Should we use Nexus or Artifactory for a Maven Repo? [closed]

Question

We are using Maven for a large build process (> 100 modules). We have been storing our external dependencies in source control, and using that to update a local repo.

However, we are ready to graduate to a local repo that can cache central so that we don't have to proactively download all 3rd parties (but we can still have a local repo to pull from). In addition we want to publish our internal build artifacts from a nightly build so that developers don't have to build the world.

We are considering Nexus and Artifactory. What are the reasons for preferring one over the other? Are there others we should be considering?

Calfee

Your link is not too objective, here's the other side response blogs.jfrog.org/2009/01/contrasting-artifactory-and-nexus.html – Equalizer

I think you should consider a plain http server like Apache or nginx. They are "Boring Technology" (mcfunley.com/choose-boring-technology). – Motherless

@JohanWalles: more like "Inconvenient and Productivity-Reducing Technology" in this context. – Nicol

Answer 1

I don't know about Artifactory but here are my reasons for using Nexus:

• Dead simple install (and since 1.2, dead simple upgrade, too)
• Very good web UI
• Easy to maintain, almost no administrative overhead
• Provides you with RSS feeds of recently installed, broken artifacts and errors
• It can group several repositories so you can mirror several sources but need only one or two entries in your settings.xml
• Deploying from Maven works out of the box (no need for WebDAV hacks, etc).
• it's free
• You can redirect access paths (i.e. some broken pom.xml requires "a.b.c" from "xxx"). Instead of patching the POM, you can fix the bug in Nexus and redirect the request to the place where the artifact really is.

Brabant

Nexus has great web UI for creating regularly scheduled jobs that can purge SNAPSHOTS. Artifactory doesn't have this (yet). – Edd

Answer 2

I'm sure that if you only talk about storing binaries from "mvn deploy" both will do fine.

We use Artifactory very extensively with all upgrades along the way. Lots of projects, numerous snapshots deployed and external repos proxied. Not a single problem. I find it hard to explain how other people experience issues with its DB, indexing or anything else. Nothing like that ever happened to us. Also, Artifactory allows to store data on a disk and only use a DB for storing metadata, it is quite flexible (see more here).

What makes those applications very different is their approach towards integration with other build tools and technologies. Nexus and Sonatype are pretty much locked on Maven and m2eclipse. They ignore anything else and only recently started to work on their own proprietary Hudson integration (see their Maven 3 webinar). EDIT: This is not true anymore as of 2017 Nexus gives a much larger support for other build tools End of Edit

Artifactory provides an awesome Hudson, TeamCity and Bamboo integration, and Gradle / Ivy support. So while Nexus gives you nothing once you step out of Sonatype "comfort zone" (Maven, m2eclipse), Artifactory embraces and collaborates with all major build tools.

In fact, being able to deploy build artifacts from Hudson, when job has finished, and not by "mvn deploy" is a huge difference: Artifactory Hudson plugin makes an atomic-like deploy of all artifacts at once, only when a build job finished successfully. "mvn deploy" runs after each module and can deploy a partial set of artifacts if a build job fails in the middle. Deploying from Maven on module completion and not from a build server on job completion is really a bad thing to do.

As you see, Artifactory thinks "outside the box" while Nexus thinks "inside the box" and only cares about Maven and Maven artifacts.

Something else that makes Artifactory more accessible is their cloud-based Artifactory Online solution. For about $80 a month you have your own Artifactory instance, no need to dedicate any server for it.

Artifactory has a simple and straightforward REST API, don't know how it works for Nexus. Edit Nexus has also a REST API that you can use easily as well.

To summarize, for basic storage of Maven artifacts I think both are fine. But while Nexus stops there being strictly a "Maven repository manager", Artifactory goes on and on, being a general "Binaries storage" for binaries of any kind, from any build tool and CI server.

Toluene

I'm sorry but I smell FUD here. Nexus is certainly not "locked on Maven and m2eclipse", it integrates perfectly well with Jenkins, TeamCity and Bamboo. It has a simple and straightforward REST API; every Nexus feature is exposed as a REST endpoint. It is not true to say that Nexus "only cares about Maven and Maven artifacts"; it also supports .Net (NuGet), Gradle/Ivy, OSGI, and can host Yum RPM repositories. In terms of artifact storage, tar, zip, rar, par are included along with the standard java archive types. – Vogler

Dude, that response was posted 4 years ago :) It's not about Maven any more? Good for it then! – Toluene

@EvgenyGoldin Doesn't make his comment less relevant (except of the FUD-part^^). – Brocklin

Now that this post is seven years old, and REST apis are more or less mandatory with tools, Nexus still seems to suck at this. Using Nexus3 there rest API is basically rpc; you have to upload a little script to execute what you want to do. Artifactory on the other hand seems to expose a well thought out API that has good documentation. – Bog

Answer 3

Artifactory supports both file-system and database storage backends. Storage is checksum based and identical binaries are stored only once, no matter how many times they appear in the repo, which makes Artifactory more efficient storage-wise. Move and copy are also very cheap because of this architecture (in Nexus there's no REST for move/copy - you have to move stuff on the file system, then run corrective actions on the repo to let it know content has changed).

