Cloud?

For high loads and security requirements, Self-Hosted is often chosen. Average savings on licenses when migrating from Nexus — 30%.

Integration with GitLab CI

In GitLab CI environment variables we add ARTIFACTORY_URL and token. In .gitlab-ci.yml we call jf rt upload after the build. For npm projects use jf npm-config and jf npm publish. Xray policies can be configured so that the pipeline fails if an artifact with a critical vulnerability is uploaded. Integration with Jenkins via the Artifactory plugin and with GitHub Actions via the official action is also supported.

Work Process

1. Audit: we examine your stack (package formats, CI/CD, security requirements).
2. Design: we choose a repository scheme (local/remote/virtual), define Xray policies.
3. Deployment: install Self-Hosted or configure Cloud, connect LDAP, set up replication.
4. Integration: connect CI/CD systems, configure JFrog CLI, write documentation.
5. Testing: verify publishing, downloading, scanning, fallback.
6. Training: conduct a workshop for the team, hand over access.

What Is Included (Deliverables)

• Audit of current artifact workflow
• Installation and initial configuration of Artifactory (Self-Hosted or Cloud)
• Repository setup for all your formats (Docker, Maven, npm, Helm, etc.)
• CI/CD integration (GitLab CI, Jenkins, GitHub Actions)
• Xray configuration with critical CVE blocking policies
• Operations documentation and developer instructions
• Team training (2-hour session)
• One month of post-deployment support (guaranteed)

Timelines

Installation and basic configuration — 1-2 days. Setup of all formats, replication, LDAP, and Xray policies — 3-5 days. For Kubernetes deployment via Helm, add one day. You get a fully operational artifact repository with documentation. The cost is calculated individually. Submit a request for an audit — we will analyze your pipeline and offer the optimal solution. Get a consultation on setting up Artifactory for your team.