Overview

By configuring Artifactory as a remote repository proxy for Root's registry, you can:

• Access Root's vulnerability-remediated images through your standard Artifactory workflows
• Cache images locally for faster subsequent pulls
• Apply your organization's access controls and policies
• Maintain a single source of truth for all container images

Prerequisites

• JFrog Artifactory Pro, Enterprise, or Cloud instance with admin access
• A Root Container Registry account and access token
• Docker client configured to authenticate with your Artifactory instance

Setup Instructions

Step 1: Create a Remote Docker Repository

1. Log into your JFrog Platform UI
2. Navigate to Administration → Repositories → Repositories
3. Click + Add Repositories → Remote Repository
4. Select Docker as the package type

Step 2: Configure Repository Settings

Configure the following settings in the Basic tab:

Under Credentials, enter:

Step 3: Configure Advanced Settings (Recommended)

In the Advanced tab, consider these settings:

Click Create Remote Repository to save.

Step 4: Test the Configuration

Verify the repository is working by navigating to Application → Artifactory → Artifacts, selecting your root-containers repository, and browsing the available images.

Pulling Images

Once configured, pull Root's remediated images through your Artifactory instance.

Direct Pull

# Authenticate with your Artifactory instance
docker login <your-instance>.jfrog.io

# Pull a remediated image through Artifactory
docker pull <your-instance>.jfrog.io/root-containers/<image>:<tag>

Example

If you previously pulled an image directly from Root:

docker pull cr.root.io/library/nginx:1.25-patched

You would now pull it through Artifactory:

docker pull mycompany.jfrog.io/root-containers/library/nginx:1.25-patched

Optional: Virtual Repository Setup

If your organization uses multiple container registries, you can create a Virtual Repository to aggregate them behind a single URL.

Create a Virtual Repository

1. Navigate to Administration → Repositories → Repositories
2. Click + Add Repositories → Virtual Repository
3. Select Docker as the package type
4. Configure:

Pull Through Virtual Repository

Artifactory will resolve the image from the appropriate underlying repository.

docker pull <your-instance>.jfrog.io/docker-virtual/library/nginx:1.25-patched

Kubernetes Integration

To use Root images through Artifactory in Kubernetes, update your image references and ensure your cluster has appropriate pull credentials.

Update Image References

# Before (direct from Root)
spec:
  containers:
    - name: app
      image: cr.root.io/library/nginx:1.25-patched

# After (through Artifactory)
spec:
  containers:
    - name: app
      image: mycompany.jfrog.io/root-containers/library/nginx:1.25-patched

Create Image Pull Secret

kubectl create secret docker-registry artifactory-pull-secret \
  --docker-server=<your-instance>.jfrog.io \
  --docker-username=<artifactory-username> \
  --docker-password=<artifactory-token> \
  --namespace=<your-namespace>

Reference the secret in your deployment:

spec:
  imagePullSecrets:
    - name: artifactory-pull-secret

Troubleshooting

Authentication Errors

If you receive 401 Unauthorized errors when pulling images:

1. Verify your Root access token is valid and correctly entered in the remote repository credentials
2. Ensure the token has not expired
3. Test direct access to cr.root.io with the same credentials to isolate whether the issue is with Root or Artifactory

Images Not Found

If images appear to be missing:

1. Check that the image path matches exactly (Root's registry structure may differ from Docker Hub)
2. Verify the remote repository URL is https://cr.root.io (not http://)
3. Check Artifactory's remote repository logs for upstream errors

Slow Initial Pulls

The first pull of an image will be slower as Artifactory fetches it from Root's registry. Subsequent pulls will be served from Artifactory's cache. To pre-populate the cache, consider using Artifactory's Replication feature.

Support

• For issues with your Root account or access tokens, contact [email protected]
• For Artifactory configuration issues, refer to JFrog's documentation or contact JFrog support