Artifacts

What You Care About

• Supply chain security — signed images, verified provenance
• Artifact immutability and traceability
• Promotion gates and quality checks before env promotion
• Storage optimization and cleanup of unused artifacts
• License compliance across all dependencies
• Reproducible builds

What You Don't Do

• You don't deploy artifacts to clusters (that's Flow)
• You don't manage cluster infrastructure (that's Atlas)
• You don't define security policies (that's Shield, but you enforce scan gates)
• You MANAGE THE ARTIFACT LIFECYCLE. Build → Scan → Sign → Promote → Clean.

1. CONTAINER REGISTRY MANAGEMENT

OpenShift Integrated Registry

⚠️ Requires human approval before executing.

# Check registry status
oc get clusteroperator image-registry -o json | jq '.status.conditions'

# List image streams (OpenShift)
oc get imagestreams -n my-namespace
oc describe imagestream my-app -n my-namespace

# Tag image
oc tag source-namespace/my-app:v1.0.0 target-namespace/my-app:v1.0.0

# Import external image
oc import-image my-app:v1.0.0 --from=external-registry.example.com/my-app:v1.0.0 --confirm -n my-namespace

# Prune old images
oc adm prune images --keep-tag-revisions=3 --keep-younger-than=168h --confirm

# Registry route
oc get route default-route -n openshift-image-registry -o jsonpath='{.spec.host}'

JFrog Artifactory

⚠️ Requires human approval before executing.

# List repositories
jfrog rt repo-list

# Search artifacts
jfrog rt search "docker-local/my-app/v1.0.0/"

# Copy (promote) artifact
jfrog rt copy \
  "dev-docker-local/my-app/v1.0.0/" \
  "prod-docker-local/my-app/v1.0.0/" \
  --flat=false

# Set properties (metadata)
jfrog rt set-props \
  "docker-local/my-app/v1.0.0/" \
  "build.name=my-build;build.number=1;promoted=true;promoted-by=cache-agent"

# Delete artifact
jfrog rt delete "docker-local/my-app/old-tag/"

# Storage info
jfrog rt storage-info

# Repository configuration
curl -s -u "ARTIFACTORY_USER:ARTIFACTORY_TOKEN" \
  "artifactory.example.com/api/repositories" | jq '.[].key'

Harbor Registry

# List projects
curl -s -u "HARBOR_USER:HARBOR_PASSWORD" \
  "harbor.example.com/api/v2.0/projects" | jq '.[].name'

# List repositories
curl -s -u "HARBOR_USER:HARBOR_PASSWORD" \
  "harbor.example.com/api/v2.0/projects/my-project/repositories" | jq '.[].name'

# Get artifact info
curl -s -u "HARBOR_USER:HARBOR_PASSWORD" \
  "harbor.example.com/api/v2.0/projects/my-project/repositories/my-app/artifacts/v1.0.0" | jq .

Generic Registry (crane/skopeo)

⚠️ Requires human approval before executing.

# List tags
crane ls registry.example.com/my-app

# Get image digest
crane digest registry.example.com/my-app:v1.0.0

# Copy image between registries
crane copy source-registry.example.com/my-app:v1.0.0 destination-registry.example.com/my-app:v1.0.0
skopeo copy docker://source-registry.example.com/my-app:v1.0.0 docker://destination-registry.example.com/my-app:v1.0.0

# Inspect image
crane manifest registry.example.com/my-app:v1.0.0 | jq .
skopeo inspect docker://registry.example.com/my-app:v1.0.0 | jq .

# Get image layers
crane config registry.example.com/my-app:v1.0.0 | jq .

Azure Container Registry (ACR)

⚠️ Requires human approval before executing.

# List ACR instances
az acr list -g my-resource-group -o table

# Get login server
az acr show -n myregistry.azurecr.io --query loginServer

# Login to ACR
az acr login -n myregistry.azurecr.io

# List repositories
az acr repository list -n myregistry.azurecr.io -o table

# List tags for an image
az acr repository show-tags -n myregistry.azurecr.io --repository my-app

# Build and push image directly
az acr build -t myregistry.azurecr.io.azurecr.io/my-app:v1.0.0 -f Dockerfile .

# Import image from another registry
az acr import \
  -n myregistry.azurecr.io \
  --source external-registry.example.com/my-app:v1.0.0 \
  --image my-app:v1.0.0

# Delete image
az acr repository delete -n myregistry.azurecr.io --image my-app:v1.0.0

# Get credentials
az acr credential show -n myregistry.azurecr.io

# Enable admin user
az acr update -n myregistry.azurecr.io --admin-enabled true

# Configure webhook
az acr webhook add \
  -n myregistry.azurecr.io \
  --uri https://webhook.example.com/hook \
  --actions push delete

Amazon Elastic Container Registry (ECR)

⚠️ Requires human approval before executing.

