Skip to content

Commit 556f6f5

Browse files
craig-osterhoutcraig-osterhout
authored
scout: add artifactory integration via watch (#23321)
<!--Delete sections as needed --> ## Description Added topic for Artifactory integration via watch https://deploy-preview-23321--docsdocker.netlify.app/scout/integrations/registry/artifactory/ ## Related issues or tickets ENGDOCS-2956 ## Reviews <!-- Notes for reviewers here --> <!-- List applicable reviews (optionally @tag reviewers) --> - [ ] Technical review - [ ] Editorial review - [ ] Product review --------- Signed-off-by: Craig <[email protected]>
1 parent 5f79dd9 commit 556f6f5

File tree

2 files changed

+170
-4
lines changed

2 files changed

+170
-4
lines changed

‎content/manuals/scout/integrations/_index.md‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ keywords: supply chain, security, integrations, registries, ci, environments
44
title: Integrating Docker Scout with other systems
55
linkTitle: Integrations
66
weight: 80
7-
aliases:
8-
- /scout/integrations/registry/artifactory
97
---
108

119
By default, Docker Scout integrates with your Docker organization and your
@@ -29,11 +27,12 @@ The following container registry integrations are available:
2927

3028
- [Amazon Elastic Container Registry](./registry/ecr.md)
3129
- [Azure Container Registry](./registry/acr.md)
30+
- [JFrog Artifactory](./registry/artifactory.md)
3231

3332
### Continuous Integration
3433

35-
Integrating Docker Scout with Continuous Integration (CI) systems is a great
36-
way to get instant, automatic feedback about your security posture in your inner
34+
Integrating Docker Scout with Continuous Integration (CI) systems is a great way
35+
to get instant, automatic feedback about your security posture in your inner
3736
loop. Analysis running in CI also gets the benefit of additional context that's
3837
useful for getting even more insights.
3938

