JFrog Artifactory Basics

By Kokil Thapa | Last reviewed: September 2026

Your build works on one laptop and fails in staging because a dependency vanished from a public registry. JFrog Artifactory basics solve that class of problem by giving your team one controlled place to store, cache, and version every package your applications need. If you already manage artifact repositories with Nexus or Artifactory, this guide focuses on Artifactory from first install through daily use. The patterns here apply whether you run PHP Composer builds, Node.js frontends, or container images on Ubuntu servers you maintain through Linux system administration.

What is JFrog Artifactory and why do teams use it?

Artifactory is a binary repository manager. It stores JAR files, npm tarballs, Docker layers, Helm charts, and dozens of other package formats in one platform. Public registries like npm or Docker Hub can change, rate-limit, or disappear a version overnight. Artifactory sits between your developers and those upstream sources.

On real client projects I have seen a single missing Composer package block a Friday deploy. A private repository with remote caching prevents that. Artifactory also gives you audit trails, permission boundaries, and promotion workflows from dev to production.

Teams adopt it when:

• Multiple applications share internal libraries and need semver discipline.
• CI pipelines must produce identical artifacts for staging and production.
• Compliance requires knowing exactly which binary ran in production.
• Build speed matters and repeated downloads from npm or Maven Central waste minutes.

Artifactory is not a replacement for Git. Source code stays in GitLab or GitHub. Built outputs — the things you actually deploy — live in Artifactory. That separation is the core of mature custom software development delivery.

How do you install and configure JFrog Artifactory for a small team?

Artifactory ships as a self-hosted install or as JFrog cloud SaaS. For a small team on a single Ubuntu 22 or 24 server, the Linux installer is the usual starting point. You need Java 17 or newer and at least 4 GB RAM for a trial setup.

Self-hosted install on Ubuntu

Download the Linux archive from the official JFrog site. Extract it, then run the bundled script:

tar -xvf jfrog-artifactory-oss-<version>-linux.tar.gz
cd artifactory-oss-<version>/app/bin
./artifactory.sh start

Default UI port is 8081. First login uses admin / password, and you must change the password immediately. For production, put Nginx or Apache in front with TLS. That matches how I configure other internal tools on shared EC2 boxes alongside Deployer-managed PHP apps like those on Adventure Third Pole Trek.

Initial configuration checklist

1. Create an admin service account for CI — never use the root admin user in pipelines.
2. Generate an identity token or API key for programmatic access.
3. Set base URL under Administration → General → Server Settings.
4. Configure mail alerts for disk usage and license expiry.
5. Enable garbage collection schedules if you store Docker layers.

Disk planning matters early. Docker images and npm caches grow fast. Budget 50 GB minimum for a team of five. Monitor with standard Linux tooling covered in Linux performance tuning basics.

Validate your setup JSON config with a JSON formatter before pasting API payloads into scripts. Small syntax errors in repository JSON cause silent 400 responses.

What are the main repository types in Artifactory?

Three repository types form the foundation of every Artifactory deployment. Understanding them prevents the most common misconfiguration: pointing CI at a remote repo when you need a local one.

Local repositories

Local repos store artifacts your team publishes. Examples include internal Composer packages, custom npm scopes, or release JARs. Nothing enters a local repo unless something explicitly uploads it. Use naming like composer-local or npm-local.

Remote repositories

Remote repos proxy upstream registries. When a build requests lodash@4.17.21, Artifactory checks its cache first. On a miss, it fetches from registry.npmjs.org and stores a copy. Subsequent builds download from your LAN or VPC instead of the public internet.

Virtual repositories

Virtual repos aggregate multiple local and remote repos behind one URL. Your .npmrc or composer.json repository URL should almost always point at a virtual repo. Resolution order matters: Artifactory searches members in the order you define, so put local repos first to prefer internal packages over cached public ones.

