cloudparts

JFrog Artifactory

The commercial universal repository manager: one server, or JFrog’s SaaS, that hosts, proxies and promotes artifacts for more than 60 package types, from Maven and npm to Docker images and Hugging Face models.

What it is
Artifact registries
Used for
Package managers
Type
Commercial product
Made by
JFrog Ltd.
License
Proprietary (a free Artifactory OSS edition covers Java artifacts)
Facts checked
24 October 2026
Website

What it is

Artifactory stores the binaries a company builds and the ones it downloads, and package managers and Docker talk to it in their own protocols. JFrog lists more than 60 artifact types, including Maven, npm, PyPI, Docker, Helm, NuGet, Debian, RPM and Terraform, and it now also proxies Hugging Face and NVIDIA NGC models and stores in-house models. It runs as JFrog’s SaaS on AWS, Azure and Google Cloud regions, or self-managed, including high-availability clusters.

Repositories come in four kinds. Local repositories hold what your organization uploads. Remote repositories are caching proxies: artifacts are “only fetched (pulled) and stored (cached) on demand”, and changing metadata such as maven-metadata.xml or a Docker manifest is rechecked after the metadata retrieval cache period, two hours by default for most types and six for Docker, OCI and Helm OCI. Virtual repositories aggregate any number of local and remote ones behind one URL and always search local repositories first, then remote caches, then the remote repositories themselves. Federated repositories keep their contents in sync with matching repositories at other sites.

Storage is by checksum: each binary is renamed to its checksum and stored once, while the database maps checksums to repository paths, so copying, moving and promoting are database operations and identical files take no extra space. Around Artifactory, JFrog sells Xray for scanning and software composition analysis, Curation for blocking packages before they enter, and Release Lifecycle Management, where a signed release bundle is promoted from one environment to the next with jf release-bundle-promote.

Why teams pick it

  • Covers almost every ecosystem a large company uses in one product with one permission model, including system packages and AI models
  • Its local, remote and virtual repository model, with deterministic resolution order, became the pattern most other registries copy
  • Checksum-based storage deduplicates binaries and makes promotion between repositories cheap
  • Available as SaaS on all three big clouds or self-managed with high availability and multi-site federation

Watch out for

  • Proprietary and priced per edition; the free OSS edition is aimed at Java artifacts, and scanning, curation and release bundles are separate paid products
  • A large system to run yourself, and a high-value target: in September 2026 CISA listed an Artifactory vulnerability (CVE-2026-82329) as exploited in the wild
  • Remote repositories can serve stale metadata until the cache period expires, so a just-published upstream version may not be visible at once
  • Backups re-expand deduplicated files into every path that references them, so they can be much larger than the filestore

Alternatives

What all artifact registries have in common →Compare side by side →
Sonatype Nexus RepositoryCommercialSonatype’s repository manager, born from Maven: proxy, hosted and group repositories for Maven, npm, PyPI, Docker and more, in a free Community Edition capped by usage or a paid Pro edition.Artifact KeeperOpen sourceA self-hosted artifact registry written in Rust that speaks the protocols of more than 45 package formats, with proxying, promotion, retention rules and vulnerability scanning all in one MIT-licensed release.

How it fits with other technologies

Promote a signed release bundle to production with the JFrog CLI · bash

# A release bundle groups the artifacts of a build; promoting it
# copies them into the target environment's repositories
jf release-bundle-promote my-app 1.4.0 PROD \
  --signing-key=release-key

See it in a real stack

No architecture uses JFrog Artifactory yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2006–2026

In 2006 Yoav Landman was a consultant who had moved “a couple of large client projects from Ant to Maven 2” and was “frustrated by the absence of good options to manage dependencies and hosting artifacts in house”. A Codehaus outage that cut clients off from artifacts they depended on for days was “the final straw”, and he started Artifactory as an open-source project. “The quick adoption of Artifactory lead me to create JFrog around it,” he said; JFrog dates its start to 2008.

JFrog grew from Maven repositories into a platform for every package type, and ran public repositories itself: Bintray, JCenter, GoCenter and ChartCenter. It shut Bintray down on May 1, 2021, saying many of its services were now served by the JFrog Platform; GoCenter, kept read-only for years, finally shut down on February 2, 2026. JFrog went public on the Nasdaq as FROG on September 16, 2020, at $44 a share, describing itself as “the liquid software company”.

Since then Artifactory has added federated repositories for multi-site setups and Release Lifecycle Management with signed release bundles (from Artifactory 7.63.2), and has extended its formats to machine-learning models and agent packages.

Why it’s built this way

Proxy remote repositories on demand
Landman’s trigger was a public repository outage. Caching each artifact the first time a build asks for it keeps builds working when upstream fails, without mirroring the whole of Maven Central.
Virtual repositories with a fixed order
Build tools configured with several repositories resolve unpredictably. One URL that searches local, then cached, then remote repositories gives every build the same answer.
Store binaries by checksum
Artifacts are copied and moved between repositories on every promotion. Keeping one file per checksum and treating copies as database rows saves space and makes those operations fast.

Timeline

  1. 2006

    Yoav Landman starts Artifactory as an open-source project

  2. 2008

    JFrog is founded around Artifactory

  3. 2020

    JFrog lists on the Nasdaq as FROG (September 16)

  4. 2021

    Bintray is shut down (May 1)

  5. 2026

    GoCenter’s final shutdown (February 2); CISA lists an exploited Artifactory CVE (September)

Sources9 · facts checked 24 October 2026

Improve this page on GitHub