Hacker News Reader

Comment by thesimon | Hacker News Reader

I guess I've not worked in big enough corporates to use this.

Can any user here provide some context what JFrog does? The website doesn't really say much, the example pipeline files for JFrog pipelines seem more complex than GitLab CI.

View on HN

For me JFrog is synonymous with Artifactory -- I think that was their earliest / bread & butter product? That may just be my interaction. It's an on-premise/cloud hybrid source artifact repository. The nice thing about it is that it is one product that can act as a maven/npm/pip/etc. repo. If you're in a polyglot org (big enterprise) and you have security needs/historical baggage to host on-premise (big enterprise) then you can do a lot worse picking a solution. Also has nice API & CLI components for integration, it is far from my least favorite of the enterprise-y sorts of things you can run into at a big company :)

What is an artifact in this context?

build output

That’s even more ambiguous than “artifact”. If someone asks me for build output, I would typically think about the console logs.

A package, typically. Like a Maven package for java, a wheel/egg package for Python, a gem package for Ruby, etc.

Docker Containers

I think you mean an image, not a container?

That's correct, my apologies

Anything your build server produces that you want to serve or archive. Binaries, packages, test results, etc.

A library. If you're familiar with pip or npm or the like, you've probably used public repositories. npmjs.org hosts all the free and open source node libraries. But a big org might have a loads of closed and proprietary libraries they need to share and version among multiple development teams or partners. A product like artefactory hosts those kind of libraries for multiple languages and is compatible with the popular package managers.

It's also like a local cache of public repos. That means faster builds, some level of quality control (ie black or white list of safe libraries) as well as protection against things like the leftpad fiasco or 2016.

I would define it as a file that is distributed for use among many decoupled hosts and which is generated from some sort of source input.

Packages/libraries such as those used by NPM and Pip are some examples. It may also be an entire program, an OS package, a virtual machine, a Docker image, even things like PNG images.

Artifactory has tooling to make it easy to integrate into typical build pipelines.

It's quite useful, and certainly better than trying to roll it yourself, but it's also surprisingly slow.

How is it compared to Sonatype Nexus?

I think the big part that everyoen missed, is that other than artifact storage (artifacts are usually what your code becomes, like the usable end product, and also stores info to reproduce and audit, etc etc) is that JFrog is also putting lots of efforts into full fledged software distribution pipelines, which is what these big enterprises need. There is also the whole DevSecOps sections of their product, and though OSS is not as big, they are giving out plenty back to the community by hosting ChartCenter (Helm), GoCenter (Go-lang), JCenter (Java), and Conan (C/C++)

We use it for artifactory to support scala services. S3 based solutions aren't as good, though jfrog isn't without its faults.

We use Artifactory to store custom debian packages. Not sure about the rest of their offering

Artifactory is a strong tool. I work for a large multinational with somewhat regressive IT policies, so you can't really use the internet - Artifactory is both a package cache and package manager, working across pretty much every language. I have used PyPi, JS, Java, & Docker artifacts contained in it, so that's pretty cool

Also no idea what else they do.

The company I work for uses it for the same reasons as yours. We also have to use it to cache things like NPM and RPM packages. Without that caching, we would be putting a strain on public mirrors. We additionally have a layer of security because we have a system for approving which packages and package versions go into our cache.

They also have an XRay offering for scanning things like Docker containers for vulnerabilities, although for various reasons we do not use it. I wish we did! It would keep things integrated.

The main reason why we use Artifactory, though, is because it allows us to share artifacts across different regions and environments.

The one thing I don't like is how stingy jfrog is with their licenses. It makes automatic deployments of Artifactory a bit difficult for us. Their Mission Control offering isn't enough for the way we deploy Artifactory.

It's our private maven repo. Works well for that.

Their flagship product is Artifactory, a polyglot artifact repository, which is used throughout most of the Fortune 100.

I thought they were more known for package registries and hosting (eg conan) than CI.

def more known for Artifactory (and community spin-offs like Conan and JFrog Container Registry), but CI/CD has become the core growth as the artifact storage is pretty robust at this point

Reply on news.ycombinator.com