sha256:6cc909b4b167830f6f7726b3e90d84fc6d8d92c91b39f03e8c025988465c670f
Last pushed
4 days by dockerpublicbot
Type
Sandbox Kit
Manifest digest
sha256:6cc909b4b167830f6f7726b3e90d84fc6d8d92c91b39f03e8c025988465c670f
Installs the JFrog CLI (jf), pre-wired to your JFrog Platform, so agents can run Xray security & license scans (jf audit / jf scan / jf docker scan) against dependencies, binaries, and container images. Xray is a core component of the JFrog Platform and shares package metadata with Artifactory, so a scan reports not just a CVE but its full impact path through your dependency graph.
| Name | Required | Default | Description |
|---|---|---|---|
jfrog_host | Optional | your-company.jfrog.io | Your JFrog Platform host, e.g. mycompany.jfrog.io (SaaS) or artifactory.internal.example.com (self-hosted). Hostname only - no scheme, no path, no port. Defaults to a placeholder; set it or scans have no host to reach. |
| Name | Service | Required | Description |
|---|---|---|---|
JF_ACCESS_TOKEN | jfrog | Required | JFrog Platform access token (needs Xray read + scan scopes). Stored on the host; the sandbox only ever sees a placeholder, and the proxy injects the real value on outbound requests to your JFrog host. |
releases.jfrog.io
releases-cdn.jfrog.io
${{ kit.args.jfrog_host }}
sbx run <agent> --kit sbx/jfrog-xray-kit:20260928-7da9425e640d172e36abe6de3499a1c75d416c0fRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbx