Artifactory is JFrog's repository manager, and once it is installed the work stops being about installation and starts being about layout. Every package type resolves through the same three shapes — local repositories for what you publish, remote repositories that proxy and cache an upstream, virtual repositories that present a set of them behind one URL — and the naming convention you choose for those repositories is effectively permanent, because build scripts, Docker daemons and package manager configuration files across the organisation will encode it.
Underneath, Artifactory separates three things that people often assume are one. The database holds metadata. The filestore holds binaries, addressed by checksum, and can be local disk, a mounted volume or object storage configured in binarystore.xml. The application layer holds configuration, permissions and scheduled work. Understanding that separation is what makes backup, restore, migration to object storage and capacity planning tractable rather than terrifying.
Operating it well means learning the parts that do not appear in a quick-start. Permission targets, which grant repository and path patterns to groups rather than to people. AQL, the query language that answers questions like which artifacts have not been downloaded in six months. Cleanup policies and scheduled tasks, without which storage grows until someone escalates. Replication — push, pull, event-based and multi-push — for organisations with more than one site. Access tokens and their scoping, for CI systems that should not hold a human's credentials. And BuildInfo, published by the JFrog CLI or a CI plugin, which is what turns a promotion decision into a query instead of an argument.
Why this skill matters now
Software supply chain expectations changed faster than most build platforms did. Customers, auditors and increasingly regulators now ask which components went into a release, where they came from, what licences they carry and whether the exact binary in production is the one that passed the pipeline. Answering that requires a repository manager that was configured deliberately, not one that grew a repository per team over eight years.
At the same time, build platforms have become genuinely large. A repository manager holding several terabytes across dozens of package types, serving thousands of resolutions an hour, and replicating between sites is a distributed system with its own failure modes — cache misses that stall a release, replication that silently falls behind, a filestore that fills on a Friday.
So the skill in demand is not 'can you upload a JAR'. It is repository layout that survives reorganisation, permission models that survive an audit, storage that stays bounded, replication topologies that behave sensibly when a link drops, and scanning policies that block a genuinely dangerous dependency without blocking everyone's Tuesday. Those are engineering decisions, and they are made once.