Chainguard Container for go-msft-fips

Container image for building Go applications with FIPS

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/go-msft-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Go FIPS with OpenSSL

This image provides go toolchain that produces FIPS compliant binaries. It is go toolchain compiled with microsoft/go patches applied. The image itself has the go binary itself compiled in FIPS compliant mode, and contains a CMVP certified OpenSSL FIPS provider.

The image has recommended environment variables set to compile binaries in enforcing mode.

• CGO_ENABLED=1
• GOEXPERIMENT=systemcrypto
• GODEBUG=fips140=on
• GOFLAGS=-tags=requirefips

Further documentation is available from upstream:

• README covering build and runtime options
• User Guide covering changes to individual golang standard library APIs

Whilst Chainguard's edition of OpenSSL FIPS is recommended, the resulting binaries are vendor-agnostic and can be used at runtime with OpenSSL FIPS providers on other OpenSSL FIPS hosts.

FIPS compliance is achieved by not using any native golang cryptographic functionality and redirecting all calls to OpenSSL at runtime.

If no other cryptographic algorithms are implemented or used, certification status will depend on the runtime OpenSSL FIPS certification. For Chainguard that is #4282 and the submitted rebrand of that.

Usage guidance

Default execution of the container has all of the recommended flags preset. The toolchain defaults to GOEXPERIMENT=systemcrypto, even when GOEXPERIMENT variable is unset.

• Use CGO_ENABLED=1
• Either compile applications with -tags=requirefips OR use GODEBUG=fips140=on at runtime
• Ensure runtime environment has OpenSSL with FIPS provider (e.g. cgr.dev/chainguard-private/glibc-openssl-fips image)

Interactive build with FIPS operation validation

This section contains two examples of how you can use the Go FIPS Chainguard Image to build an example Go application. For more information on working with this Image, check out our Getting Started with the Go Chainguard Image guide.

Start interactive shell in the go-msft-fips image:

docker run --rm -ti --user root -w /root --entrypoint bash cgr.dev/chainguard-private/go-msft-fips:latest

User root is used here, to perform tampering with the FIPS module selfcheck after compiling and running the application.

Install a golang demo application helloserver:

# go install golang.org/x/example/helloserver@latest
go: downloading golang.org/x/example v0.0.0-20240205180059-32022caedd6a
go: downloading golang.org/x/example/helloserver v0.0.0-20240205180059-32022caedd6a

Observe build settings used to build the binary:

# go version -m go/bin/helloserver
go/bin/helloserver: go1.25.0
        path    golang.org/x/example/helloserver
        mod     golang.org/x/example/helloserver        v0.0.0-20250605160450-8b405629c4a5      h1:0JvruIGF0CrrXuph0bOeqKYj2LBuyxi2VVkpNL321EE=
        build   microsoft_systemcrypto=1
        build   -buildmode=exe
        build   -compiler=gc
        build   -tags=requirefips
        build   DefaultGODEBUG=asynctimerchan=1,containermaxprocs=0,decoratemappings=0,fips140=on,gotestjsonbuildtext=1,gotypesalias=0,httplaxcontentlength=1,httpmuxgo121=1,httpservecontentkeepheaders=1,multipathtcp=0,panicnil=1,randseednop=0,rsa1024min=0,tls10server=1,tls3des=1,tlsmlkem=0,tlsrsakex=1,tlssha1=1,tlsunsafeekm=1,updatemaxprocs=0,winreadlinkvolume=0,winsymlink=0,x509keypairleaf=0,x509negativeserial=1,x509rsacrt=0,x509sha256skid=0,x509usepolicies=0
        build   CGO_ENABLED=1
        build   CGO_CFLAGS=
        build   CGO_CPPFLAGS=
        build   CGO_CXXFLAGS=
        build   CGO_LDFLAGS=
        build   GOARCH=amd64
        build   GOFIPS140=latest
        build   GOOS=linux
        build   GOAMD64=v1

Observe the following settings are in place:

• build CGO_ENABLED=1 enables access to OpenSSL via CGO
• build microsoft_systemcrypto=1 enables systemcrypto
• build -tags=requirefips ensures FIPS mode is enforced at the binary startup

Verify that OpenSSL symbols are used by the binary:

