January 2017 Summaries

JFrog Xray's integration with Artifactory and Jenkins significantly enhances the security of software builds by automatically failing Jenkins build jobs if vulnerabilities are detected, preventing compromised builds from advancing through the pipeline to production systems. As of version 1.6, Xray collaborates with Artifactory version 4.16 and Jenkins Artifactory Plugin version 2.9.0 to provide early warnings about vulnerabilities, reducing the risk of deploying insecure software. While it is not necessary for developers to scan every build, incorporating a scan in nightly builds that include the latest code from all developers can offer daily alerts about potential issues. Initially, Xray's CI/CD integration was compatible with Jenkins CI, and from version 1.8, it also supports JetBrains TeamCity, with the potential for more CI server integrations in the future. Artifactory operates seamlessly without requiring additional configuration, ensuring an effortless integration process.

The blog post discusses the principles of setting up a robust Docker pipeline for secure, automated releases into a production Docker registry, emphasizing the separation of layers in Docker images for effective management and security updates. It describes a two-layer architecture consisting of a "framework layer" and an "application layer," where the framework layer contains the base image with necessary components like JDK and Tomcat, and the application layer includes specific application files such as a WAR file. The process involves testing both layers independently to ensure security updates do not disrupt builds, utilizing a sandwich testing approach that combines top-down and bottom-up testing methods. The blog highlights the importance of automation tools, such as Jenkins, Bamboo, or Ansible, to promote images across Docker registries and manage container lifecycles efficiently. It outlines the triggers for pipeline activation, detailing the conditions under which the framework and application pipelines should be initiated to ensure seamless CI/CD processes, while also acknowledging the rare edge case that might require manual intervention. Future discussions will include the implementation details using Jenkins Pipelines to enhance image management between Docker registries.