Skip to content

Commit 364e4c2

Browse files
craig-osterhoutcraig-osterhout
committed
scout: add artifactory integration via watch
Signed-off-by: Craig <[email protected]>
1 parent fc52d9e commit 364e4c2

File tree

2 files changed

+156
-2
lines changed

2 files changed

+156
-2
lines changed

‎content/manuals/scout/integrations/_index.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ keywords: supply chain, security, integrations, registries, ci, environments
44
title: Integrating Docker Scout with other systems
55
linkTitle: Integrations
66
weight: 80
7-
aliases:
8-
- /scout/integrations/registry/artifactory
97
---
108

119
By default, Docker Scout integrates with your Docker organization and your
@@ -29,6 +27,7 @@ The following container registry integrations are available:
2927

3028
- [Amazon Elastic Container Registry](./registry/ecr.md)
3129
- [Azure Container Registry](./registry/acr.md)
30+
- [JFrog Artifactory](./registry/artifactory.md)
3231

3332
### Continuous Integration
3433

‎content/manuals/scout/integrations/registry/artifactory.md‎

Lines changed: 155 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,155 @@
1+
---
2+
description: Integrate Artifactory Container Registry with Docker Scout
3+
keywords: docker scout, artifactory, integration, image analysis, security, cves
4+
title: Integrate Docker Scout with Artifactory Container Registry
5+
linkTitle: Artifactory Container Registry
6+
---
7+
8+
Integrating Docker Scout with JFrog Artifactory lets you index and analyze
9+
images from Artifactory Docker. This integration is powered by a long-running
10+
`docker scout watch` process. It pulls images from your selected repositories
11+
(optionally filtered), can receive webhook callbacks from Artifactory, and
12+
pushes image data to Docker Scout. View results in the Docker Scout Dashboard or
13+
with `docker scout` CLI.
14+
15+
## How it works
16+
17+
You run [`docker scout watch`](/reference/cli/docker/scout/watch/) on a host you
18+
control and configure the Artifactory-specific registry string via `--registry
19+
"key=value,..."`. The watch process can:
20+
21+
- Watch specific repositories or an entire registry
22+
- Optionally ingest all existing images once
23+
- Periodically refresh repository lists
24+
- Receive webhook callbacks from Artifactory on a local port you choose
25+
26+
Unlike the ACR and ECR integration flows, this setup does not create any cloud
27+
resources for you. You supply Artifactory credentials, start watch, and
28+
optionally configure Artifactory webhooks.
29+
30+
### Artifactory-specific registry string options
31+
32+
These `type=artifactory` options override the generic registry handling for the `--registry` option:
33+
34+
| Key | Required | Description |
35+
|------------------|:--------:|-------------|
36+
| `type` | Yes | Must be `artifactory`. |
37+
| `registry` | Yes | Docker/OCI registry hostname (e.g., `example.jfrog.io`). |
38+
| `api` | Yes | Artifactory REST API base URL (e.g., `https://example.jfrog.io/artifactory`). |
39+
| `repository` | Yes | Repository to watch (replaces `--repository`). |
40+
| `includes` | No | Globs to include (e.g., `*/frontend*`). |
41+
| `excludes` | No | Globs to exclude (e.g., `*/legacy/*`). |
42+
| `port` | No | Local port to listen on for webhook callbacks. |
43+
| `subdomain-mode` | No | `true` or `false`; matches Artifactory’s Docker layout (subdomain vs repo-path). |
44+
45+
## Integrate an Artifactory registry
46+
47+
Use the following steps to integrate your Artifactory registry with Docker
48+
Scout.
49+
50+
1. Pick the host on which to run `docker scout watch`.
51+
52+
The host must have local or network access to your private registry and be able
53+
to access the Scout API (`https://api.scout.docker.com`) over the internet. If
54+
you're using webhook callbacks, Artifactory must also be able to reach the Scout
55+
client host on the configured port.
56+
Override the `--workers` option (default: `3`) for optimal performance based on
57+
the size of the host and the expected workload.
58+
59+
2. Ensure you are running the latest version of Scout.
60+
61+
Check your current version:
62+
63+
```console
64+
$ docker scout version
65+
```
66+
67+
If necessary, [install the latest version of Scout](https://docs.docker.com/scout/install/).
68+
69+
3. Set up your Artifactory credentials.
70+
71+
Store the credentials that the Scout client will use to authenticate with
72+
Artifactory. The following is an example using environment variables. Replace
73+
`<user>` and `<password-or-access-token>` with your actual values.
74+
75+
```console
76+
$ export DOCKER_SCOUT_ARTIFACTORY_API_USER=<user>
77+
$ export DOCKER_SCOUT_ARTIFACTORY_API_PASSWORD=<password-or-access-token>
78+
```
79+
80+
> [!TIP]
81+
>
82+
> As a best practice, create a dedicated user with read-only access and use
83+
> an access token instead of a password.
84+
85+
Store the credential that Artifactory will use to authenticate webhook
86+
callbacks. The following is an example using an environment variable. Replace
87+
`<random-64-128-character-secret>` with an actual secret.
88+
89+
```console
90+
$ export DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET=<random-64-128-character-secret>
91+
````
92+
93+
> [!TIP]
94+
>
95+
> As a best practice, generate a high-entropy random string of 64-128 characters.
96+
97+
4. Set up your Scout credentials.
98+
99+
1. Generate an organization access token for accessing Scout. For more
100+
details, see [Create an organization access
101+
token](/enterprise/security/access-tokens/#create-an-organization-access-token).
102+
2. Sign in to Docker using the organization access token.
103+
104+
```console
105+
$ docker login --username <your_organization_name>
106+
```
107+
108+
When prompted for a password, paste the organization access token you
109+
generated.
110+
111+
3. Connect your local Docker environment to your organization's Docker Scout service.
112+
113+
```console
114+
$ docker scout enroll <your_organization_name>
115+
```
116+
117+
5. Index existing images. You only need to do this once.
118+
119+
Run `docker scout watch` with the `--all-images` option to index all images in the specified Artifactory repository. The following is an example command:
120+
121+
```console
122+
$ docker scout watch --registry \
123+
"type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \
124+
--all-images
125+
```
126+
127+
6. Confirm the images have been indexed by viewing them on the [Scout
128+
Dashboard](https://scout.docker.com/).
129+
130+
7. Configure Artifactory callbacks.
131+
132+
In your Artifactory UI or via REST API, configure webhooks for image
133+
push/update events. Set the endpoint to your `docker scout watch` host and
134+
port, and include the `DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET` for
135+
authentication.
136+
137+
For more information, see the [JFrog Artifactory Webhooks
138+
documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/webhooks)
139+
or the [JFrog Artifactory REST API Webhooks
140+
documentation](https://jfrog.com/help/r/jfrog-rest-apis/webhooks)
141+
142+
8. Continuously watch for new or updated images.
143+
144+
Run `docker scout watch` with the `--refresh-registry` option to watch for
145+
new images to index. The following is an example command:
146+
147+
```console
148+
$ docker scout watch --registry \
149+
"type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \
150+
--refresh-registry
151+
```
152+
153+
9. Optional. Set up Scout integration for real-time notifications from popular
154+
collaboration platforms. For details, see [Integrate Docker Scout with
155+
Slack](../team-collaboration/slack.md).

0 commit comments

Comments
 (0)