‎content/manuals/scout/integrations/registry/artifactory.md‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
---
2+
description: Integrate Artifactory Container Registry with Docker Scout
3+
keywords: docker scout, artifactory, integration, image analysis, security, cves
4+
title: Integrate Docker Scout with Artifactory Container Registry
5+
linkTitle: Artifactory Container Registry
6+
---
7+
8+
{{% experimental %}}
9+
10+
The `docker scout watch` command is experimental.
11+
12+
Experimental features are intended for testing and feedback as their
13+
functionality or design may change between releases without warning or
14+
can be removed entirely in a future release.
15+
16+
{{% /experimental %}}
17+
18+
Integrating Docker Scout with JFrog Artifactory lets you index and analyze
19+
images from Artifactory. This integration is powered by a long-running
20+
`docker scout watch` process. It pulls images from your selected repositories
21+
(optionally filtered), can receive webhook callbacks from Artifactory, and
22+
pushes image data to Docker Scout. View results in the Docker Scout Dashboard or
23+
with `docker scout` CLI.
24+
25+
## How it works
26+
27+
You run [`docker scout watch`](/reference/cli/docker/scout/watch/) on a host you
28+
control and configure the Artifactory-specific registry string via `--registry
29+
"key=value,..."`. The watch process can:
30+
31+
- Watch specific repositories or an entire registry
32+
- Optionally ingest all existing images once
33+
- Periodically refresh repository lists
34+
- Receive webhook callbacks from Artifactory on a local port you choose
35+
36+
After the integration, Docker Scout automatically pulls and analyzes images
37+
that you push to the Artifactory registry. Metadata about your images are stored on the
38+
Docker Scout platform, but Docker Scout doesn't store the container images
39+
themselves. For more information about how Docker Scout handles image data, see
40+
[Data handling](/manuals/scout/deep-dive/data-handling.md).
41+
42+
### Artifactory-specific registry string options
43+
44+
These `type=artifactory` options override the generic registry handling for the `--registry` option:
45+
46+
| Key | Required | Description |
47+
|------------------|:--------:|----------------------------------------------------------------------------------------|
48+
| `type` | Yes | Must be `artifactory`. |
49+
| `registry` | Yes | Docker/OCI registry hostname (e.g., `example.jfrog.io`). |
50+
| `api` | Yes | Artifactory REST API base URL (e.g., `https://example.jfrog.io/artifactory`). |
51+
| `repository` | Yes | Repository to watch (replaces `--repository`). |
52+
| `includes` | No | Globs to include (e.g., `*/frontend*`). |
53+
| `excludes` | No | Globs to exclude (e.g., `*/legacy/*`). |
54+
| `port` | No | Local port to listen on for webhook callbacks. |
55+
| `subdomain-mode` | No | `true` or `false`; matches Artifactory’s Docker layout (subdomain versus repository-path). |
56+
57+
## Integrate an Artifactory registry
58+
59+
Use the following steps to integrate your Artifactory registry with Docker
60+
Scout.
61+
62+
1. Pick the host on which to run `docker scout watch`.
63+
64+
The host must have local or network access to your private registry and be able
65+
to access the Scout API (`https://api.scout.docker.com`) over the internet. If
66+
you're using webhook callbacks, Artifactory must also be able to reach the Scout
67+
client host on the configured port.
68+
Override the `--workers` option (default: `3`) for optimal performance based on
69+
the size of the host and the expected workload.
70+
71+
2. Ensure you are running the latest version of Scout.
72+
73+
Check your current version:
74+
75+
```console
76+
$ docker scout version
77+
```
78+
79+
If necessary, [install the latest version of Scout](https://docs.docker.com/scout/install/).
80+
81+
3. Set up your Artifactory credentials.
82+
83+
Store the credentials that the Scout client will use to authenticate with
84+
Artifactory. The following is an example using environment variables. Replace
85+
`<user>` and `<password-or-access-token>` with your actual values.
86+
87+
```console
88+
$ export DOCKER_SCOUT_ARTIFACTORY_API_USER=<user>
89+
$ export DOCKER_SCOUT_ARTIFACTORY_API_PASSWORD=<password-or-access-token>
90+
```
91+
92+
> [!TIP]
93+
>
94+
> As a best practice, create a dedicated user with read-only access and use
95+
> an access token instead of a password.
96+
97+
Store the credential that Artifactory will use to authenticate webhook
98+
callbacks. The following is an example using an environment variable. Replace
99+
`<random-64-128-character-secret>` with an actual secret.
100+
101+
```console
102+
$ export DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET=<random-64-128-character-secret>
103+
````
104+
105+
> [!TIP]
106+
>
107+
> As a best practice, generate a high-entropy random string of 64-128 characters.
108+
109+
4. Set up your Scout credentials.
110+
111+
1. Generate an organization access token for accessing Scout. For more
112+
details, see [Create an organization access
113+
token](/enterprise/security/access-tokens/#create-an-organization-access-token).
114+
2. Sign in to Docker using the organization access token.
115+
116+
```console
117+
$ docker login --username <your_organization_name>
118+
```
119+
120+
When prompted for a password, paste the organization access token you
121+
generated.
122+
123+
3. Connect your local Docker environment to your organization's Docker Scout service.
124+
125+
```console
126+
$ docker scout enroll <your_organization_name>
127+
```
128+
129+
5. Index existing images. You only need to do this once.
130+
131+
Run `docker scout watch` with the `--all-images` option to index all images in the specified Artifactory repository. The following is an example command:
132+
133+
```console
134+
$ docker scout watch --registry \
135+
"type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \
136+
--all-images
137+
```
138+
139+
6. Confirm the images have been indexed by viewing them on the [Scout
140+
Dashboard](https://scout.docker.com/).
141+
142+
7. Configure Artifactory callbacks.
143+
144+
In your Artifactory UI or via REST API, configure webhooks for image
145+
push/update events. Set the endpoint to your `docker scout watch` host and
146+
port, and include the `DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET` for
147+
authentication.
148+
149+
For more information, see the [JFrog Artifactory Webhooks
150+
documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/webhooks)
151+
or the [JFrog Artifactory REST API Webhooks
152+
documentation](https://jfrog.com/help/r/jfrog-rest-apis/webhooks).
153+
154+
8. Continuously watch for new or updated images.
155+
156+
Run `docker scout watch` with the `--refresh-registry` option to watch for
157+
new images to index. The following is an example command:
158+
159+
```console
160+
$ docker scout watch --registry \
161+
"type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \
162+
--refresh-registry
163+
```
164+
165+
9. Optional. Set up Scout integration for real-time notifications from popular
166+
collaboration platforms. For details, see [Integrate Docker Scout with
167+
Slack](../team-collaboration/slack.md).

0 commit comments

Comments
 (0)