For PHP projects using Composer 2.10, create a Composer local repo and a Packagist remote. Laravel 13 and Symfony 8.1 builds both benefit from the same pattern. Pin your composer.lock and let Artifactory cache the dist files.

How do you publish and retrieve packages with Artifactory?

Configuration differs by package type, but the pattern is identical. Point your tool at the virtual repo URL, authenticate, then publish or install.

npm and Node.js 26 LTS projects

Create repos for npm. Add a scoped registry in .npmrc at the project root:

@myorg:registry=https://artifactory.example.com/artifactory/api/npm/npm-virtual/
//artifactory.example.com/artifactory/api/npm/npm-virtual/:_authToken=${ARTIFACTORY_TOKEN}

Install dependencies with npm 12 as usual. Artifactory transparently resolves through the virtual repo. To publish an internal package:

npm publish --registry https://artifactory.example.com/artifactory/api/npm/npm-local/

Frontend builds compiled with Vite 8.x on GitLab CI should use the same .npmrc in the pipeline. Commit a template file and inject the token from CI variables.

Composer and PHP 8.5 builds

Add a Composer repository block in composer.json or use a global auth.json:

{
  "repositories": [
    {
      "type": "composer",
      "url": "https://artifactory.example.com/artifactory/api/composer/composer-virtual"
    }
  ]
}

Run composer install on your Laravel 13 application. Artifactory proxies Packagist and caches dist files. For private packages, publish with:

curl -u "$USER:$TOKEN" -T my-package-1.0.0.zip \
  "https://artifactory.example.com/artifactory/composer-local/my-vendor/my-package/1.0.0/my-package-1.0.0.zip"

I've used this pattern on production Laravel applications where internal packages shared validation logic across legal-tech portals. One source of truth beats copying code between repos.

Docker images

Enable the Docker repository type. Login and push:

docker login artifactory.example.com
docker tag myapp:1.2.0 artifactory.example.com/docker-local/myapp:1.2.0
docker push artifactory.example.com/docker-local/myapp:1.2.0

Docker layer storage consumes disk quickly. Set retention policies on untagged manifests. The official JFrog Docker registry documentation covers cleanup rules and token-based login for CI.

How does Artifactory fit into CI/CD pipelines?

Artifactory belongs in the publish stage of your pipeline, not the compile stage. Build once, store the artifact, deploy the same binary everywhere. That principle matches Deployer 7 workflows I run on sister sites sharing GitLab CI infrastructure.

GitLab CI example

build-and-publish:
  stage: deploy
  script:
    - composer install --no-dev --optimize-autoloader
    - tar czf release-${CI_COMMIT_SHA}.tar.gz .
    - curl -u "$ARTIFACTORY_USER:$ARTIFACTORY_TOKEN" \
        -T release-${CI_COMMIT_SHA}.tar.gz \
        "https://artifactory.example.com/artifactory/generic-local/myapp/${CI_COMMIT_SHA}/release.tar.gz"
  artifacts:
    expire_in: 1 hour
    paths:
      - release-${CI_COMMIT_SHA}.tar.gz

Your deploy job downloads that tarball by commit SHA. Staging and production receive identical bytes. Rollback means pulling an older SHA from Artifactory, not rebuilding from source. Read adding AI code review to your CI pipeline for complementary quality gates that run before publish.

For container workflows, integrate with Kubernetes basics by pulling images from Artifactory's Docker virtual repo. Image pull secrets reference the same credentials CI uses to push.

Permissions and security

Create dedicated CI users with write access to local repos only. Developers get read on virtual repos and write on specific local repos for their team. Never grant admin to pipeline accounts. Rotate tokens quarterly. Store secrets in GitLab CI variables or your vault — not in the repo.

Artifactory supports Xray for vulnerability scanning on stored artifacts. For teams without Xray, run composer audit or npm audit in CI before publish. Combine both for defense in depth during testing and optimization phases.

How does Artifactory compare to Sonatype Nexus?

Both tools solve binary repository management. Your choice often comes down to existing team knowledge, licensing, and ecosystem fit rather than a clear technical winner.

