conductor-fips

packaged by Chainguard

Chainguard Container for conductor-fips

A minimal wolfi-based FIPS image for Conductor, an event-driven workflow orchestration engine

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/conductor-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

This is the FIPS variant of the conductor image, intended for workloads that must run in FIPS 140-3 mode.

The conductor-fips Chainguard Container is a drop-in FIPS replacement for the upstream conductoross/conductor image. It reproduces the upstream layout, entrypoint, and ports: the React UI is served on port 5000 and the REST API on port 8080.

A few things to note:

• Like upstream, the image runs as the root user, because the entrypoint (/app/startup.sh) launches and supervises nginx.
• By default the server uses the built-in SQLite persistence profile, so it runs standalone with no external Elasticsearch, Redis, or Postgres. Set the CONFIG_PROP environment variable to a properties file under /app/config to point Conductor at an external backend.

If you need a shell and package manager to build or debug, use the -dev variant of this image.

FIPS Support

The conductor-fips Chainguard Container ships with a validated redistribution of the Bouncy Castle FIPS (BCFIPS) Java security provider and links the FIPS-hardened system OpenSSL. For more on FIPS support in Chainguard Containers, consult the guide on FIPS-enabled Chainguard Containers on Chainguard Academy.

This image is pre-configured to operate in FIPS mode without any additional setup:

• JVM cryptography: the Conductor server uses the BouncyCastle FIPS provider. /app/startup.sh starts the boot jar with a BCFKS trust store (-Djavax.net.ssl.trustStoreType=BCFKS, -Djavax.net.ssl.trustStoreProvider=BCFIPS), so JVM TLS uses only FIPS-approved algorithms.
• nginx / OpenSSL: the bundled nginx links the FIPS-hardened system OpenSSL (openssl-config-fipshardened), so TLS terminated by nginx negotiates only FIPS-approved protocols (TLS 1.2/1.3) and ciphers.
• Fail-closed: the FIPS module is integrity-checked at startup. If the BouncyCastle FIPS provider is tampered with, the server refuses to start rather than silently falling back to non-FIPS cryptography.

When Conductor or the fronting nginx terminates or initiates a TLS connection, provide keystores/truststores in the BCFKS format; legacy JKS/PKCS12 stores and non-FIPS algorithms (e.g. MD5, RC4, 3DES) are not available in FIPS mode.

Getting Started

Run it with the UI (5000) and API (8080) ports exposed:

docker run -d --name conductor-fips -p 5000:5000 -p 8080:8080 \
  cgr.dev/ORGANIZATION/conductor-fips:latest

The UI is then available at http://localhost:5000 and the API health check at http://localhost:8080/health.

Documentation and Resources

• Project Repository
• Documentation
• Running Conductor
• Configuration reference
• Chainguard FIPS images overview
• Community and discussions

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.