Artifactory: Repository Management

In modern software delivery, managing binary artifacts is just as critical as managing source code. JFrog Artifactory has emerged as a leading universal repository manager, providing a single source of truth for all your binaries—from Docker images and npm packages to Maven JARs and Helm charts.

This post explores the fundamentals of repository management in Artifactory and shares practical guidance for structuring your repositories effectively.

Why a Repository Manager?

Before diving into specifics, it's worth understanding what problems Artifactory solves:

• Centralized storage for build artifacts across teams and technologies
• Caching of remote dependencies to reduce external network calls and improve build reliability
• Access control and security scanning for binaries
• Promotion workflows that move artifacts through environments (dev → staging → production)

The Three Repository Types

Artifactory organizes storage into three fundamental repository types. Understanding these is key to a healthy setup.

1. Local Repositories

Local repositories host artifacts that your organization produces. These are your internal builds, releases, and snapshots.

libs-release-local
libs-snapshot-local
docker-local

A common best practice is to separate release and snapshot artifacts to enforce different retention and promotion policies.

2. Remote Repositories

Remote repositories act as caching proxies for external sources like Maven Central, npmjs, or Docker Hub. When a dependency is requested, Artifactory downloads and caches it locally.

maven-central-remote  ->  https://repo1.maven.org/maven2
npm-remote            ->  https://registry.npmjs.org

This reduces reliance on external services and protects you from upstream outages.

3. Virtual Repositories

Virtual repositories aggregate multiple local and remote repositories under a single URL. Consumers point to one endpoint, and Artifactory resolves artifacts across the underlying repos.

maven-virtual
├── libs-release-local
├── libs-snapshot-local
└── maven-central-remote

This abstraction is powerful: you can reorganize backend repositories without changing client configuration.

A Recommended Naming Convention

Consistent naming prevents chaos as your instance grows. A widely adopted pattern is:

<team>-<technology>-<maturity>-<type>

For example:

payments-docker-release-local
payments-maven-snapshot-local
frontend-npm-virtual

Include the repository type suffix (-local, -remote, -virtual) so it's immediately clear how a repository behaves.

Managing Repositories via REST API

Automation is essential at scale. Artifactory exposes a comprehensive REST API for creating and configuring repositories.

curl -u admin:password -X PUT \
  "https://artifactory.example.com/artifactory/api/repositories/docker-local" \
  -H "Content-Type: application/json" \
  -d '{
    "rclass": "local",
    "packageType": "docker",
    "dockerApiVersion": "V2"
  }'

For infrastructure-as-code enthusiasts, the official Terraform provider lets you declare repositories declaratively:

resource "artifactory_local_docker_v2_repository" "docker_local" {
  key             = "docker-local"
  tag_retention   = 3
  max_unique_tags = 5
}

Cleanup and Retention

Binary storage grows quickly. Without a strategy, disk usage becomes unmanageable. Consider:

• Retention policies that limit the number of snapshots or Docker tags kept
• Scheduled cleanup jobs using AQL (Artifactory Query Language) to identify stale artifacts
• Storage quotas to trigger alerts before you run out of space

Here's an AQL example that finds artifacts not downloaded in 90 days:

items.find({
  "repo": "libs-snapshot-local",
  "stat.downloaded": {"$before": "90d"}
})

Security Best Practices

Repository management isn't complete without access control:

• Use permission targets to grant least-privilege access per repository
• Enable JFrog Xray to scan artifacts for vulnerabilities and license violations
• Restrict anonymous access on production-facing repositories
• Rotate access tokens regularly and prefer them over passwords in CI pipelines

Conclusion

Effective repository management in Artifactory rests on a few core principles: understand the three repository types, adopt a consistent naming convention, automate provisioning, and enforce cleanup and security policies from day one.

Get these fundamentals right, and Artifactory becomes a reliable backbone for your entire software supply chain—scaling cleanly as your organization and its binaries grow.