Dockerfile

# syntax=docker/dockerfile:1.6

# --- Base Images ---
ARG BASE_IMAGE="cgr.dev/chainguard/wolfi-base@sha256:9925d3017788558fa8f27e8bb160b791e56202b60c91fbcc5c867de3175986c8"
ARG STATIC_IMAGE="cgr.dev/chainguard/static@sha256:11ec91f0372630a2ca3764cea6325bebb0189a514084463cbb3724e5bb350d14"
# --- Version Variables ---
ARG FIPS_VERSION
ARG CORE_VERSION
ARG APK_TOOLS_VER
ARG BUSYBOX_VER
ARG GLIBC_VER
ARG GLIBC_LOCALE_POSIX_VER
ARG LD_LINUX_VER
ARG LIBCRYPT1_VER
ARG LIBXCRYPT_VER
ARG LIBGCC_VER
ARG WOLFI_BASE_VER
ARG WOLFI_BASELAYOUT_VER
ARG WOLFI_KEYS_VER

# --- Build Stage Packages ---
ARG BUILD_BASE_VER
ARG PERL_VER
ARG LINUX_HEADERS_VER
ARG WGET_VER
ARG CA_CERTIFICATES_VER

# --- Runtime & Helper Packages ---
ARG LIBSTDC_PLUS_PLUS_VER
ARG ZLIB_VER
ARG TZDATA_VER
ARG POSIX_LIBC_UTILS_VER

# --- Dev Tools (SDK Only) ---
ARG PKGCONF_VER
ARG PCRE_DEV_VER
ARG ZLIB_DEV_VER
ARG BASH_VER
ARG CURL_VER
ARG JQ_VER
ARG UNZIP_VER

FROM ${BASE_IMAGE} as producer
ARG APK_TOOLS_VER
ARG BUSYBOX_VER
ARG GLIBC_VER
ARG GLIBC_LOCALE_POSIX_VER
ARG LD_LINUX_VER
ARG LIBCRYPT1_VER
ARG LIBXCRYPT_VER
ARG LIBGCC_VER
ARG WOLFI_BASE_VER
ARG WOLFI_BASELAYOUT_VER
ARG WOLFI_KEYS_VER
ARG BUILD_BASE_VER
ARG PERL_VER
ARG LINUX_HEADERS_VER
ARG WGET_VER
ARG CA_CERTIFICATES_VER
ARG LIBSTDC_PLUS_PLUS_VER
ARG ZLIB_VER
ARG TZDATA_VER
ARG POSIX_LIBC_UTILS_VER
ARG PKGCONF_VER
ARG PCRE_DEV_VER
ARG ZLIB_DEV_VER
ARG BASH_VER
ARG CURL_VER
ARG JQ_VER
ARG UNZIP_VER
USER root
RUN mkdir -p /rootfs/distroless /rootfs/standard /rootfs/development
# -------------------------------------------------------------------------
# Block 1: DISTROLESS (No Shell, No Busybox)
# -------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/apk \
    set -eux; \
    apk add --no-cache --initdb --no-scripts --root /rootfs/distroless \
    --keys-dir /etc/apk/keys --repositories-file /etc/apk/repositories \
    wolfi-baselayout=${WOLFI_BASELAYOUT_VER} \
    wolfi-keys=${WOLFI_KEYS_VER} \
    glibc=${GLIBC_VER} \
    libgcc=${LIBGCC_VER} \
    zlib=${ZLIB_VER} \
    tzdata=${TZDATA_VER} \
    ca-certificates=${CA_CERTIFICATES_VER}; \
    mkdir -p /rootfs/distroless/etc/apk; \
    cp -a /etc/apk/keys /rootfs/distroless/etc/apk/; \
    cp -a /etc/apk/repositories /rootfs/distroless/etc/apk/; \
    cp -a /etc/passwd /rootfs/distroless/etc/; \
    cp -a /etc/group /rootfs/distroless/etc/; \
    cp -a /etc/shadow /rootfs/distroless/etc/; \
    echo "hosts: files dns" > /rootfs/distroless/etc/nsswitch.conf; \
    touch /rootfs/distroless/etc/resolv.conf /rootfs/distroless/etc/hosts


