ARTIFACTORY: How to search the docker blob only under the same image

Introduction 

By default, when we try to HEAD a blob, Artifactory will check for the blob under all the allowed repositories. This means if you HEAD a blob under a non-existent image(the image had been deleted), it will also return 200 when the blob is also under other existent images. Then, when you try to GET the blob, it will return 404 since the image which the blob should be under is not existent.
This behaviour will cause client confusion about why HEAD a blob returns 200 but GET it will return 404, and then return an error.
The problem snippet:

yanxiuw@yanxiuw-mac ~ % curl -u '$user:$password' -I http://localhost:9082/artifactory/api/docker/yan-docker-local/v2/yan/blobs/sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606
HTTP/1.1 200 OK
yanxiuw@yanxiuw-mac ~ % curl -u '$user:$password' -GET http://localhost:9082/artifactory/api/docker/yan-docker-local/v2/yan/blobs/sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606
{"errors":[{"code":"BLOB_UNKNOWN","message":"blob unknown to registry","detail":{"blobSum":"sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606"}}]}

Note: The yan image in http://localhost:9082/artifactory/api/docker/yan-docker-local/v2/yan/blobs/sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606 is a non-existent image


Resolution 

The Artifactory has a system property artifactory.docker.enforce.search.for.blob.under.image to disable this behaviour. Setting this property to be true allows searching the Docker blob only under the same image. (The default value of the property is false.)

We can set this property to be true, artifactory.docker.enforce.search.for.blob.under.image=true in $JFROG_HOME/artifactory/etc/artifactory/artifactory.system.properties and then restart the artifactory.
The expected snippet:

yanxiuw@yanxiuw-mac ~ % curl -u '$user:$password' -I http://localhost:9082/artifactory/api/docker/yan-docker-local/v2/yan/blobs/sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606
HTTP/1.1 404 Not Found
yanxiuw@yanxiuw-mac ~ % curl -u '$user:$password' -GET http://localhost:9082/artifactory/api/docker/yan-docker-local/v2/yan/blobs/sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606
{"errors":[{"code":"BLOB_UNKNOWN","message":"blob unknown to registry","detail":{"blobSum":"sha256:6e174226ea690ced550e5641249a412cdbefd2d09871f3e64ab52137a54ba606"}}]}

Please be aware that this property only works after Artifactory 7.127.0, and enabling this flag would have performance and cost consequences.


Conclusion 

After enabling the property by setting artifactory.docker.enforce.search.for.blob.under.image=true, we can search the Docker blob only under the same image.