Cloud customer?
 Upgrade in MyJFrog >

Search





Overview

Start working with the JFrog Platform

The purpose of this guide is to easily get you started with your JFrog self-hosted instance. Going through the steps below will introduce you to some of the basic functionality of the JFrog Platform and the solutions that are included with your Pro and ProX subscriptions: 

  1. JFrog ArtifactoryUniversal package management and container registry in one, supporting all major packaging formats, build tools, and CI servers.
    *Available with a JFrog Pro and ProX subscription.

  2. JFrog XrayOpen source security scanning and license compliance enabling DevSecOps and ensuring application security throughout your SDLC.
    *Available with a JFrog ProX subscription.

Be sure to follow the guide and use the default names provided.

Before you start

Here’s what you’ll need:

Page Contents


Step 1: Login to your JFrog Platform environment

Login using the credentials provided to you by email, or any other administrator user created after login.

Step 2: Add repositories & artifacts

This step will walk you through creating a Docker repository type and uploading your container images, allowing you to use Artifactory as your Docker Registry. You can then follow the instructions to create other types of repositories for additional binaries out of the 27 supported technologies such as npm, Maven, Go, and others.

  1. Navigate to the Administration Module. Expand the Repositories menu and click on the Repositories menu item.

  2. Create 3 new Docker package type repositories:
    • Add a new Local Repository with the Repository Key “docker-quickstart-local” and keep the rest of the default settings.
    • Click on the Remote tab and add a new Remote Repository with the Repository Key “docker-quickstart-remote” and keep the rest of the default settings.
    • Click on the Virtual tab and add a new Virtual Repository with the Repository Key “docker-quickstart”.
      • Add the local and remote Docker repositories you just created. 
      • Select your local repository as the Default Deployment Repository and keep the rest of the default settings.

  3. Configure the Artifactory Docker settings to use the repository path method. This will access your Docker repository directly without a reverse proxy.
    • Navigate to the Administration Module. Click on the Artifactory menu and the General > HTTP Settings menu item.
    • In the Docker Settings panel, select Repository Path as the Docker Access Method.
    • In the Reverse Proxy Settings panel select Embedded Tomcat as the Server Provider (which indicates you're not using a reverse proxy).
    • By default, Docker will only send basic HTTP authentication when working against an HTTPS host. Since we are using the repository path method, we’ll use HTTP and need to use insecure registry configuration for our Docker registry.
      • For example, in Linux systems create and add the following daemon.json file under /etc/docker

        {
          "insecure-registries" : ["<My_artifactory_IP:Artifactory_Port"]
        }

        The repository path method is intended for testing purposes. When working in production, set up a reverse proxy to achieve a secure registry.

  4. Fork the JFrog Project Examples GitHub repository. Here you will find the JFrog QuickStart example GitHub repository, containing a simple Dockerfile that you will use to build your custom image.
  5. Update the base image reference.
    • Clone your forked repository and update the FROM line of the Dockerfile to reference your virtual Docker repository.

      FROM ${Artifactory_URL:Artifactory_PORT}/${VIRTUAL_REPO_NAME}/ubuntu:16.04
      

      The SERVER_NAME is the first part of the URL given to you for your environment. For example: Artifactory_IP:Artifactory_Port 

      The VIRTUAL_REPO_NAME is the name “docker-quickstart” that you assigned to your virtual repository in the steps above.

  6.  Using the following commands, log in to your virtual repository “docker-quickstart”, build, tag and push your custom image to your Docker repository:

    $ docker login ${SERVER_NAME}
    
    $ docker build --tag ${SERVER_NAME}/${VIRTUAL_REPO_NAME}/my-docker-image:latest .
    
    $ docker push ${SERVER_NAME}/${VIRTUAL_REPO_NAME}/my-docker-image:latest

    Run these commands from the cloned directory containing the Docker file.

  7. Navigate to the Application Module, in the Platform UI, expand the Artifactory menu and click the Artifacts menu item. Here you’ll be able to see the details of your new artifacts.

Step 3: Scan for OSS security vulnerabilities & compliance

*Available with a JFrog ProX subscription

This step will walk you through defining a Policy, assigning it to a Watch, selecting a repository to monitor, and running your scan.

  1. Navigate to the Administration Module. Click on the Xray Security & Compliance menu and the Indexed Resources menu item.
  2. Add your “docker-quickstart-local”, “docker-quickstart-remote” repositories to your indexed resources by clicking Add a Repository.

    Keep in mind for your future work that indexing all repositories is resource intensive. It is recommended to select only the repositories you need to scan according to your organization needs.


  3. Define a security policy that you will later enforce in a watch.
    • Navigate to the Application module, expand the Security & Compliance menu and click the Policies menu item.

    • Create a new policy called “docker-security”, of type Security, with a rule called “docker-all-severities” set with All-Severities.
  4. Define a watch that includes your new security policy. A watch provides context to a policy by assigning it to resources such as repositories.
    • Navigate to the Application module, expand the Security & Compliance menu and click the Watches menu item.
    • Create a new watch called “sample-watch”, with your 2 repositories (“docker-quickstart-local” and “docker-quickstart-remote”) and your “docker-security” policy assigned to it by clicking Manage Policies.

      Watches, Policies & Rules

      Policies allow us to define security and license compliance behaviors specific to your organization. Once they are defined, they are enforced by applying them to Watches. Rules define the behaviors that we want to enforce.


  5. Run your scan by hovering over your watch and clicking on Apply on Existing Content to manually trigger it.

    The Xray scan may take some time to complete and show the vulnerabilities results. You can return to this step later to see your vulnerabilities.



  6. View any discovered vulnerabilities by clicking on your watch.

Step 4: Set up users, groups and permissions

This step will walk you through managing role-based access control (RBAC) for your resources, such as repositories by defining users, groups, roles and permissions. This will allow you, as an administrator of the JFrog Platform, to set up access for different teams in your organization.

  1. Create a new user.
    • Navigate to the Administration Module. Click on the Identity & Access menu and the Users menu item.
    • Create a new user with the User Name “frog”. Set the Email Address and Password
  2. Create a group and assign your user to this group.
    • Navigate to the Administration Module. Click on the Identity & Access menu and the Groups menu item.
    • Create a new group called “dev-team1”. Set the Group Name and assign your newly created “frog” user to it.
  3. Define permission targets that match specific resources to your users and groups. This step will enable access for all the users in your “dev-team1” group to deploy and cache artifacts in the “docker-quickstart-local” and “docker-quickstart-remote” repositories.
    • Navigate to the Administration Module. Click on the Identity & Access menu and the Permissions menu item.
    • Create a new permission called “dev-team1-permissions”.
      • Add your “docker-quickstart-local”, “docker-quickstart-remote” repositories to your resources by clicking Add Repositories.
      • Click on the Groups tab, select your newly created “dev-team1” group, and select the Deploy/Cache permission. This also will provide your group with Read and Annotation permissions.

Use a meaningful name for the permission target that will easily help you manage and detect the required permission. For example, RnD_India, Project A, DevOps_US..

Congratulations! You’re all set and ready to continue exploring the JFrog Platform.


Learn More

Now that you’re familiar with the basic functionality of the JFrog Platform and the solutions included in your subscription, here are some useful resources to continue learning and exploring the Platform.

Documentation Resources

Other Resources



  • No labels
Copyright © 2020 JFrog Ltd.