# $ go tool nm go/bin/helloserver | grep -e OpenSSL_version
  6a4300 T _cgo_ba70ff964674_Cfunc__mkcgo_OpenSSL_version
  6a4340 T _cgo_ba70ff964674_Cfunc__mkcgo_OpenSSL_version_num
  6a46a0 T _cgo_ba70ff964674_Cfunc__mkcgo_available_OpenSSL_version_num
  a0ecf0 D _g_OpenSSL_version
  a0ece8 D _g_OpenSSL_version_num
  6acb90 T _mkcgo_OpenSSL_version
  6acbc0 T _mkcgo_OpenSSL_version_num
  6acba0 T _mkcgo_available_OpenSSL_version_num
  4fbe60 t vendor/github.com/golang-fips/openssl/v2/internal/ossl._Cfunc__mkcgo_OpenSSL_version.abi0
  4fbf00 t vendor/github.com/golang-fips/openssl/v2/internal/ossl._Cfunc__mkcgo_OpenSSL_version_num.abi0
  4fc380 t vendor/github.com/golang-fips/openssl/v2/internal/ossl._Cfunc__mkcgo_available_OpenSSL_version_num.abi0
  9a3898 d vendor/github.com/golang-fips/openssl/v2/internal/ossl._cgo_ba70ff964674_Cfunc__mkcgo_OpenSSL_version
  9a38a0 d vendor/github.com/golang-fips/openssl/v2/internal/ossl._cgo_ba70ff964674_Cfunc__mkcgo_OpenSSL_version_num
  9a38e0 d vendor/github.com/golang-fips/openssl/v2/internal/ossl._cgo_ba70ff964674_Cfunc__mkcgo_available_OpenSSL_version_num

Note that golang-fips/openssl/v2 are the underlying bindings for all the available APIs, even if individual binary may not use all of them.

Verify binary execution with suitable OpenSSL FIPS provider (use Ctrl+C to terminate):

# go/bin/helloserver
2024/04/15 10:22:21 serving http://localhost:8080
^C

Now tamper with the fips provider to observe failure to start the application in FIPS mode

# cp /etc/ssl/fipsmodule.cnf /etc/ssl/fipsmodule.cnf.back
# sed -i 's|:*|:00|' /etc/ssl/fipsmodule.cnf
# go/bin/helloserver
panic: opensslcrypto: FIPS mode requested (environment variable GODEBUG=fips140=on) but not available: OpenSSL 3.5.2 5 Aug 2025

goroutine 1 [running]:
crypto/internal/backend.init.0()
        /usr/lib/go/src/crypto/internal/backend/openssl_linux.go:48 +0x129

As you can see above helloserver panics when on startup OpenSSL FIPS fails self tests.

Now restore fipsmodule.cnf to get back into operational state:

cp /etc/ssl/fipsmodule.cnf.back /etc/ssl/fipsmodule.cnf

Dockerfile example

The following example Dockerfile builds a helloserver program in Go and copies it on top of the cgr.dev/chainguard-private/glibc-openssl-fips:latest base image:

FROM cgr.dev/chainguard-private/go-msft-fips:latest AS build

RUN go install golang.org/x/example/helloserver@latest

FROM cgr.dev/chainguard-private/glibc-openssl-fips:latest

COPY --from=build /home/nonroot/go/bin/helloserver /helloserver
CMD ["/helloserver"]

Run the following command to build the demo image and tag it as go-helloserver-fips:

docker build -t go-helloserver-fips .

Now you can run the image with:

docker run go-helloserver-fips

What are Chainguard Containers?

Chainguard Containers are minimal container images that are secure by default.

In many cases, the Chainguard Containers tagged as :latest contain only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager. Chainguard Containers are built with Wolfi, our Linux undistro designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a -dev variant.

Although the -dev container image variants have similar security features as their more minimal versions, they feature additional software that is typically not necessary in production environments. We recommend using multi-stage builds to leverage the -dev variants, copying application artifacts into a final minimal container that offers a reduced attack surface that won’t allow package installations or logins.

Learn More

To better understand how to work with Chainguard Containers, please visit Chainguard Academy and Chainguard Courses.

In addition to Containers, Chainguard offers VMs and Libraries. Contact Chainguard to access additional products.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.