# -------------------------------------------------------------------------
# Block 2: STANDARD (With Busybox & Shell)
# -------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/apk \
    set -eux; \
    apk add --no-cache --initdb --no-scripts --root /rootfs/standard \
    --keys-dir /etc/apk/keys --repositories-file /etc/apk/repositories \
    wolfi-baselayout=${WOLFI_BASELAYOUT_VER} \
    wolfi-keys=${WOLFI_KEYS_VER} \
    glibc=${GLIBC_VER} \
    libgcc=${LIBGCC_VER} \
    zlib=${ZLIB_VER} \
    tzdata=${TZDATA_VER} \
    ca-certificates=${CA_CERTIFICATES_VER} \
    busybox=${BUSYBOX_VER} \
    posix-libc-utils=${POSIX_LIBC_UTILS_VER} \
    libstdc++=${LIBSTDC_PLUS_PLUS_VER}; \
    mkdir -p /rootfs/standard/etc/apk; \
    cp -a /etc/apk/keys /rootfs/standard/etc/apk/; \
    cp -a /etc/apk/repositories /rootfs/standard/etc/apk/; \
    cp -a /etc/passwd /rootfs/standard/etc/; \
    cp -a /etc/group /rootfs/standard/etc/; \
    cp -a /etc/shadow /rootfs/standard/etc/; \
    for applet in $(/rootfs/standard/usr/bin/busybox --list); do \
        ln -sf busybox /rootfs/standard/usr/bin/$applet; \
    done; \
    ln -sf busybox /rootfs/standard/usr/bin/sh; \
    echo "hosts: files dns" > /rootfs/standard/etc/nsswitch.conf; \
    touch /rootfs/standard/etc/resolv.conf /rootfs/standard/etc/hosts


# -------------------------------------------------------------------------
# Block 3: DEVELOPMENT (With Busybox, Shell & SDK)
# -------------------------------------------------------------------------
RUN --mount=type=cache,target=/var/cache/apk \
    set -eux; \
    apk add --no-cache --initdb --no-scripts --root /rootfs/development \
    --keys-dir /etc/apk/keys --repositories-file /etc/apk/repositories \
    wolfi-baselayout=${WOLFI_BASELAYOUT_VER} \
    wolfi-keys=${WOLFI_KEYS_VER} \
    glibc=${GLIBC_VER} \
    libgcc=${LIBGCC_VER} \
    zlib=${ZLIB_VER} \
    tzdata=${TZDATA_VER} \
    ca-certificates=${CA_CERTIFICATES_VER} \
    busybox=${BUSYBOX_VER} \
    posix-libc-utils=${POSIX_LIBC_UTILS_VER} \
    libstdc++=${LIBSTDC_PLUS_PLUS_VER} \
    build-base=${BUILD_BASE_VER} \
    pkgconf=${PKGCONF_VER} \
    pcre-dev=${PCRE_DEV_VER} \
    zlib-dev=${ZLIB_DEV_VER} \
    bash=${BASH_VER} \
    curl=${CURL_VER} \
    jq=${JQ_VER} \
    unzip=${UNZIP_VER}; \
    mkdir -p /rootfs/development/etc/apk; \
    cp -a /etc/apk/keys /rootfs/development/etc/apk/; \
    cp -a /etc/apk/repositories /rootfs/development/etc/apk/; \
    cp -a /etc/passwd /rootfs/development/etc/; \
    cp -a /etc/group /rootfs/development/etc/; \
    cp -a /etc/shadow /rootfs/development/etc/; \
    for applet in $(/rootfs/standard/usr/bin/busybox --list); do \
        ln -sf busybox /rootfs/standard/usr/bin/$applet; \
    done; \
    ln -sf busybox /rootfs/standard/usr/bin/sh; \
    echo "hosts: files dns" > /rootfs/development/etc/nsswitch.conf; \
    touch /rootfs/development/etc/resolv.conf /rootfs/development/etc/hosts




FROM ${BASE_IMAGE} AS fips-builder
USER root
ARG BUILD_BASE_VER
ARG PERL_VER
ARG LINUX_HEADERS_VER
ARG WGET_VER
ARG CA_CERTIFICATES_VER
ARG FIPS_VERSION
RUN --mount=type=cache,target=/var/cache/apk \
    apk add --no-cache \
    build-base=${BUILD_BASE_VER} \
    perl=${PERL_VER} \
    linux-headers=${LINUX_HEADERS_VER} \
    wget=${WGET_VER} \
    ca-certificates=${CA_CERTIFICATES_VER}

