FIPS JDK 21 Image

Here’s a Dockerfile tailored for your FIPS-compliant Spring Boot application with JDK 21, along with explanations:

# FIPS-Compliant Base Image
FROM redhat/ubi9-minimal:9.2-814 # FIPS-validated Red Hat Universal Base Image

# Install Required Packages and JDK 21
RUN microdnf install -y --nodocs \
    java-21-openjdk-headless \
    openssl-libs-fips \
    && microdnf clean all \
    && sed -i 's/securerandom=drng/securerandom=drng_fips/g' /etc/crypto-policies/back-ends/openjdk.config \
    && update-crypto-policies --set FIPS

# Enable FIPS Mode
ENV OPENSSL_CONF=/etc/pki/tls/openssl.cnf

# Application User
RUN groupadd -r spring && useradd -r -g spring spring

# Set Working Directory
USER spring
WORKDIR /home/spring

# Copy Application JAR
COPY --chown=spring:spring target/your-spring-boot-app.jar app.jar

# Expose Port (Change if needed)
EXPOSE 8080

# Run Application
ENTRYPOINT ["java", "-Djava.security.egd=file:/dev/./urandom", "-jar", "app.jar"]

Key Points & Explanation:

• FIPS-validated Base Image:
  • We start with redhat/ubi9-minimal:9.2-814, a Red Hat Universal Base Image that’s FIPS-validated. This ensures a secure foundation for our container.
• FIPS-Compliant JDK 21:
  • We install the java-21-openjdk-headless package, which provides the FIPS-compliant JDK 21. The -headless option is used for server-side applications.
• OpenSSL FIPS Module:
  • We include the openssl-libs-fips package for FIPS-validated cryptographic operations.
• Enable FIPS Mode:
  • The sed command modifies the openjdk.config file to use the FIPS-compliant DRNG (Deterministic Random Number Generator), and update-crypto-policies sets the system-wide cryptographic policy to FIPS. We also set the OPENSSL_CONF environment variable to the FIPS-compliant OpenSSL configuration file.
• Security Best Practices:
  • An unprivileged spring user is created and used to run the application, enhancing security.
  • The -Djava.security.egd=file:/dev/./urandom option is added to improve the startup time of Spring Boot applications.
• Customization:
  • Replace your-spring-boot-app.jar with the actual name of your Spring Boot JAR file.
  • If your application uses a different port than 8080, modify the EXPOSE instruction accordingly.

Build & Run:

1. Build Image:

   docker build -t my-fips-spring-app .
   

2. Run Container:

   docker run -p 8080:8080 my-fips-spring-app
   

Important Considerations:

• FIPS Certification: Make sure your Spring Boot application itself is designed to be FIPS-compliant. If it uses any external libraries or components, ensure they’re also FIPS-certified or compatible.
• Testing: Thoroughly test your application in the Docker container to verify that FIPS mode is working correctly and that all functionalities are behaving as expected.