Use Advanced Docker Operations with Artifactory CLI

Advanced Docker operations using JFrog CLI's Artifactory commands (jf rt). These commands are separate from the main jf docker command and provide integration with alternative container tools (Podman, Kaniko, buildx, OpenShift) and Docker image lifecycle management (build-docker-create, docker-promote).

This topic covers the following tasks:

• Pull Docker images using Podman
• Push Docker images using Podman
• Push Docker images using Kaniko
• Push Docker images using buildx
• Push Docker images using OpenShift CLI
• Add published Docker images to the build-info
• Promote Docker images

Prerequisites

Before running any commands on this page, ensure the following are in place.

To prepare your environment:

1. JFrog CLI configured — run jf config add and verify with jf config show.
2. Docker repositories exist — the source and target repositories must already exist in your Artifactory instance.
3. Podman installed — required for podman-pull and podman-push commands.
   • On macOS, Podman requires a running VM: podman machine init && podman machine start
   • Verify: podman --version
4. Podman authenticated to your registry — the CLI automatically attempts podman login before pull/push. Pre-authenticate to avoid failures:
   Bash

   podman login <your-registry>

   If your Artifactory server is configured with a reference token (non-JWT), Podman requires explicit username credentials. Use the --user flag on podman-pull and podman-push, or pre-login manually:
   Bash

   podman login <your-registry> --username <artifactory-username> --password <access-token>

5. jf docker integration — If you also use jf docker (native Docker client flows), see Environment variables on that page for JFROG_CLI_CONTAINER_MANAGER and JFROG_CLI_SKIP_DOCKER_IMAGE_ID_VERIFICATION.

Pull Docker Images Using Podman

Podman is a daemon-less container engine for developing, managing, and running OCI Containers. The podman-pull command pulls docker images from Artifactory using Podman, while collecting build-info.

To pull Docker images using Podman:

1. Ensure Prerequisites are met and your image tag uses the form <registry>/<repo-path>/<image>:<tag>.
2. Run jf rt podman-pull with the image tag, source repository, and optional build-info flags (see Example).

Example

jf rt podman-pull <registry>/<repo-path>/<image>:<tag> <source-repo> --build-name <build-name> --build-number <build-number>

Where:

• <registry> is your Artifactory Docker registry (for example, my-docker-registry.io)
• <repo-path> is the repository sub-path within the registry (for example, my-repo)
• <image>:<tag> is the Docker image name and tag (for example, my-docker-image:latest)
• <source-repo> is the source repository in Artifactory (for example, docker-local)

For example:

jf rt podman-pull my-docker-registry.io/my-repo/my-docker-image:latest docker-local --build-name my-build-name --build-number 7

Expected output

On success, the command prints the pulled image layers and build-info collection status:

[Info] Pulling image: my-docker-registry.io/my-repo/my-docker-image:latest
[Info] Build info successfully collected for build my-build-name/7

Push Docker Images Using Podman

After building your image, the podman-push command pushes the image layers to Artifactory, while collecting build-info.

To push Docker images using Podman:

1. Ensure Prerequisites are met and your image tag uses the form <registry>/<repo-path>/<image>:<tag>.
2. Run jf rt podman-push with the image tag, target repository, and optional build-info flags (see Example).

Example

jf rt podman-push <registry>/<repo-path>/<image>:<tag> <target-repo> --build-name <build-name> --build-number <build-number>

Where:

• <registry> is your Artifactory Docker registry (for example, my-docker-registry.io)
• <repo-path> is the repository sub-path within the registry (for example, my-repo)
• <image>:<tag> is the Docker image name and tag (for example, my-docker-image:latest)
• <target-repo> is the target repository in Artifactory (for example, docker-local)

For example:

jf rt podman-push my-docker-registry.io/my-repo/my-docker-image:latest docker-local --build-name my-build-name --build-number 7

Expected output

On success, the command prints the pushed image layers and build-info collection status:

[Info] Pushing image: my-docker-registry.io/my-repo/my-docker-image:latest
[Info] Build info successfully collected for build my-build-name/7

Push Docker Images Using Kaniko

JFrog CLI allows pushing containers to Artifactory using Kaniko, while collecting build-info and storing it in Artifactory.

The Kaniko workflow uses the jf rt build-docker-create command (jf rt bdc) to attach the already-built and pushed image to the build-info after Kaniko completes the push.

