phpmyadmin-fips

packaged by Chainguard

Chainguard Container for phpmyadmin-fips

A minimal wolfi-based FIPS-enabled image for phpMyAdmin, a web interface for administering MySQL and MariaDB databases

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/phpmyadmin-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The Chainguard FIPS Image for phpMyAdmin is a FIPS-enabled build for environments that require FIPS 140 validated cryptography. Like most other Chainguard Images, it has few-to-zero CVEs and does not run as the root user. Because it runs as a nonroot user, it serves on port 8080 rather than the upstream default of 80 (a nonroot user cannot bind the privileged port 80); adjust your port mappings, Kubernetes Services, and health checks accordingly.

FIPS Support

For FIPS compliance this build replaces phpMyAdmin's libsodium cookie and URL-query encryption (XSalsa20-Poly1305 secretbox) with OpenSSL AES-256-GCM. Data encrypted by the non-FIPS build cannot be decrypted here. When migrating from the standard image, regenerate blowfish_secret in your config.inc.php and log in again — existing auth cookies are rejected, so users must re-authenticate.

Getting Started

Using Docker to Deploy

Point phpMyAdmin at a database server with PMA_HOST and run both on the same network:

docker network create phpmyadmin-net

# Start a MariaDB database
docker run -d --network phpmyadmin-net --name db \
  -e MARIADB_ROOT_PASSWORD=secret \
  -e MARIADB_DATABASE=mydb \
  cgr.dev/ORGANIZATION/mariadb:latest

# Start phpMyAdmin (FIPS)
docker run -d --network phpmyadmin-net -p 8080:8080 \
  -e PMA_HOST=db \
  cgr.dev/ORGANIZATION/phpmyadmin-fips:latest

The phpMyAdmin web UI is then available at http://localhost:8080; log in with your database credentials.

For the full set of supported environment variables (PMA_HOST, PMA_ARBITRARY, PMA_USER/PMA_PASSWORD, *_FILE secrets, and more), see the upstream Docker documentation.

Deploying on Kubernetes

Deploy the image with a Deployment and Service, pointing it at your MySQL or MariaDB service with PMA_HOST. The image runs as a nonroot user and serves on port 8080:

kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: phpmyadmin
spec:
  replicas: 1
  selector:
    matchLabels:
      app: phpmyadmin
  template:
    metadata:
      labels:
        app: phpmyadmin
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 65532
        runAsGroup: 65532
        fsGroup: 65532
      containers:
        - name: phpmyadmin
          image: cgr.dev/ORGANIZATION/phpmyadmin-fips:latest
          ports:
            - containerPort: 8080
          env:
            - name: PMA_HOST
              value: mysql.default.svc.cluster.local
---
apiVersion: v1
kind: Service
metadata:
  name: phpmyadmin
spec:
  selector:
    app: phpmyadmin
  ports:
    - port: 8080
      targetPort: 8080
EOF

Once the pod is Ready, port-forward and open the UI:

kubectl port-forward svc/phpmyadmin 8080:8080

Then browse to http://localhost:8080 and log in with your database credentials.

A community Helm chart is also available from HelmForge; note its released chart sets the pod's container port to 80, which must be changed to 8080 for this image.

Documentation and Resources

• phpMyAdmin Documentation
• phpMyAdmin GitHub Repository
• phpMyAdmin Docker Image Documentation
• HelmForge phpMyAdmin Helm Chart

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.