Neither replaces the other in every scenario. I have maintained Nexus on one infrastructure stack and Artifactory on another. The operational patterns — local, remote, virtual repos and CI publish — transfer directly. Our companion article on artifact management with Nexus and Artifactory walks through side-by-side setup steps.

For PHP-heavy teams already running GitLab CI and Deployer on Ubuntu, Artifactory OSS or a small SaaS tier is usually enough. Java-heavy enterprises often already own Nexus licenses. Evaluate total cost including disk, backup, and admin time — not license price alone. Enterprise application development engagements often standardise on one tool across all client projects for consistency.

Common mistakes to avoid

• Pointing developers directly at remote repos instead of virtual repos.
• Storing CI tokens in Git history — use masked CI variables.
• Skipping disk monitoring until the server fills with Docker layers.
• Rebuilding from source for production instead of promoting stored artifacts.
• Granting admin rights to every developer for convenience.

Backup Artifactory's data directory alongside your MySQL 9.7 or PostgreSQL 18 databases. Artifact loss means you cannot reproduce production builds. Include Artifactory in the same backup rotation as application databases on support and maintenance contracts.

For infrastructure-as-code teams, the Artifactory REST API creates repos programmatically. Pair it with Ansible or the patterns in Puppet configuration management basics to rebuild a server from scratch. Document every repo name and retention policy in your runbook.

Legal-tech and eCommerce portals I have deployed — including sites like Court Marriage In Nepal and Quick And Easy Nepalese Grocery — rarely need Artifactory on day one. Add it when you publish shared packages or deploy Docker containers at scale. Premature tooling adds admin burden without return.

Key Takeaways

• Artifactory stores built artifacts — not source code — and caches upstream packages through remote repos.
• Always point build tools at virtual repos; put local repos first in resolution order.
• Publish from CI by commit SHA so staging and production run identical binaries.
• Create scoped CI service accounts with write access to local repos only.
• Monitor disk usage early, especially for Docker and npm caches.
• Start with Artifactory OSS on a VPS; upgrade when promotion workflows or scanning become requirements.

People Also Ask

Is JFrog Artifactory free?

Artifactory OSS is free and self-hosted with core repository features. JFrog Pro and cloud tiers add HA, replication, Xray scanning, and advanced permissions. Small PHP or Node teams often run OSS on a Rs 3,000–5,000/month VPS (~USD 22–37) without needing a paid license.

What is the difference between Artifactory and Docker Hub?

Docker Hub is a public registry for container images. Artifactory can proxy Docker Hub through a remote repo, cache your pulls locally, and host private images your team publishes. You control access, retention, and promotion — Docker Hub alone does not provide that for private enterprise workflows.

Can Artifactory work with Composer and Laravel?

Yes. Create Composer local, remote, and virtual repos in Artifactory. Point composer.json at the virtual URL and authenticate with an API token. Laravel 13 and PHP 8.5 projects install dependencies through Artifactory exactly as they would through Packagist, with the added benefit of cached dist files and private package hosting.

How much disk space does Artifactory need?

Plan 50 GB minimum for a small team using npm and Composer caching. Docker-heavy pipelines need 200 GB or more within months. Enable cleanup policies for snapshot and untagged Docker manifests. Monitor with standard Linux disk tools and alert at 80% capacity.

Build reliable pipelines with controlled artifacts

JFrog Artifactory basics come down to three repository types, one virtual URL for your tools, and a CI publish step that freezes each build by commit SHA. That foundation removes an entire category of "it worked yesterday" deployment failures. Start with Composer and npm virtual repos on a single Ubuntu box, wire GitLab CI to publish, and add Docker or Xray only when your team outgrows the simple setup. If you want help designing artifact storage alongside your Laravel or eCommerce deployment pipeline, contact us or review our web development services. For background on Kokil's DevOps work, see the about page and related guides on Tyk API management and hosting infrastructure.