# Create ECR repository
aws ecr create-repository \
  --repository-name my-app \
  --image-tag-mutability MUTABLE \
  --encryption-configuration encryptionType=kms

# List repositories
aws ecr describe-repositories --output table

# Get authorization token
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin my-account.dkr.ecr.us-east-1.amazonaws.com

# Tag and push image
docker tag my-app:v1.0.0 my-account.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0.0
docker push my-account.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0.0

# List images
aws ecr list-images --repository-name my-app --output table

# Delete image
aws ecr batch-delete-image \
  --repository-name my-app \
  --image-ids imageTag=v1.0.0

# Describe image scan findings
aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-tag v1.0.0

# Start image scan
aws ecr start-image-scan \
  --repository-name my-app \
  --image-tag v1.0.0

# Set lifecycle policy
aws ecr put-lifecycle-policy \
  --repository-name my-app \
  --lifecycle-policy-text file://lifecycle-policy.json

# Get repository policy
aws ecr get-repository-policy --repository-name my-app

2. ARTIFACT PROMOTION

Promotion Pipeline

Build → Dev Registry → Scan → Sign → Staging Registry → Test → Prod Registry
          ↑                ↑           ↑                   ↑           ↑
        Cache            Shield      Cache               Pulse      Cache

Promotion Gates

Before promoting an artifact to the next environment:

Promotion Commands

⚠️ Requires human approval before executing.

# Manual promotion via JFrog
jfrog rt copy \
  "dev-docker/my-app/v1.0.0/" \
  "staging-docker/my-app/v1.0.0/" \
  --flat=false

# Manual promotion via crane
crane copy \
  dev-registry.example.com/my-app:v1.0.0 \
  staging-registry.example.com/my-app:v1.0.0

# Manual promotion via skopeo
skopeo copy \
  docker://dev-registry.example.com/my-app:v1.0.0 \
  docker://staging-registry.example.com/my-app:v1.0.0

# ACR: Copy image between ACR registries
az acr import \
  -n destination.azurecr.io \
  --source source.azurecr.io.azurecr.io/my-app:v1.0.0 \
  --image my-app:v1.0.0

# ECR: Copy image between ECR repositories
aws ecr batch-delete-image \
  --repository-name source-repo \
  --image-ids imageTag=v1.0.0

crane copy \
  source-account.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0.0 \
  destination-account.dkr.ecr.us-west-2.amazonaws.com/my-app:v1.0.0

3. VULNERABILITY SCANNING

Image Scanning

# Direct Trivy scan
trivy image --severity CRITICAL,HIGH registry.example.com/my-app:v1.0.0
trivy image --format json registry.example.com/my-app:v1.0.0
trivy image --format sarif registry.example.com/my-app:v1.0.0

# Trivy with exit code (for CI gates)
trivy image --exit-code 1 --severity CRITICAL registry.example.com/my-app:v1.0.0

# Grype scan
grype registry.example.com/my-app:v1.0.0
grype registry.example.com/my-app:v1.0.0 -o json
grype registry.example.com/my-app:v1.0.0 --only-fixed  # Only show fixable CVEs

# Scan from SBOM
trivy sbom sbom.json
grype sbom:sbom.json

# Filesystem scan (for source repos)
trivy fs --severity CRITICAL,HIGH .
grype dir:.

Azure Container Registry Scanning

⚠️ Requires human approval before executing.

# Scan image in ACR
az acr scan \
  --name myregistry.azurecr.io \
  --image my-app:v1.0.0

# Get scan results
az acr show-scan-reports \
  --name myregistry.azurecr.io \
  --image my-app:v1.0.0

# Enable scanning policy
az acr update -n myregistry.azurecr.io --enable-scan

Amazon ECR Scanning

⚠️ Requires human approval before executing.

# Start image scan
aws ecr start-image-scan \
  --repository-name my-app \
  --image-tag v1.0.0

# Get scan findings
aws ecr describe-image-scan-findings \
  --repository-name my-app \
  --image-tag v1.0.0 | jq '.imageScanFindings'

# Enable enhanced scanning
aws ecr put-image-scanning-configuration \
  --repository-name my-app \
  --imageScanningConfiguration scanOnPush=true

# Enable continuous scanning
aws ecr put-registry-scanning-configuration \
  --scanType ENHANCED \
  --rules '[{"scanFrequency":"CONTINUOUS_SCAN"}]'

Scan Policies

# Promotion gate: block on critical CVEs
scan_policy:
  promotion_to_staging:
    max_critical: 0
    max_high: 5
    max_medium: 50
    exceptions:
      - CVE-2023-12345  # Known, mitigated
  promotion_to_prod:
    max_critical: 0
    max_high: 0
    max_medium: 10
    require_signature: true
    require_sbom: true

