|
| 1 | +--- |
| 2 | +title: FIPS |
| 3 | +description: Learn how Docker Hardened Images support FIPS 140 through validated cryptographic modules to help organizations meet compliance requirements. |
| 4 | +keywords: docker fips, fips 140 images, fips docker images, docker compliance, secure container images |
| 5 | +--- |
| 6 | + |
| 7 | +## What is FIPS 140? |
| 8 | + |
| 9 | +[FIPS 140](https://csrc.nist.gov/publications/detail/fips/140/3/final) is a U.S. |
| 10 | +government standard that defines security requirements for cryptographic modules |
| 11 | +that protect sensitive information. It is widely used in regulated environments |
| 12 | +such as government, healthcare, and financial services. |
| 13 | + |
| 14 | +FIPS certification is managed by the [NIST Cryptographic Module Validation |
| 15 | +Program |
| 16 | +(CMVP)](https://csrc.nist.gov/projects/cryptographic-module-validation-program), |
| 17 | +which ensures cryptographic modules meet rigorous security standards. |
| 18 | + |
| 19 | +## Why FIPS compliance matters |
| 20 | + |
| 21 | +FIPS 140 compliance is required or strongly recommended in many regulated |
| 22 | +environments where sensitive data must be protected, such as government, |
| 23 | +healthcare, finance, and defense. These standards ensure that cryptographic |
| 24 | +operations are performed using vetted, trusted algorithms implemented in secure |
| 25 | +modules. |
| 26 | + |
| 27 | +Using software components that rely on validated cryptographic modules can help organizations: |
| 28 | + |
| 29 | +- Satisfy federal and industry mandates, such as FedRAMP, which require or |
| 30 | + strongly recommend FIPS 140-validated cryptography. |
| 31 | +- Demonstrate audit readiness, with verifiable evidence of secure, |
| 32 | + standards-based cryptographic practices. |
| 33 | +- Reduce security risk, by blocking unapproved or unsafe algorithms (e.g., MD5) |
| 34 | + and ensuring consistent behavior across environments. |
| 35 | + |
| 36 | +## How Docker Hardened Images support FIPS compliance |
| 37 | + |
| 38 | +Docker Hardened Images (DHIs) include variants that use cryptographic modules |
| 39 | +validated under FIPS 140. These images are intended to help organizations meet |
| 40 | +compliance requirements by incorporating components that meet the standard. |
| 41 | + |
| 42 | +- FIPS image variants use cryptographic modules that are already validated under |
| 43 | + FIPS 140. |
| 44 | +- These variants are built and maintained by Docker to support environments with |
| 45 | + regulatory or compliance needs. |
| 46 | +- Docker provides signed test attestations that document the use of validated |
| 47 | + cryptographic modules. These attestations can support internal audits and |
| 48 | + compliance reporting. |
| 49 | + |
| 50 | +> [!NOTE] |
| 51 | +> |
| 52 | +> Using a FIPS image variant helps meet compliance requirements but does not |
| 53 | +> make an application or system fully compliant. Compliance depends on how the |
| 54 | +> image is integrated and used within the broader system. |
| 55 | +
|
| 56 | +## Identify images that support FIPS |
| 57 | + |
| 58 | +Docker Hardened Images that support FIPS are marked as **FIPS** compliant |
| 59 | +in the Docker Hardened Images catalog. |
| 60 | + |
| 61 | +To find DHI repositories with FIPS image variants, [explore images](../how-to/explore.md) and: |
| 62 | + |
| 63 | +- Use the **FIPS** filter on the catalog page |
| 64 | +- Look for **FIPS** compliant on individual image listings |
| 65 | + |
| 66 | +These indicators help you quickly locate repositories that support FIPS-based |
| 67 | +compliance needs. Image variants that include FIPS support will have a tag |
| 68 | +ending with `-fips`, such as `3.13-fips`. |
| 69 | + |
| 70 | +## Validate FIPS-related tests using attestations |
| 71 | + |
| 72 | +Docker Hardened Images include a signed [test |
| 73 | +attestation](../core-concepts/attestations.md) that documents the results of |
| 74 | +automated image validation. For FIPS variants, this includes test cases that |
| 75 | +verify whether the image uses FIPS-validated cryptographic modules. |
| 76 | + |
| 77 | +You can retrieve and inspect this attestation using the Docker Scout CLI: |
| 78 | + |
| 79 | +```console |
| 80 | +$ docker scout attest get \ |
| 81 | + --predicate-type https://scout.docker.com/tests/v0.1 \ |
| 82 | + --predicate \ |
| 83 | + <your-namespace>/dhi-<image>:<tag> --platform <platform> |
| 84 | +``` |
| 85 | + |
| 86 | +For example: |
| 87 | + |
| 88 | +```console |
| 89 | +$ docker scout attest get \ |
| 90 | + --predicate-type https://scout.docker.com/tests/v0.1 \ |
| 91 | + --predicate \ |
| 92 | + docs/dhi-python:3.13-fips --platform linux/amd64 |
| 93 | +``` |
| 94 | + |
| 95 | +The output is a structured JSON report. Individual test outputs are |
| 96 | +base64-encoded under fields like `stdout`. You can decode them to review the raw |
| 97 | +test output. |
| 98 | + |
| 99 | +To decode and view test results: |
| 100 | + |
| 101 | +```console |
| 102 | +$ docker scout attest get \ |
| 103 | + --predicate-type https://scout.docker.com/tests/v0.1 \ |
| 104 | + --predicate \ |
| 105 | + docs/dhi-python:3.13-fips --platform linux/amd64 \ |
| 106 | + | jq -r '.results.tests[].extra.stdout' \ |
| 107 | + | base64 -d |
| 108 | +``` |
0 commit comments