How to build FIPS-enabled containers (FIPS 140-3)

OCImend · 2026-09-26

Short answer

A FIPS-enabled container uses only cryptographic modules with a FIPS 140-3 certificate and runs them in FIPS mode. For OpenSSL 3 images that means installing a validated FIPS provider, generating its configuration, making it the default for every process, and then proving at run time that non-approved algorithms such as MD5 are refused.

The four steps

01Inventoryevery crypto library in the image
02Validatea CMVP 140-3 certificate each
03EnforceFIPS mode in the image, not the host
04Provelive test: MD5 refused, FIPS on

1. Find every crypto module

An image usually carries more than one: the distribution's OpenSSL, a Go binary with its own crypto, a JVM, Node.js with a bundled OpenSSL. Each needs its own answer.

Runtime	What makes it FIPS	Typical trap
OpenSSL 3	a validated FIPS provider + `fips=yes` default properties	provider present but not activated
Go	a validated Go crypto module or BoringCrypto build	static binaries ignore system OpenSSL
Java	a FIPS JCE provider (e.g. vendor or Bouncy Castle FIPS)	default JCE providers are not validated
Node.js / Python	linked against a FIPS-mode OpenSSL	bundled OpenSSL without the provider

2. Check the certificate, not the version

FIPS 140-2 certificates became historical on 21–22 September 2026; new acquisitions need FIPS 140-3. The OpenSSL 3.1.2 FIPS provider is certified under 140-3 as CMVP #4985. A newer OpenSSL is not automatically covered: the certificate names the exact module version.

3. Enforce FIPS mode inside the image

Vendor images (Red Hat UBI, Amazon Linux, Ubuntu Pro) switch FIPS mode on when the host kernel runs in FIPS mode, which is hard on managed Kubernetes. Enforcing it in the image itself (provider installed, fipsmodule.cnf generated, default properties set in openssl.cnf) makes the image FIPS on any node.

4. Prove it

Start the image in a sandbox and ask it: is the FIPS provider loaded, does MD5 fail, which TLS ciphers are offered? A report without a live test is an inference.

With OCImend

01Scanmodule-by-module verdict
02FIPS imageprovider + config, in gVisor
03Live testinside the new image
04Pullocimend.io/NAME:TAG-fips

Build a FIPS image →

Questions

Does a FIPS-enabled container need a FIPS kernel?

Not if FIPS mode is enforced in the image's own OpenSSL configuration. Vendor images that follow the host's /proc/sys/crypto/fips_enabled do need a FIPS-mode host.

Is a FIPS-enabled container FIPS certified?

No. Certification belongs to the cryptographic module (its CMVP certificate). The container uses certified modules in FIPS mode; your system's authorization also depends on how it uses them.

Which OpenSSL version is FIPS 140-3 validated?

The OpenSSL 3.1.2 FIPS provider holds FIPS 140-3 certificate #4985. Check the CMVP list for the exact module and version you ship.