WORKDIR /src
RUN wget -q https://www.openssl.org/source/old/3.1/openssl-${FIPS_VERSION}.tar.gz || \
    wget -q https://www.openssl.org/source/openssl-${FIPS_VERSION}.tar.gz && \
    tar -xf openssl-${FIPS_VERSION}.tar.gz

WORKDIR /src/openssl-${FIPS_VERSION}
RUN ./Configure enable-fips && \
    make -j$(nproc)

FROM ${BASE_IMAGE} AS core-builder
USER root
ARG CORE_VERSION
ARG BUILD_BASE_VER
ARG PERL_VER
ARG LINUX_HEADERS_VER
ARG WGET_VER
ARG CA_CERTIFICATES_VER
RUN --mount=type=cache,target=/var/cache/apk \
    apk add --no-cache \
    build-base=${BUILD_BASE_VER} \
    perl=${PERL_VER} \
    linux-headers=${LINUX_HEADERS_VER} \
    wget=${WGET_VER} \
    ca-certificates=${CA_CERTIFICATES_VER}

WORKDIR /src
RUN wget -q https://www.openssl.org/source/openssl-${CORE_VERSION}.tar.gz || \
    wget -q https://www.openssl.org/source/old/3.4/openssl-${CORE_VERSION}.tar.gz && \
    tar -xf openssl-${CORE_VERSION}.tar.gz

WORKDIR /src/openssl-${CORE_VERSION}
RUN ./Configure enable-fips shared --prefix=/usr/local --openssldir=/usr/local/ssl && \
    make -j$(nproc) && \
    make install_sw install_ssldirs

FROM core-builder AS fips-integrator
USER root
ARG FIPS_VERSION
RUN ldconfig
COPY --from=fips-builder /src/openssl-${FIPS_VERSION}/providers/fips.so /usr/local/lib/ossl-modules/fips.so

RUN /usr/local/bin/openssl fipsinstall \
    -module /usr/local/lib/ossl-modules/fips.so \
    -out /usr/local/ssl/fipsmodule.cnf \
    -self_test_onload \
    -pedantic \
    -hmac_key_check \
    -kmac_key_check \
    -hkdf_digest_check \
    -hkdf_key_check \
    -kbkdf_key_check \
    -tls13_kdf_digest_check \
    -tls13_kdf_key_check \
    -tls1_prf_digest_check \
    -tls1_prf_key_check \
    -no_drbg_truncated_digests \
    -tdes_encrypt_disabled \
    -signature_digest_check \
    -rsa_pkcs15_padding_disabled \
    -rsa_pss_saltlen_check \
    -rsa_sign_x931_disabled \
    -dsa_sign_disabled \
    -ecdh_cofactor_check \
    -ems_check \
    -no_short_mac

COPY conf/openssl.cnf /usr/local/ssl/openssl.cnf
RUN ln -sf libcrypto.so.3 /usr/local/lib/libcrypto.so && \
    ln -sf libssl.so.3 /usr/local/lib/libssl.so
FROM ${BASE_IMAGE} AS helper
ARG LIBSTDC_PLUS_PLUS_VER
ARG ZLIB_VER
ARG TZDATA_VER
ARG POSIX_LIBC_UTILS_VER
RUN --mount=type=cache,target=/var/cache/apk \
    apk add --no-cache libstdc++=${LIBSTDC_PLUS_PLUS_VER} zlib=${ZLIB_VER} tzdata=${TZDATA_VER} posix-libc-utils=${POSIX_LIBC_UTILS_VER}
RUN addgroup -g 1000 openssl && adduser -u 1000 -G openssl -D -s /bin/bash openssl
RUN mkdir -p /etc && touch /etc/nsswitch.conf
RUN cp /usr/share/zoneinfo/UTC /etc/localtime && echo "UTC" > /etc/timezone








FROM ${STATIC_IMAGE} AS standard
ARG STATIC_IMAGE
COPY --from=producer /rootfs/standard /
ENV PATH="/usr/local/bin:${PATH}" \
    LD_LIBRARY_PATH="/usr/local/lib:/usr/lib:/lib" \
    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
    OPENSSL_CONF=/usr/local/ssl/openssl.cnf \
    OPENSSL_MODULES=/usr/local/lib/ossl-modules \
    TZ=UTC \
    LANG=C.UTF-8
COPY --from=fips-integrator /usr/local/bin/openssl /usr/local/bin/openssl
COPY --from=fips-integrator /usr/local/lib/libcrypto.so* /usr/local/lib/
COPY --from=fips-integrator /usr/local/lib/libssl.so* /usr/local/lib/
COPY --from=fips-integrator /usr/local/lib/ossl-modules /usr/local/lib/ossl-modules
COPY --from=fips-integrator /usr/local/ssl /usr/local/ssl
USER nonroot