Another important differentiator is Artifactory has unique integration with Hudson and TeamCity for capturing information about deployed artifacts, resolved dependencies and environment data associated with build runs, which provides full build traceability.

Duna

Artifactory also supports S3 persistence. – Muirhead

@TimFerrell, not untrue, but at a price that is prohibitively expensive for most shops I generally work at. – Embolus

Answer 4

Artifactory stores the artifacts in a database, which means that if something goes wrong, all your artifacts are gone. Nexus uses a flat file for your precious artifacts so you don't have to worry about them all getting lost.

Maggiore

That was what made the difference for us too. I imagine it's mostly just paranoia, but it's comforting to know that it will be easy to inspect the system at any time. – Cooperstein

We are planning to switch from Artifactory to Nexus because of this. – Crude

+1 from another victim of corruption; I've used Archiva and Nexus since then and both seem pretty solid. – Hoyt

This answer is outdated. Artifactory can now be configured to store objects on the file system. – Russ

As long as I've used Artifactory, it has had filesystem support for the actual artifacts. But I use a database anyway because our main database server is replicated and backed up. I don't see how filesystem storage is inherently safer than a database. Nothing against Nexus, just trying to clear this up. – Piteous

@JoshuaDavis yes, but database itself is another layer of sophistication. Given that anything made by human beings tends to break or decay - database itself can. Bearing that in mind storing artifacts as files is safer. – Biodegradable

"Artifactory stores the artifacts in a database, which means that if something goes wrong, all your artifacts are gone." Hahahaha don't know if you were aware at that moment in time, but all companies in the world - even then - were using databases for their most precious business assets, like orders. Nothing replaces risk analysis and backup/recovery strategy when it comes to any data. – Gluttonize

I've read somewhere that artifactory can be configured to store on filesystem aswell. And if your filesystem gets corrupted enough, it is also hard to recover data from there, so it is not really a security concern. You should allways have backups of everything which is important, and you can allways recover data from broken databases. – Rea

Answer 5

If you need the "Pro" features of either (e.g. Staging repos, artifact promotion, NuGet), , then you need to consider the different pricing models, which are displayed on their websites.

• http://www.jfrog.com/home/v_pricing
• http://www.sonatype.com/nexus/purchase

In summary:

• Artifactory Pro
  • you pay per server
  • you can pay more for increased service hours
• Nexus Pro
  • you pay per seat, i.e. how many developers downloading artifacts
  • support service is Mon-Fri 0800-2000 ET only, no matter what you pay

No matter how many users you have, Nexus Pro offers a support service that's broadly equivalent to Artifactory's $7,450/year "Silver Value Pack".

$7,450/year will buy you approximately 67 Nexus Pro seats (1-50 @ $108, the rest @ $120).

On price and support alone then, Nexus Pro makes sense until you get to 67 users, at which point Artifactory becomes the cheaper option.

If you're doing all the support in-house; however, that magic point is about 23 users (Artifactory's most basic support offering is $2,750/year).

Vogler

Answer 6

I made some research recenly about Artifactory 2 and Nexus 1.3. I'll list here the main differences I found:

• Artifactory stores metadata and optionally files in DB, Nexus writes directly to file system. There are pros. and cons. for each approach. DB supports transactions, while in FS stored files can be accessed directly.
• Artifactory has higher system requirements especially for disk space.

The most complete comparison: http://binary-repositories-comparison.github.io/

Natant

Actually Artifactory is now GPL. – Maggiore

Nexus OSS has Ldap support for several releases now. – Maggiore

Artifactory support for LDAP groups is still a pro feature: jfrog.com/confluence/display/RTF/LDAP+Groups – Abampere

Update July 2015: Codehaus is dead now, so the matrix migrated to binary-repositories-comparison.github.io – Thermocouple

Answer 7

You should use Artifactory Its latest version was a real jump You can backup incrementally your repositories , which means you can have all your artifacts saved and maintain Its has a easy to use web ui and is really easy to set up i enjoyed it a lot check out its new version 2.0

Acus

Answer 8

From a learners point of view I note some specific differences between the two.

