coder-fips

packaged by Chainguard

Chainguard Container for coder-fips

FIPS-enabled minimal Wolfi-based image for Coder, the self-hosted platform for provisioning and managing remote development environments

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/coder-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

This is the FIPS variant of the Chainguard coder image. It is a drop-in replacement for the upstream ghcr.io/coder/coder image and links Go's OpenSSL-backed FIPS crypto module:

• The entrypoint is /opt/coder server.
• The image runs as the non-root coder user (uid/gid 1000:1000) with HOME=/home/coder.
• The API and web UI are served on port 3000 by default.
• Runtime dependencies (git, OpenSSH client, curl, bash, OpenSSL, and a bundled Terraform) are included.

FIPS Support

This variant builds Coder against an OpenSSL FIPS-validated cryptographic module (delivered via openssl-config-fipshardened), so all TLS and hashing operations route through the FIPS provider. It is intended for regulated environments (FedRAMP, FISMA, etc.) that require FIPS 140 validated cryptography. For more on FIPS support in Chainguard Images, consult the guide on FIPS-enabled Chainguard Images on Chainguard Academy.

FIPS images are otherwise a drop-in replacement for the standard image; see the standard coder image for general compatibility background.

Getting Started

Coder is typically run against a PostgreSQL database:

docker run --rm -p 3000:3000 \
  -e CODER_PG_CONNECTION_URL="postgresql://coder:coder@postgres:5432/coder?sslmode=disable" \
  -e CODER_ACCESS_URL="http://localhost:3000" \
  cgr.dev/ORGANIZATION/coder-fips:latest

Test FIPS Compliance

To confirm the image's OpenSSL FIPS module is active, run the provided test script:

docker run -it \
 --user root --entrypoint openssl-fips-test \
 cgr.dev/ORGANIZATION/coder-fips

You should see output similar to the following:

Checking OpenSSL lifecycle assurance.
*** Running check: FIPS module is available...
    HMAC : (Module_Integrity) : Pass
    SHA1 : (KAT_Digest) : Pass
    SHA2 : (KAT_Digest) : Pass
    SHA3 : (KAT_Digest) : Pass
    TDES : (KAT_Cipher) : Pass
    AES_GCM : (KAT_Cipher) : Pass
    AES_ECB_Decrypt : (KAT_Cipher) : Pass
    RSA : (KAT_Signature) :     RNG : (Continuous_RNG_Test) : Pass
...

You can review the output for detailed information on OpenSSL module and cipher availability.

Kubernetes / Helm

To run Coder on Kubernetes, use the upstream Helm chart and point the image values at this container image:

helm repo add coder-v2 https://helm.coder.com/v2
helm install coder coder-v2/coder \
  --set coder.image.repo=cgr.dev/ORGANIZATION/coder-fips \
  --set coder.image.tag=latest

See the upstream Install Coder via Helm guide for prerequisites (PostgreSQL, access URL, ingress) and the full set of values.

Documentation and Resources

For configuration options, deployment guides, and Helm chart usage, refer to the upstream Coder documentation.

• Chainguard Academy: FIPS-enabled Containers

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.