Skip to main content
Configure JFrog Artifactory as a pull-through cache for cr.root.io. This lets teams pull Root-secured images through their existing Artifactory instance — applying organizational access controls, enabling local caching, and maintaining a single source of truth for container images.

​
Prerequisites

  • JFrog Artifactory Pro, Enterprise, or Cloud instance with admin access
  • A Root Container Registry account and access token
  • Docker client configured to authenticate with your Artifactory instance

​
Step 1: Create a Remote Docker Repository

  1. Log into your JFrog Platform UI
  2. Navigate to Administration → Repositories → Repositories
  3. Click + Add Repositories → Remote Repository
  4. Select Docker as the package type

​
Step 2: Configure Repository Settings

In the Basic tab:
FieldValue
Repository Keyroot-containers
URLhttps://cr.root.io
Under Credentials:
FieldValue
Usernameroot
PasswordYour Root access token
In the Advanced tab:
SettingRecommended ValueDescription
Store Artifacts LocallyEnabledCaches pulled images in Artifactory
Retrieval Cache Period7200 secondsHow long to cache metadata before rechecking upstream
Missed Retrieval Cache Period1800 secondsHow long to cache “not found” responses
Block Mismatching MIME TypesEnabledSecurity best practice
Click Create Remote Repository to save.

​
Step 4: Test the Configuration

Navigate to Application → Artifactory → Artifacts, select your root-containers repository, and browse available images to confirm connectivity.

​
Pulling Images Through Artifactory

# Authenticate with Artifactory
docker login your-instance.jfrog.io

# Pull a Root image through Artifactory
docker pull your-instance.jfrog.io/root-containers/python:3.12
Compare to pulling directly from Root: 
# Direct from Root
docker pull cr.root.io/python:3.12

# Through Artifactory
docker pull your-instance.jfrog.io/root-containers/python:3.12
The image contents are identical. Artifactory caches the layers after the first pull.

​
Optional: Virtual Repository

To aggregate Root images with other container registries behind a single URL:
  1. Navigate to Administration → Repositories → Repositories
  2. Click + Add Repositories → Virtual Repository
  3. Select Docker as the package type
  4. Configure:
FieldValue
Repository Keydocker-virtual
RepositoriesSelect root-containers and any other Docker repositories
Default Deployment RepositoryYour local Docker repository
Teams then pull from a single virtual registry: 
docker pull your-instance.jfrog.io/docker-virtual/python:3.12

​
Kubernetes Integration

Update image references in your manifests: 
# Before (direct from Root)
spec:
  containers:
    - name: app
      image: cr.root.io/python:3.12

# After (through Artifactory)
spec:
  containers:
    - name: app
      image: your-instance.jfrog.io/root-containers/python:3.12
Create an ImagePullSecret for your Artifactory instance: 
kubectl create secret docker-registry artifactory-pull-secret \
  --docker-server=your-instance.jfrog.io \
  --docker-username=your-artifactory-username \
  --docker-password=your-artifactory-token \
  --namespace=your-namespace
Reference it in your deployments: 
spec:
  imagePullSecrets:
    - name: artifactory-pull-secret

​
Troubleshooting

IssueSolution
401 UnauthorizedVerify Root access token is valid and correctly entered in Artifactory credentials
Images not foundCheck that the image path matches exactly; verify remote repository URL is https://cr.root.io
Slow initial pullsFirst pull fetches from Root and caches in Artifactory; subsequent pulls are served locally
Stale imagesReduce Retrieval Cache Period if you need Root Patches to propagate faster
For Root credential issues: support@root.io For Artifactory configuration issues: refer to JFrog documentation