1. Sonatype .war deployment is not supported on Jboss application server at the time, although it does run under Tomcat.
2. Sonatype does not offer me an Amazon Machine Image (AMI), at present, that I could quickly stand up and test.
3. An Artifactory AMI is provided by Bitnami and takes a only a few minutes to stand up and a few more minutes to configure, maybe several tens of minutes dependant upon what you're trying to achieve.
4. Artifactory offer a SaaS version of Artifactory in the cloud so you can focus on getting things done rather than infrastructure.
5. I've no experience with Nexus but I've found Artifactory very intuitive and easy to configure, at least initially.
6. Added - I do note that the Artifactory User Guide, which may be OK for a seasoned pro, is a bit light on for some in depth explanations. For instance, starting out, one unzips and then addes a Repository, say RedHat's Jboss EAP Enterprise Repo. All goes fine but then when I tried to view the artifacts that were imported Artifactory reports zero artifacts? No errors or warnings so I'm now looking for an explanation. Is this normal or not normal? A simple explanation in the doco can quickly point one in the right direction. Being a good contributor I'm adding these comments to the project for the benefit of other starters.

Largely

Answer 9

All politics/religion aside, licensing makes a difference for some organizations.

Nexus is GPL now AGPLv3 and now Eclipse Public License (EPL).

Artifactory is Apache licensed LGPLv3 licensed as of version 2.1 of the product.

You may also want to consider Archiva, just for comparison's sake. It's Apache 2.0 licensed.

Greathearted

Why, this is a troll. Does the fact that Linux is GPL dissuade organizations from using it? There's a difference between incorporating a tool into a program and using it. – Nucleolated

I did not mean to troll, but I appreciate your point. I've removed the superlatives from the text. – Greathearted

@tobrien: FWIW, some organizations (including mine) are highly cautious about when they use GPL'ed software, fearing legal exposure. I don't want to discuss the (lack of) wisdom of such policy -- I suspect we would agree completely. Just pointing out that for some, it matters. – Greathearted

Yes, this is definitively something organizations (also including mine) consider. – Quincunx

As of 2.1, Artifactory is LGPL anyway. – Maggiore

@Zac @user145026 Are you linking your code to Nexus libraries?? If not, I don't see why the GPL license is an issue. – Marrero

@Pascal you're right, of course ... but that doesn't stop companies from having policies! – Greathearted

I think everyone ought to read and understand the first comment of this thread. There's a difference between using GPL software (linux, git, whatever), and incorporating it into your product. Are you planning to redistribute artifactory? – Silique

Answer 10

I see that Nexus usage is growing, while Artifcatory usage is generaly staying flat.

Picture is taken from here http://blog.sonatype.com/2014/11/42000-nexus-repository-managers-and-growing/

There is also matrix-comparison http://docs.codehaus.org/display/MAVENUSER/Maven+Repository+Manager+Feature+Matrix

Malisamalison

1. This picture is not accurate, since it relies on Maven Central calls only. There are downloads beyond Maven Central. 2. Codehaus is dead now, matrix migrated to binary-repositories-comparison.github.io – Thermocouple

Nice. Do you have any better picture? – Malisamalison

You can find some numbers here. – Thermocouple

Biased towards Nexus, Biased towards jfrog - I wouldn't trust either set of numbers. – Hadji

Answer 11

Both Artifactory and Nexus have more or less similar feature set but Artifactory's LDAP support makes it more attractive over Nexus. Though Nexus also have LDAP support but in paid version :-(

Unwary

There is an open source LDAP plugin for Nexus on google code. – Maggiore

LDAP support is now in the free version of Nexus, since 1.5.0 – Aureus

Answer 12

Hmmm...my experience with artifactory is awful...but I'm a relative newbie so take it with a grain of salt. My overall complaint is that jar files recently uploaded to Artifactory do not seem to get indexed right away - as in for hours - and there does not seem to be a good way to force it. I've tried various things that appeared as if they should have worked, but didn't. I have been working with m2eclipse, adding dependencies to a project that i'm converting from ant. When I try to add a jar that I have just added to artifactory, I expect it to show up as a choice in the selector but it does not.

a coworker told me that they had installed nexus and so far they like it...but I can't vouch for it yet. I'm about to install that on a Linux box as soon as IT can find me one.

Flycatcher

You are referring to Nexus indexes that are downloaded and consumed by IDEs, in your case - by the m2eclipse plugin. These indexes are periodically downloaded to clients and are not meant to be consumed upon every deployment. Artifactory lets you schedule these index updates or force it. FYI, indexes used by Artifactory searches (UI/REST) are different and are updated immediately and atomically as part of deploying new artifacts. Tools like IntelliJ make use of this by running searches against the repository rather than a locally cached index, using the REST API of Artifactory. – Duna