apicurio-registry-fips

packaged by Chainguard

Chainguard Container for apicurio-registry-fips

FIPS-compliant build of Apicurio Registry, a datastore for sharing standard event schemas and API designs across event-driven and API architectures.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/apicurio-registry-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Image Components

This module provides the FIPS-validated builds of the Apicurio Registry family:

• apicurio-registry-fips: The main registry backend (Java/Quarkus application)
• apicurio-registry-3-operator-fips: The Kubernetes operator (Java/Quarkus application)

There is no FIPS UI variant. The web UI is served by the standard (non-FIPS) apicurio-registry-ui image (nginx serving static assets), which pairs with the FIPS registry.

Compatibility Notes

The Chainguard FIPS images are minimal, secure builds of the upstream images:

The web UI uses the non-FIPS cgr.dev/chainguard/apicurio-registry-ui image.

The Chainguard images differ from upstream in the following ways:

FIPS Support

These images run under the BouncyCastle FIPS provider:

• bcfips-policy registers BouncyCastle as the JVM security provider, and openssl-config-fipshardened enables FIPS mode for OpenSSL.
• The BouncyCastle FIPS module is loaded via JAVA_TOOL_OPTIONS=--module-path=/usr/share/java/bouncycastle-fips -Djavax.net.ssl.trustStoreType=FIPS; trustStoreType=FIPS lets the TLS client read the JVM cacerts under BouncyCastle FIPS.
• The FIPS images pass the enforced DISA STIG scan.

No JBoss Container Scripts

The upstream image includes JBoss container scripts (/opt/jboss/container/) that process various environment variables for JVM configuration, debugging, and proxy settings. The Chainguard image runs the Quarkus application directly without these scripts.

Environment variables NOT supported in the Chainguard image:

To achieve equivalent functionality in Chainguard images, pass JVM options directly via JAVA_TOOL_OPTIONS (honored by the JVM natively, since the image has no shell):

# Example: Set memory limits and enable debugging
docker run -d \
  -e JAVA_TOOL_OPTIONS="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager -XX:MaxRAMPercentage=80.0 -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=5005" \
  cgr.dev/ORGANIZATION/apicurio-registry-fips:latest

(The apicurio-registry-3-operator-fips image launches via sh -c and also honors JAVA_OPTIONS.)

Minimal Base Image

The Chainguard image is built on a minimal base with only the essential components:

• OpenJDK 21 runtime
• BouncyCastle FIPS provider and Quarkus application JARs
• No shell or package manager in the registry production variant

UI Image Differences (apicurio-registry-ui)

FIPS deployments use the non-FIPS apicurio-registry-ui image, which differs from the upstream image (quay.io/apicurio/apicurio-registry-ui) in the following ways:

No S2I (Source-to-Image) Scripts

The upstream UI image uses Red Hat's S2I framework with scripts in /usr/libexec/s2i/. The Chainguard image runs nginx directly without S2I:

Nginx Configuration Changes

The nginx configuration has been modified for compatibility with Wolfi/Alpine nginx:

If you need TLS termination at the UI container, configure it via an ingress controller, service mesh sidecar, or mount certificates and provide a custom nginx configuration.

Storage Backends

Apicurio Registry supports multiple storage backends:

• In-memory (default): Data is not persisted across restarts
• KafkaSQL: Uses Apache Kafka for persistent storage

Configure the storage backend using environment variables:

# In-memory (default)
APICURIO_STORAGE_KIND=mem

# Kafka storage
APICURIO_STORAGE_KIND=kafkasql
APICURIO_KAFKASQL_BOOTSTRAP_SERVERS=kafka:9092

Running with Docker

Basic Setup (In-memory Storage)

# Start the registry backend
docker run -d \
  --name apicurio-registry-fips \
  -p 8080:8080 \
  cgr.dev/ORGANIZATION/apicurio-registry-fips:latest

# Start the UI (optional; non-FIPS UI image)
docker run -d \
  --name apicurio-registry-ui \
  -p 8888:8080 \
  -e REGISTRY_API_URL="http://localhost:8080/apis/registry/v3" \
  cgr.dev/ORGANIZATION/apicurio-registry-ui:latest

With Kafka Storage

# Start Kafka first (using Confluent Kafka as an example)
docker network create apicurio-net

docker run -d \
  --name kafka \
  --hostname kafka \
  --network apicurio-net \
  -e KAFKA_NODE_ID=1 \
  -e KAFKA_PROCESS_ROLES='broker,controller' \
  -e KAFKA_LISTENER_SECURITY_PROTOCOL_MAP='CONTROLLER:PLAINTEXT,PLAINTEXT:PLAINTEXT' \
  -e KAFKA_LISTENERS='PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093' \
  -e KAFKA_ADVERTISED_LISTENERS='PLAINTEXT://kafka:9092' \
  -e KAFKA_CONTROLLER_LISTENER_NAMES='CONTROLLER' \
  -e KAFKA_CONTROLLER_QUORUM_VOTERS='1@kafka:9093' \
  -e KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1 \
  -e CLUSTER_ID='MkU3OEVBNTcwNTJENDM2Qk' \
  confluentinc/cp-kafka:latest

# Start Apicurio Registry with Kafka storage
docker run -d \
  --name apicurio-registry-fips \
  --network apicurio-net \
  -p 8080:8080 \
  -e APICURIO_STORAGE_KIND=kafkasql \
  -e APICURIO_KAFKASQL_BOOTSTRAP_SERVERS=kafka:9092 \
  cgr.dev/ORGANIZATION/apicurio-registry-fips:latest

Deployment on Kubernetes

Basic Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: apicurio-registry
spec:
  replicas: 1
  selector:
    matchLabels:
      app: apicurio-registry
  template:
    metadata:
      labels:
        app: apicurio-registry
    spec:
      containers:
      - name: registry
        image: cgr.dev/ORGANIZATION/apicurio-registry-fips:latest
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: apicurio-registry
spec:
  selector:
    app: apicurio-registry
  ports:
  - port: 8080
    targetPort: 8080

UI Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: apicurio-registry-ui
spec:
  replicas: 1
  selector:
    matchLabels:
      app: apicurio-registry-ui
  template:
    metadata:
      labels:
        app: apicurio-registry-ui
    spec:
      containers:
      - name: registry-ui
        image: cgr.dev/ORGANIZATION/apicurio-registry-ui:latest
        ports:
        - containerPort: 8080
        env:
        - name: REGISTRY_API_URL
          value: "http://apicurio-registry:8080/apis/registry/v3"
---
apiVersion: v1
kind: Service
metadata:
  name: apicurio-registry-ui
spec:
  selector:
    app: apicurio-registry-ui
  ports:
  - port: 8080
    targetPort: 8080

TLS Configuration

Enable TLS on the registry using Quarkus HTTP configuration:

env:
- name: QUARKUS_HTTP_SSL_PORT
  value: "8443"
- name: QUARKUS_HTTP_SSL_CERTIFICATE_FILES
  value: "/etc/tls/tls.crt"
- name: QUARKUS_HTTP_SSL_CERTIFICATE_KEY_FILES
  value: "/etc/tls/tls.key"
- name: QUARKUS_HTTP_INSECURE_REQUESTS
  value: "disabled"  # or "redirect" to redirect HTTP to HTTPS

Mount TLS certificates from a Kubernetes Secret:

volumeMounts:
- name: tls-certs
  mountPath: /etc/tls
  readOnly: true
volumes:
- name: tls-certs
  secret:
    secretName: apicurio-registry-tls

Documentation and Resources

• Apicurio Registry Documentation
• Apicurio Registry GitHub
• Apicurio Registry API Documentation

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.