To push Docker images using Kaniko:

1. Run Kaniko to build and push the image to Artifactory, capturing the image digest.

2. Write the image reference to a file in the format <IMAGE-TAG>@sha256:<MANIFEST-SHA256>.

3. Run jf rt bdc to add the image to the build-info:

   Bash

   jf rt bdc <target-repo> --image-file <path-to-image-file> --build-name <build-name> --build-number <build-number>

4. Publish the build-info with jf rt build-publish.

For a complete setup including the Kaniko container configuration and Dockerfile, refer to the Kaniko project example on GitHub.

Push Docker Images Using buildx

JFrog CLI allows pushing containers to Artifactory using buildx, while collecting build-info and storing it in Artifactory.

The buildx workflow uses docker buildx build --push to build and push a multi-platform (fat manifest) image to Artifactory, then attaches it to the build-info using jf rt bdc.

To push Docker images using buildx:

1. Run docker buildx build --push targeting your Artifactory registry, capturing the image digest.

2. Write the image reference to a file in the format <IMAGE-TAG>@sha256:<MANIFEST-SHA256>.

3. Run jf rt bdc to add the image to the build-info:

   Bash

   jf rt bdc <target-repo> --image-file <path-to-image-file> --build-name <build-name> --build-number <build-number>

4. Publish the build-info with jf rt build-publish.

For a complete setup including multi-platform build configuration, refer to the buildx project example on GitHub.

Push Docker Images Using the OpenShift CLI

JFrog CLI allows pushing containers to Artifactory using the OpenShift CLI, while collecting build-info and storing it in Artifactory.

The jf rt oc start-build command (abbreviation jf rt osb) wraps OpenShift's native build system. It runs oc start-build on your behalf and then reads the resulting image tag and digest directly from OpenShift to add them to the build-info — no separate jf rt bdc step is required.

To push Docker images using the OpenShift CLI:

1. Configure your OpenShift BuildConfig to push to your Artifactory Docker registry.

2. Ensure the OpenShift CLI (oc), version 3.0.0 or higher, is installed and authenticated to the cluster.

3. Run jf rt oc start-build with the build config name and target repository:

   Bash

   jf rt oc start-build <build-config-name> --repo <target-repo> --build-name <build-name> --build-number <build-number>

   Parameter	Description
   Command-name	rt oc start-build
   Abbreviation	rt osb
   --repo	[Mandatory] The name of the repository to which the image was pushed
   --server-id	[Optional] Server ID configured using jf config
   --build-name	[Optional] Build name
   --build-number	[Optional] Build number
   --project	[Optional] JFrog project key
   --module	[Optional] Module name for build-info
   Build config name	The OpenShift BuildConfig name to trigger (or --from-build=<build name> to reuse an existing build)

   The -w/--wait, --template, and -o/--output oc options are not supported, since jf rt oc start-build manages waiting for build completion and reads the result itself. Only the start-build subcommand of oc is supported.

4. Publish the build-info with jf rt build-publish.

For a complete setup including the OpenShift BuildConfig and pipeline integration, refer to the OpenShift build project example on GitHub.

Add Published Docker Images to the Build-Info

The build-docker-create command allows adding a docker image that is already published to Artifactory into the build-info.

To add a published Docker image to the build-info:

1. Write the image reference (including digest) to a file (see Example).
2. Run jf rt bdc with the target repository, --image-file, and optional build-info flags.

If your Docker image has multiple tags pointing to the same digest, provide them in comma-separated format in the --image-file.

Example

Create the image file first:

echo "<registry>/<repo-path>/<image>:<tag>@sha256:<manifest-sha256>" > image-file-details.txt

Then run:

jf rt bdc docker-local --image-file image-file-details.txt --build-name myBuild --build-number 1

Expected output

On success:

[Info] Build info successfully created

Promote Docker Images

The docker-promote command moves or copies a Docker image from one repository to another in Artifactory.

To promote a Docker image between repositories:

1. Identify the source image name, source repository, and target repository in Artifactory.
2. Run jf rt docker-promote (or jf rt dpr) with those arguments and optional flags (see Example).

Example

jf rt docker-promote hello-world docker-dev-local docker-staging-local

Expected output

On success:

[Info] Promoting image hello-world from docker-dev-local to docker-staging-local
[Info] Docker image promotion completed successfully

Troubleshooting

Enable debug logging: export JFROG_CLI_LOG_LEVEL=DEBUG

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Use Docker with JFrog CLI
• Build Tools Overview
• Native Mode