ARTIFACTORY: Setting Up Docker Subdomain Method with a Private Link for your SaaS Artifactory

Introduction 

Docker Subdomain
The Docker subdomain method allows you to configure a Docker registry, like Artifactory, so that each Docker repository has its own unique DNS hostname. Instead of using a single domain with paths, this method creates a subdomain for each repository.

For example, if your registry is at https://artifactory.jfrog.io and you have a repository named test-repo, you would access it via https://artifactory.test-repo.jfrog.io.

For example:

docker login http://artifactory.test-repo.jfrog.io

docker tag nginx:latest artifactory.test-repo.jfrog.io/nginx-custom/nginx:latest

docker push artifactory.test-repo.jfrog.io/nginx-custom/nginx:latest

Private Connections
To help JFrog customers who wish to reduce the security risks associated with exposing their JFrog SaaS instances via the public Internet, JFrog enables you to set up a PrivateLink connection using different providers. 

Establishing a private link connection enables a secure network connection, originating from your own cloud environment to your JFrog Cloud (SaaS) instance. Using a private connection acts like a private, secure tunnel that directly connects two VPC’s without ever stepping outside the cloud provider's network, ensuring your data travels safely and privately.
You can read more about it here: https://jfrog.com/help/r/myjfrog-portal/manage-privatelink-connections-in-myjfrog


Docker Subdomain + Private Connections
Combining the Docker sub-domain method with Private Links to Artifactory provides a secure, reliable, and scalable solution for managing Docker repositories. The sub-domain method assigns a unique hostname to each Docker repository, while Private Links keeps all traffic between clients and Artifactory within a private network, avoiding exposure to the public internet.


The article below will guide you through the following steps:

1. Configuring Docker Sub-Domain Method in Artifactory (via public internet)
2. Setting Up Private Link within your cloud provider
3. Combining the Sub-Domain Method with Private Link (Using Hosted Zones)
4. Adding in Custom Subdomains

In summary, there are 3 ways to set up using the Docker Subdomain method in an Artifactory SaaS instance, each option building on top of the previous by adding an extra layer of complexity: 

• Docker subdomain via the public internet
• Docker subdomain via a private Link (Requires extra DNS config in cloud provider)
• Docker subdomain via private Link with custom subdomain (Requires extra DNS config in cloud provider and Certificate configuration in MyJFrog Portal)

This can mainly be summarised in the diagram below for clarity:

 


Resolution
Configuring Docker Sub-Domain Method in Artifactory

1. Requesting Sub-Domain Method From JFrog Support
If you wish to use the Sub-Domain method, please email support@jfrog.com to get it enabled. It is essential to note that you cannot enable the repository path and subdomain method simultaneously.

2. Setting up Subdomains in Artifactory
To access a Docker repository via a subdomain, you first need to create the Docker repository in the Artifactory UI. Once this is done, some automatic jobs will be run on JFrog's side to ensure the nginx configuration is updated to handle the requests to this repository via the subdomain.

Therefore, if you create a repo called test-repo on an instance called artifactory.jfrog.io, you will be able to pull artifacts using the URL artifactory-test-repo.jfrog.io. If you convert to using a subdomain via support@jfrog.com, this will all be handled for you automatically!

docker login artifactory-test-repo.jfrog.io
Username: <username>
Password: <password>
Login Succeeded

docker pull artifactory-test-repo.jfrog.io/nginx-custom/nginx:latest
latest: Pulling from nginx-custom/nginx
5ba766340b3d: Pull complete 
5b219a92f92a: Pull complete 
ee3a09d2248a: Pull complete 
7382b41547b8: Pull complete 
9ee60c6c0558: Pull complete 
114e699da838: Pull complete 
5b5fa0b64d74: Pull complete 
Digest: sha256:460a7081b2a0e17940688563b294c03f326cd96dc43d768691f58abb50f7746f

Setting Up Private-Link
You can set up a private connectivity link using Azure, GCP, or AWS, allowing secure, private access without exposing traffic to the public internet. This can be achieved through each cloud provider’s native private networking capabilities, such as Azure Private Link, AWS PrivateLink, or GCP Private Service Connect. This is done to ensure secure and reliable communication between your services. 

