sha256:e9d93ccde8a85ac256007d5056993245952f830588df4d4f926908a0122572d5
Last pushed
2 days by dockerpublicbot
Type
Sandbox Kit
Manifest digest
sha256:e9d93ccde8a85ac256007d5056993245952f830588df4d4f926908a0122572d5
Installs the JFrog CLI (jf), pre-wired to your JFrog Platform, so agents can run Xray security & license scans (jf audit / jf scan / jf docker scan) against dependencies, binaries, and container images. Xray is a core component of the JFrog Platform and shares package metadata with Artifactory, so a scan reports not just a CVE but its full impact path through your dependency graph.
| Name | Required | Default | Description |
|---|---|---|---|
jfrog_host | Optional | your-company.jfrog.io | Your JFrog Platform host, e.g. mycompany.jfrog.io (SaaS) or artifactory.internal.example.com (self-hosted). Hostname only - no scheme, no path, no port. Defaults to a placeholder; set it or scans have no host to reach. |
| Name | Service | Required | Description |
|---|---|---|---|
JF_ACCESS_TOKEN | jfrog | Required | JFrog Platform access token (needs Xray read + scan scopes). Stored on the host; the sandbox only ever sees a placeholder, and the proxy injects the real value on outbound requests to your JFrog host. |
releases.jfrog.io
releases-cdn.jfrog.io
${{ kit.args.jfrog_host }}
sbx run <agent> --kit sbx/jfrog-xray-kit:20260921-b73cd28cd7c00095a0d25956ec111b287cff5bdcRun the following command to install sbx on your machine.
brew install docker/tap/sbxwinget install Docker.sbx