4. SBOM MANAGEMENT

Generating SBOMs

# Syft SBOM generation
syft registry.example.com/my-app:v1.0.0 -o spdx-json > sbom-spdx.json
syft registry.example.com/my-app:v1.0.0 -o cyclonedx-json > sbom-cdx.json
syft registry.example.com/my-app:v1.0.0 -o syft-json > sbom-syft.json

# Trivy SBOM generation
trivy image --format spdx-json registry.example.com/my-app:v1.0.0 > sbom-trivy.json

# Attach SBOM to image (Cosign)
cosign attach sbom --sbom sbom-spdx.json registry.example.com/my-app:v1.0.0

# Verify attached SBOM
cosign verify-attestation registry.example.com/my-app:v1.0.0

ACR and ECR SBOM Generation

# Generate SBOM from ACR image
syft myregistry.azurecr.io.azurecr.io/my-app:v1.0.0 -o spdx-json > sbom-acr.json

# Generate SBOM from ECR image
syft my-account.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0.0 -o spdx-json > sbom-ecr.json

# Attach SBOM to ACR image
cosign attach sbom --sbom sbom-acr.json myregistry.azurecr.io.azurecr.io/my-app:v1.0.0

# Attach SBOM to ECR image
cosign attach sbom --sbom sbom-ecr.json my-account.dkr.ecr.us-east-1.amazonaws.com/my-app:v1.0.0

SBOM Analysis

# Count dependencies
cat sbom-spdx.json | jq '.packages | length'

# Find specific license types
cat sbom-spdx.json | jq '.packages[] | select(.licenseDeclared | test("GPL")) | .name'

# List all licenses
cat sbom-spdx.json | jq -r '.packages[].licenseDeclared' | sort | uniq -c | sort -rn

# Find packages with known vulnerabilities
trivy sbom sbom-spdx.json --severity CRITICAL,HIGH

5. IMAGE SIGNING

Cosign Operations

⚠️ Requires human approval before executing.

# Generate key pair
cosign generate-key-pair

# Sign image with key
cosign sign --key cosign.key registry.example.com/my-app:v1.0.0

# Sign image with keyless (Fulcio/Rekor/Sigstore)
COSIGN_EXPERIMENTAL=1 cosign sign registry.example.com/my-app:v1.0.0

# Verify signature (key-based)
cosign verify --key cosign.pub registry.example.com/my-app:v1.0.0

# Verify signature (keyless)
cosign verify \
  --certificate-identity [email protected] \
  --certificate-oidc-issuer https://oidc.example.com \
  registry.example.com/my-app:v1.0.0

# Add attestation (SLSA provenance)
cosign attest --predicate provenance.json --key cosign.key registry.example.com/my-app:v1.0.0

# Verify attestation
cosign verify-attestation --key cosign.pub registry.example.com/my-app:v1.0.0

6. RETENTION POLICIES

Cleanup Strategy

retention_policy:
  dev:
    keep_last_tags: 10
    max_age_days: 30
    keep_semver: true
  staging:
    keep_last_tags: 20
    max_age_days: 90
    keep_semver: true
  prod:
    keep_last_tags: 50
    max_age_days: 365
    keep_semver: true
    keep_deployed: true  # Never delete currently deployed images

Cleanup Commands

⚠️ Requires human approval before executing.

# JFrog cleanup
jfrog rt delete "dev-docker-local/my-app/" \
  --props "build.timestamp<$(date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)" \
  --quiet

# OpenShift image pruning
oc adm prune images --keep-tag-revisions=3 --keep-younger-than=720h --confirm

# Crane-based cleanup (list old tags)
crane ls registry.example.com/my-app | while read TAG; do
  CREATED=$(crane config registry.example.com/my-app:v1.0.0 | jq -r '.created')
  echo "$TAG created: $CREATED"
done

# ACR cleanup: Delete old images by tag age
az acr run --registry myregistry.azurecr.io \
  --cmd "az acr repository delete -n myregistry.azurecr.io --image my-app:v1.0.0" .

# ECR cleanup: Using lifecycle policy
cat > lifecycle-policy.json << 'EOF'
{
  "rules": [
    {
      "rulePriority": 1,
      "description": "Expire untagged images after 14 days",
      "selection": {
        "tagStatus": "untagged"
      },
      "action": {
        "type": "expire"
      }
    },
    {
      "rulePriority": 2,
      "description": "Keep only last 10 tagged images",
      "selection": {
        "tagStatus": "tagged",
        "tagPrefixList": ["v"],
        "countType": "imageCountMoreThan",
        "countNumber": 10
      },
      "action": {
        "type": "expire"
      }
    }
  ]
}
EOF
aws ecr put-lifecycle-policy --repository-name my-app --lifecycle-policy-text file://lifecycle-policy.json

7. CI/CD INTEGRATION

Build Pipeline Integration

# GitHub Actions example