ARTIFACTORY: How to Pull Docker Hardened Images (DHI) through JFrog Artifactory

Introduction 

Docker has introduced Docker Hardened Images (DHI), container images built with a minimal footprint and industry-standard security best practices to reduce the attack surface.
Starting December 17, 2025, Docker Hardened Images are free to use.

This article explains how to configure JFrog Artifactory to act as a remote (proxy) repository for Docker Hardened Images, enabling centralized caching, access control, and governance.
 

Resolution

To begin caching Docker Hardened Images (DHI), the first essential step is to create a remote repository within Artifactory. This repository will act as a proxy cache, connecting to the DHI registry to query, fetch and store images. This can be done via the following steps:

Step 1: Create a Remote Repository

Navigate to Administration → Repositories

```
Click New Remote Repository
```

Select OCI or Docker as the package type

Configure the repository with the following required settings:

Repository Key: A unique identifier, for example: org-oci-dhi-remote

```
URL: https://dhi.io
```

```
Authentication
```

User Name: Your Docker Hub username/ organization name

Password / Access Token: A Docker Hub Personal Access Token (PAT)

Best practice: Use a dedicated service account and PAT rather than a personal Docker Hub user
Note: Prior to Artifactory version 7.139.0, clicking the Test button may result in a false indication of unauthorized access

```
Click Create Remote Repository
```

 
Step 2: Pull Docker Hardened Images via Artifactory

After the repository is created, authenticate your Docker client and pull images through Artifactory.

Authenticate to Artifactory:
```
docker login <YOUR_ARTIFACTORY_DOMAIN>
```
Pull a Docker Hardened Image according to the organization’s configured docker method. For example:
```
docker pull my-org.artifactory.com/org-oci-dhi-remote/dart:3-alpine3.22
```


Usage and Quotas

Docker Hardened Images are accessed through an authenticated connection to Docker Hub. As a result, all pulls routed through this remote repository are counted against the quota of the Docker Hub organization or account used for authentication.