Overview
When running JFrog Artifactory in a containerized environment (e.g., Docker or Docker Compose), the deployment relies on two distinct container images: Artifactory Pro and NGINX. This setup provides a built-in NGINX reverse proxy out of the box.
To keep the reverse proxy configuration up to date automatically, Artifactory uses a non-interactive service account called _internal to execute an automated NGINX configuration synchronization process.
What is the _internal User Account?
The _internal account is a system-level service account embedded within Artifactory.
-
Non-Interactive: The _internal account cannot log in through the Artifactory Web UI.
-
Purpose-Built Authentication: It is used exclusively by the NGINX container to authenticate requests when pulling reverse proxy configuration updates from the Artifactory application layer.
-
Enhanced Security: Using _internal eliminates the security risk of storing or passing administrative credentials (admin) in the container environment for configuration synchronization.
How the NGINX Auto-Sync Process Works
Unlike traditional scheduled tasks, the auto-sync process is not managed by a cron job. Instead, it runs continuously as a foreground shell loop initialized as part of the primary process inside the NGINX container.
Whenever an administrator or user modifies NGINX settings within Artifactory, the update workflow executes through the following steps:
Initialization: On container startup, the shell script initializes the communication settings required for NGINX to connect to the Artifactory application.
Periodic Retrieval: At regular intervals, the loop sends authenticated requests using the _internal account to check for and download the latest NGINX reverse proxy configuration from Artifactory.
Configuration Comparison: The process compares the newly retrieved configuration against the currently active configuration file inside the NGINX container.
Graceful Reload: If differences are detected:
Automatic Fallback (Rollback): If an error or syntax failure occurs while applying the new configuration, the process automatically restores the last known working configuration to maintain high availability and system stability.