Overview

Aqua is enhancing the JFrog Artifactory registry integration to provide better awareness of Artifactory repository types and improve how Aqua discovers, scans, and manages images stored in Artifactory.

This enhancement is available as part of the U14 release.

What is changing

Today, Aqua treats all Artifactory repositories the same regardless of whether they are configured as Local, Remote, or Virtual repositories. This can lead to unnecessary registry activity, duplicate image registration, and a less efficient user experience.

This enhancement introduces:

Repository-type awareness

  • Detect and differentiate between Local, Remote, and Virtual Artifactory repositories during registry integration
  • Apply repository-specific handling during discovery and AutoPull operations

Remote repository controls

  • Configurable options to ignore or limit AutoPull scanning for Remote repositories
  • Prevent unintended upstream image pulls from external registries during automated discovery and scanning workflows

Enhanced image search

  • Search using partial repository names and image names
  • Improved image discovery and onboarding experience within the UI

Registry statistics preservation

  • Optional configuration to prevent Aqua scan and AutoPull operations from updating Artifactory download statistics
  • Helps preserve the accuracy of Artifactory usage metrics and retention policies

Repository behavior summary

Artifactory repo type

Scan toggle

Discovery method

Expected behavior

LOCAL

N/A

Docker _catalog / tags/list

Unchanged — all local repositories will be served

REMOTE

Skip Remote Repositories=true

None

Remote repositories will be skipped

REMOTE

Skip Remote Repositories=false

AQL on <repoKey>-cache

Cached artifacts only

VIRTUAL

Skip Virtual Repositories=true

None

Virtual repositories will be skipped

VIRTUAL

Skip Virtual Repositories=false

AQL on <repoKey>

Indexed/virtual cached artifacts only

Feature limitations

  • Virtual vs local deduplication: digest-based dedup between virtual and local repos is not in this release

Behavioral change: name/tag criteria

There is a behavioral change in how name/tag criteria is applied to repositories. Customers who wish to apply name/tag criteria before "Latest X tags based on creation date" should enable feature flag SLK-129207. The current flow remains the default; only customers who choose to change this behavior need to apply the feature flag explicitly.

Why this change is being made

Many enterprise customers use JFrog Artifactory as their primary container registry. The current integration model can create operational challenges:

  • Remote repository scans may unintentionally trigger image downloads from upstream registries
  • Image search requires full repository paths, making discovery unnecessarily difficult
  • Scan operations may update Artifactory download statistics, affecting retention policies and usage reporting

These enhancements improve operational efficiency, inventory accuracy, reporting consistency, and the overall registry management experience.

Customer impact

This enhancement improves existing Artifactory integration functionality and does not require changes to current workflows unless customers choose to leverage the new capabilities.

Customers using Artifactory will benefit from:

  • Reduced unnecessary image pulls from upstream registries
  • Better control over AutoPull behavior for Remote repositories
  • Improved inventory accuracy and compliance visibility
  • Enhanced image discovery through partial-name search capabilities

Scanner upgrade to U14 is required.

Required customer action

To take advantage of these enhancements, customers should:

  • Upgrade to the release containing the updated Artifactory integration
  • Upgrade all scanners to the U14 release version
  • Review existing Artifactory registry integrations and repository configurations
  • Evaluate whether Remote repositories should participate in AutoPull workflows
  • Configure the new Remote repository AutoPull controls according to organizational requirements
  • Enable feature flag SLK-129207 only if name/tag criteria should be applied before "Latest X tags based on creation date"

Frequently Asked Questions

Q: Will my existing Artifactory integration stop working?

A: No. Existing integrations continue to function. The enhancement adds repository-type awareness and new configuration options.

Q: Should I enable AutoPull for Remote repositories?

A: Review your repository architecture. Remote repository controls allow you to skip or limit AutoPull to prevent unintended upstream pulls.

Q: What is feature flag SLK-129207?

A: Enable this flag only if you want name/tag criteria applied before "Latest X tags based on creation date." The default behavior is unchanged.

Q: Are virtual and local images deduplicated?

A: Digest-based deduplication between virtual and local repositories is not included in this release.