For step-by-step guidance and configuration details, please refer to the documentation linked below: https://jfrog.com/help/r/myjfrog-portal/manage-privatelink-connections-in-myjfrog


Combining the Sub-Domain Method with Private Link through Hosted Zones
To use the Docker-subdomain method, or in fact any other form of artifact upload/download, through the private link, you will need to do so from a VM or a machine hosted in a VPC in the same region as your Artifactory SaaS instance.

Thus, the Architecture will look as follows:

 

However, once you wish to use a subdomain for the Docker Subdomain method, a few extra steps are necessary. We will aim for the following architecture:

 

1. At this point, you are currently accessing your Docker repositories using Docker subdomains (for example: <instance_name>-<repo_name>.jfrog.io). E.g. artifactory-test-repo.jfrog.io
2. If you want to access your Docker repositories via the subdomain method using the Private Link you will need to add DNS resolution to your Hosted Zone in AWS, GCP or Azure
3. When customers access their Artifactory SaaS instance, they use, for example, artifactory.jfrog.io. When using PrivateLink, all traffic stays within the cloud provider’s network. To make this possible, clients must connect using a special PrivateLink domain, for example: artifactory.pe.jfrog.io. This endpoint is automatically generated by JFrog when a private link is set up by the customer. Thus, you can use this endpoint to ensure traffic remains on the private backbone.
4. To ensure this PrivateLink domain works correctly, you need to configure DNS so that requests to this domain are routed to your PrivateLink endpoint using a private DNS zone. What makes it “private” is that it is not publicly accessible; only systems connected to your VPC can resolve names in it, and external users on the internet cannot see or use it.
5. To do this, you need to take the following steps:
   1. Create a Private DNS zone for: *pe.jfrog.io
   2. Add a CNAME record that points: CNAME -> artifactory.pe.jfrog.io. All traffic directed via artifactory.pe.jfrog.io will now go via the private link.

Adding in Custom Domain Names

1. If you want to access your Docker repositories using custom Docker subdomains (for example: <docker-repo-name>.artifactory.instance.com), a small additional DNS setup is required to make this work with PrivateLink within the cloud provider and MyJFrog Portal.
2. Create a private hosted zone for artifactory.instance.com in your cloud provider (AWS Route 53, Azure Private DNS, or GCP Cloud DNS).
3. Specifically, we need to create a Wildcard CNAME record that redirects all Docker subdomains (for example: *.artifactory.instance.com) to the PrivateLink DNS endpoint. 
4. This DNS change ensures that every Docker repository, regardless of its name, can still be accessed using the same familiar format: <repository-name>.artifactory.instance.com, but now over a private, secure network connection instead of the public internet. A private hosted zone is needed because, without it, DNS queries for *.artifactory.instance.com would be sent to the public internet and would never reach the PrivateLink endpoint. By creating a private hosted zone, you provide a private “phone book” inside your cloud network that directs all repository requests to the private endpoint rather than the public IP, ensuring that traffic stays secure and within the cloud provider’s network.
5. Because this setup uses multiple subdomains, you will also need to upload a wildcard TLS/SSL certificate (for example: *.artifactory.instance.com) to the MyJFrog Portal for the Artifactory SaaS instance to trust all the Docker subdomains. This certificate allows secure HTTPS access for all repository subdomains without requiring a separate certificate for each one.

To do step 5 as mentioned above, you will need to log in to MyJFrog Portal and set up custom domain names as follows:

1. In http://my.jfrog.com → Settings → Custom Domain Name Management
2. Click on “Create New” and add the certificate details. The Certificate should have both <custom_domain>.com and *<custom_domain>.com Subject Alternate Name (SAN).
3. After adding the SSL certificate, add the Docker subdomain (See example below). This should then be added to the DNS Zone from step 2.