Virtual Repositories

JFrog Artifactory Documentation



To simplify access to different repositories, Artifactory allows you to define a virtual repository which is a collection of local, remote and other virtual repositories accessed through a single logical URL.

A virtual repository hides the access details of the underlying repositories letting users work with a single, well-known URL. The underlying participating repositories and their access rules may be changed without requiring any client-side changes.

Basic Settings

The following are fully described in the Common Settings section.

  • Package Type

  • Repository Key

  • Repository Layout

  • Public Description

  • Internal Description

  • Includes and Excludes Pattern


In addition, in the Repositories section of the Basic settings screen you select the Available Repositories you want to include in the new virtual repository and move them to the Selected Repositories list.

This list can be re-ordered by dragging and dropping within the Selected Repositories list.


The Included Repositories section displays the effective list of actual repositories included in this virtual repository. If any of the available repositories you have selected are themselves virtual repositories, then the Included Repositories section will display the local and remote repositories included within them. The Included Repository list is automatically updated in case any of the nested virtual repositories change.


The search/resolution order when requesting artifacts from a virtual repository is always:

  1. Local repositories

  2. Remote repository caches

  3. Remote repositories themselves.

The order within these categories is controlled by the order they are presented in the Selected Repositories list.

When fulfilling a request for the latest version of an artifact from a virtual repository, Artifactory will search all the included repositories to ensure it retrieves the latest version. This means that Artifactory will still search the remote repository even if it finds a version of the artifact in a local or cache repository, to be certain of returning the most current one. If the remote repository is found to have the latest version, Artifactory will download it and update the remote repository cache.


Nesting is a unique feature in Artifactory and facilitates more flexibility in using virtual repositories.


You should take care not to create an "infinite loop" of nested repositories. Artifactory analyzes the internal composition of virtual repositories and will issue a warning if the virtual repository can not be resolved due to invalid nesting.

Using Includes and Excludes Patterns

The ability to define and Includes Pattern and an Excludes Pattern for virtual repositories (especially when nesting is used) provides a powerful tool you can use to manage artifact requests in your organization.

For example, your organization may have its own artifacts which are hosted both internally in a local repository, but also in a remote repository. For optimal performance, you would want these artifacts to be accessed from the local repository rather than from the remote one. To enforce this policy, you can define a virtual repository called "remote-repos" which includes the full set of remote repositories accessed by your organization, and then specify an Excludes Pattern with your organization's groupID. in this way, any attempt to access your internal artifact from a remote repository would be rejected. To learn more, see Avoiding Security Risks with an Exclude Pattern.

Consider another example in which you wish to define a virtual repository for your developers, however you wish to keep certain artifacts hidden from them. This could be achieved by defining an Excludes Pattern based on groupId, source or version.

Deploying to a Virtual Repository

Artifactory supports deploying artifacts to a virtual repository. For example you can now use docker push, npm publish, NuGet push, gem push Artifactory's REST API and more to deploy packages to a virtual repository.

For more details, please refer to Deploying Artifacts.


Advanced Settings




Artifactory Requests Can Retrieve Remote Artifacts

An Artifactory instance may request artifacts from a virtual repository in another Artifactory instance. This checkbox specifies whether the virtual repository should search through remote repositories when trying to resolve an artifact requested by another Artifactory instance. For example, you can use this feature when Artifactory is deployed in a mesh (grid) architecture, and you do not want all remote instances of Artifactory to act as proxies for other Artifactory instances.

Maven, Gradle, Ivy and SBT Repositories

In addition to the above checkbox, these repository types offer the following Advanced settings:



Cleanup Repository References in POMs

Public POMs may include direct references to external repositories. If either of the below code samples are present in the POM, Maven dynamically adds an external repository URL to the build which circumvents Artifactory.


A client side solution for this is to use mirrorOf. For details please refer to Additional "Mirror-any" Setup.

This setting gives you the ability to ensure Artifactory is the sole provider of Artifacts in your system by automatically cleaning up the POM file. The three values available for this setting are:



Discard Active References

Removes repository elements that are declared directly under project or under a profile in the same POM that is activeByDefault

Discard Any References

Removes all repository elements regardless of whether they are included in an active profile or not


Does not remove any repository elements declared in the POM

Key Pair

A named key-pair to use for automatically signing artifacts.

Please refer to WebStart and Jar Signing.