The JFrog CLI Docker image provides a containerized environment to interact with JFrog products. However, unlike standard OS installations, managing configurations in Docker requires specific attention to security.
1. Selecting the Right Image
JFrog provides two primary images for the CLI:
- Slim Image: Contains only the CLI. Use this for lightweight automation where extra tools aren't needed. docker pull releases-docker.jfrog.io/jfrog/jfrog-cli-v2-jf
- Full Image: Includes additional package managers (like npm, Maven, etc.).
docker pull releases-docker.jfrog.io/jfrog/jfrog-cli-full-v2-jf
2. Secure Configuration (Stateless Approach)
The most secure way to use the JFrog CLI in Docker is to keep the image stateless. Instead of configuring the server during the build process, inject credentials at runtime using environment variables.
Recommended: Using Environment Variables
You do not need to run jf c add. The CLI automatically detects the following environment variables:
- JF_URL: The URL of your Artifactory instance.
- JF_ACCESS_TOKEN: Your JFrog Access Token (Preferred).
- JF_USER and JF_PASSWORD: (Alternative to Access Token).
Example Command:
docker run --rm \
-e JF_URL=https://my-artifactory.local/ \
-e JF_ACCESS_TOKEN=your_secure_token \
releases-docker.jfrog.io/jfrog/jfrog-cli-v2-jf jf rt ping
Alternative: Mounting Host Configuration
If you have already configured the JFrog CLI on your host machine, you can mount your configuration directory into the container. This is ideal for local development.
docker run --rm \
-v ~/.jfrog:/root/.jfrog \
releases-docker.jfrog.io/jfrog/jfrog-cli-v2-jf jf rt ping
3. Building a Custom Image for Integrated Tools
If you need to run Docker commands (like jf docker scan or jf docker pull) from within the CLI container, you must build a custom image that includes the Docker binary—without including your credentials.
Secure Dockerfile Example:
FROM releases-docker.jfrog.io/jfrog/jfrog-cli-full-v2-jf AS base
# Install Docker CLI only (no credentials stored here)
USER root
RUN apt-get update && \
apt-get install -y docker.io && \
rm -rf /var/lib/apt/lists/*
USER jfrog
Build the image:
docker build . -t my-jfrog-cli-custom
4. Running Docker Commands Securely
To allow the container to interact with Docker, you must mount the Docker socket. Note that this gives the container significant privileges on the host.
Pulling and Scanning Images
Since we are not storing credentials in the image, you must pass your registry credentials or rely on the host's existing docker login.
# Pull an image through JFrog CLI
docker run -it --rm \
--net=host \
-v /var/run/docker.sock:/var/run/docker.sock \
-e JF_URL=[https://my-artifactory.local/](https://my-artifactory.local/) \
-e JF_ACCESS_TOKEN=your_token \
my-jfrog-cli-custom jf docker pull <registry>/<repo>/<image>:<tag>
# Scan an image
docker run -it --rm \
--net=host \
-v /var/run/docker.sock:/var/run/docker.sock \
-e JF_URL=[https://my-artifactory.local/](https://my-artifactory.local/) \
-e JF_ACCESS_TOKEN=your_token \
my-jfrog-cli-custom jf docker scan <registry>/<repo>/<image>:<tag>
Summary of Best Practices
- Avoid jf c add in Dockerfiles: It creates permanent, insecure layers containing secrets.
- Prefer Access Tokens: They are easier to rotate and more secure than username/password combinations.
- Use Runtime Injection: Pass credentials via environment variables (-e JF_ACCESS_TOKEN) or Secret Management systems (Kubernetes Secrets, HashiCorp Vault).
- Keep Images Generic: A single JFrog CLI image should be usable across Dev, Staging, and Production by simply changing the environment variables provided at runtime.