FROM ${STATIC_IMAGE} AS distroless
ARG STATIC_IMAGE
COPY --from=producer /rootfs/distroless /
ENV PATH="/usr/local/bin:${PATH}" \
    LD_LIBRARY_PATH="/usr/local/lib:/usr/lib:/lib" \
    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
    OPENSSL_CONF=/usr/local/ssl/openssl.cnf \
    OPENSSL_MODULES=/usr/local/lib/ossl-modules \
    TZ=UTC \
    LANG=C.UTF-8
COPY --from=fips-integrator /usr/local/bin/openssl /usr/local/bin/openssl
COPY --from=fips-integrator /usr/local/lib/libcrypto.so* /usr/local/lib/
COPY --from=fips-integrator /usr/local/lib/libssl.so* /usr/local/lib/
COPY --from=fips-integrator /usr/local/lib/ossl-modules /usr/local/lib/ossl-modules
COPY --from=fips-integrator /usr/local/ssl /usr/local/ssl
USER nonroot

FROM ${STATIC_IMAGE} AS development
ARG STATIC_IMAGE
COPY --from=producer /rootfs/development /
ENV PATH="/usr/local/bin:${PATH}" \
    LD_LIBRARY_PATH="/usr/local/lib:/usr/lib:/lib" \
    SSL_CERT_FILE=/etc/ssl/certs/ca-certificates.crt \
    OPENSSL_CONF=/usr/local/ssl/openssl.cnf \
    OPENSSL_MODULES=/usr/local/lib/ossl-modules \
    TZ=UTC \
    LANG=C.UTF-8
COPY --from=fips-integrator /usr/local /usr/local

USER nonroot




FROM standard AS openssl-standard
ARG CORE_VERSION
ARG FIPS_VERSION

LABEL org.opencontainers.image.title="Wolfi OpenSSL FIPS (Standard)" \
    org.opencontainers.image.vendor="taha2samy" \
    org.opencontainers.image.core-version="${CORE_VERSION}" \
    org.opencontainers.image.fips-version="${FIPS_VERSION}"
COPY --from=producer /rootfs/standard /




USER nonroot
WORKDIR /home/user/nonroot

HEALTHCHECK --interval=30s --timeout=3s --start-period=2s --retries=3 \
    CMD /usr/local/bin/openssl list -providers | grep -q fips || exit 1

ENTRYPOINT ["/usr/local/bin/openssl"]






FROM distroless AS openssl-distroless
ARG CORE_VERSION
ARG FIPS_VERSION

LABEL org.opencontainers.image.title="Wolfi OpenSSL FIPS (distroless)" \
    org.opencontainers.image.description="FIPS 140-3 compliant OpenSSL container (distroless)" \
    org.opencontainers.image.vendor="taha2samy" \
    org.opencontainers.image.core-version="${CORE_VERSION}" \
    org.opencontainers.image.fips-version="${FIPS_VERSION}" \
    org.opencontainers.image.licenses="Apache-2.0" \
    org.opencontainers.image.source="https://github.com/taha2samy/openssl_fips" 
USER nonroot
WORKDIR /home/user/nonroot
HEALTHCHECK --interval=30s --timeout=3s --start-period=2s --retries=3 \
    CMD ["/usr/local/bin/openssl", "sha256", "/dev/null"]

ENTRYPOINT ["/usr/local/bin/openssl"]

FROM development AS openssl-dev

LABEL org.opencontainers.image.title="Wolfi OpenSSL FIPS (development)" \
    org.opencontainers.image.description="FIPS 140-3 compliant OpenSSL container (development)" \
    org.opencontainers.image.vendor="taha2samy" \
    org.opencontainers.image.core-version="${CORE_VERSION}" \
    org.opencontainers.image.fips-version="${FIPS_VERSION}" \
    org.opencontainers.image.licenses="Apache-2.0" \
    org.opencontainers.image.source="https://github.com/taha2samy/openssl_fips" 
USER nonroot
WORKDIR /home/user/nonroot
HEALTHCHECK --interval=30s --timeout=3s --start-period=2s --retries=3 \
    CMD /usr/local/bin/openssl list -providers | grep -q fips || exit 1

ENTRYPOINT ["/bin/bash"]