marshallhumble/fips-python repository overview

⁠FIPS-Compliant Python Docker Image

A Python 3.11 container image built from source against OpenSSL 3.1.2 with the FIPS provider enabled. Designed for workloads in regulated environments requiring FIPS 140-2/140-3 approved cryptography, including FedRAMP, CMMC, HIPAA, and PCI-DSS.

⁠What this image provides

• OpenSSL 3.1.2 compiled with enable-fips, holding an active CMVP certificate
• Python 3.11.12 built from source and linked against the FIPS OpenSSL
• cryptography 46.x compiled from source against the same OpenSSL, with no bundled non-FIPS build
• FIPS enforcement at runtime — non-approved algorithms (MD5, RC4, DES) raise exceptions
• Per-host fipsmodule.cnf generation at container startup, satisfying the OpenSSL 3.1.2 requirement that the integrity checksum not be copied between machines

⁠Quick start

docker pull marshallhumble/fips-python:3.11.12
docker run --rm marshallhumble/fips-python:3.11.12 python3 -c "from cryptography.hazmat.primitives import hashes; print('FIPS active')"

⁠Using as a base image

FROM marshallhumble/fips-python:3.11.12

WORKDIR /app
COPY requirements.txt .
RUN uv pip install --system -r requirements.txt

COPY . .
CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "8080"]

⁠FIPS verification

The image includes a FastAPI endpoint at / that attempts an MD5 hash operation. In FIPS mode MD5 is blocked, confirming the provider is active:

docker run --rm -p 8080:8080 marshallhumble/fips-python:3.11.12
curl http://localhost:8080/
# Returns: "FIPS mode is ACTIVE — MD5 is blocked."

⁠How FIPS is enforced

On every container startup the entrypoint runs openssl fipsinstall to generate a fresh fipsmodule.cnf on the current host, runs the FIPS self-tests, verifies the provider loads correctly, then execs the application. If any step fails the container exits rather than starting in a non-FIPS state.

⁠Kubernetes deployments

If your cluster enforces a read-only root filesystem, mount a writable volume at /etc/ssl so the entrypoint can write the generated config:

volumes:
  - name: openssl-config
    emptyDir: {}
volumeMounts:
  - name: openssl-config
    mountPath: /etc/ssl

⁠Tags

Pin to a digest for production use:

docker pull marshallhumble/fips-python@sha256:<digest>

⁠Security

Vulnerability scanning with Trivy runs on every build. The SBOM is published in SPDX format alongside each release. See SECURITY.md⁠ for the full security policy, known findings, and how to report vulnerabilities.

⁠Source

github.com/marshallhumble/fipsDocker⁠

MIT License