如何限制Artifactory中私有Docker仓库的登录与镜像拉取权限

Hey there, let's figure out why unauthorized Artifactory accounts are still able to pull images from your Docker repos, even though push permissions are working correctly. Here's a breakdown of the most likely culprits and how to fix them:

1. Check for Unintended Anonymous Access #

First up: Artifactory might be letting unauthenticated (or unauthorized) users slip through via anonymous access settings.

• Head to Admin > Security > Anonymous Access and make sure Allow Anonymous Access is toggled off (unless you explicitly want open pull access, which it sounds like you don't)
• Even if global anonymous access is disabled, double-check your individual Docker repo settings:
  • Go to your repo's Settings > Security tab
  • Ensure Allow Anonymous Access is disabled here too – sometimes repo-level settings override global ones

2. Audit Your Permissions Targets #

Permissions targets are the backbone of access control in Artifactory, and a misconfigured one is almost always the issue here.

• Navigate to Admin > Security > Permissions
• Find the permissions target linked to your Docker repo(s)
  • Remove any wildcard entries (like * for all users) that have Read permissions – this is a common mistake that opens up pull access to everyone
  • Make sure only your intended users/groups are granted Read access
• Also, check the default permissions target (named default by default) – if it has broad read access applied to all repos, it could be overriding your specific repo settings. Restrict it to only apply to repos where you want open access.

3. Enable Token Authentication for Docker V2 #

Docker V2 repos rely on token-based authentication to enforce pull permissions properly. If this is disabled, Artifactory might skip permission checks for pulls.

• Go to your Docker repo's Settings > Docker tab
• Toggle Enable Token Authentication to on (this is required for proper permission enforcement)
• Confirm Docker API Version is set to V2 – V1 has much looser auth checks that can bypass your rules

4. Clear Cached Credentials (Client and Server Side) #

Cached tokens or credentials can cause weird access behavior, even after you fix permissions.

• On the user's machine, clear Docker's credentials cache:
  • Linux: Run rm ~/.docker/config.json (or edit the file to remove entries for your Artifactory URL)
  • Windows/Mac: Use Docker Desktop's settings to clear saved credentials
• On Artifactory, clear the system cache:
  • Go to Admin > System > Maintenance
  • Click Clear Cache under Cache Management to flush any stale permission data

5. Check Virtual Repository Permissions (If Using Them) #

If you're using a virtual Docker repo to aggregate multiple local/remote repos, its permissions might be overriding your local repo's rules.

• Go to your virtual repo's Settings > Security tab
• Make sure the permissions here match your local repos – don't grant broader read access on the virtual repo than you do on the underlying local ones

After working through these steps, test with an unauthorized account again: log in, try to pull an image, and it should now throw the same client doesn't have permission error you see for pushes.

内容的提问来源于stack exchange，提问作者miwiwa