solr-fips

packaged by Chainguard

Chainguard Container for solr-fips

Solr is an open-source multi-modal search platform built on top of Lucene.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/solr-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

Chainguard's solr-fips container image is comparable to the official Solr image on Docker Hub. It uses the FIPS-enabled Solr package and includes the Java FIPS runtime configuration required by that package.

Upstream publishes two distributions of every release, and so do we:

Solr 10 removed the Prometheus exporter upstream, so only the 9 stream's full distribution ships it.

The plain tags now carry the full distribution. If you were previously pulling solr-fips:9, solr-fips:10, or solr-fips:latest, those images continue to hold the slim distribution under the -slim tags (9-slim, 10-slim, latest-slim); pin to a -slim tag to keep today's content.

On the 9 stream, the full distribution's modules/extraction tree ships without the non-FIPS BouncyCastle jars it bundles upstream, so parsing encrypted documents through that module is unavailable in the FIPS image. Solr 10 delegates extraction to a separate Tika Server and bundles no BouncyCastle there, so its extraction module is unaffected.

The full distribution bundles Solr's optional modules, whose dependency surface is wider than the slim distribution's. Some of those module dependencies carry security advisories that cannot be remediated without breaking module functionality, so they remain on their upstream versions. The slim distribution ships none of these modules and is not exposed to them.

Solr is installed at /usr/share/java/solr rather than /opt/solr, which changes two values in the image config:

The command (solr-foreground), the user (uid 8983), and the SOLR_HOME, SOLR_LOGS_DIR and SOLR_PID_DIR locations under /var/solr all match upstream. Update anything that refers to /opt/solr, such as bind mounts for configsets or custom jars, COPY instructions in a derived image, and scripts that call /opt/solr/bin/solr. docker-entrypoint.sh stays on PATH, so an unqualified entrypoint override still resolves.

FIPS Support

The solr-fips Chainguard Container ships with a validated redistribution of BouncyCastle's FIPS Java provider (BC-FIPS) and runs it in FIPS-approved-only mode by default, enforced via the JVM's java.security configuration. Only FIPS 140-3 approved algorithms are available to Solr's JVM; non-approved algorithms (e.g. MD5, SHA-1 signatures, RSA keys under 2048 bits) throw a FipsUnapprovedOperationError rather than silently succeeding. For more on FIPS support in Chainguard Containers, consult the guide on FIPS-enabled Chainguard Containers on Chainguard Academy.

User-supplied Java TLS keystores and truststores should use BCFKS with FIPS-approved algorithms, such as RSA 2048-bit keys and SHA-256 signatures. PKCS#12 and JKS keystores are not supported. Client PEM material using FIPS-approved algorithms is supported for TLS clients. Non-approved TLS protocols, cipher suites, certificate signatures, and EC parameters such as TLS 1.1, ChaCha20, SHA-1, secp256k1 TLS groups, and sub-224-bit EC client certificates are rejected.

HTTP/2 is not supported when Solr TLS is enabled in this FIPS image. The default Apache Solr HTTPS Jetty configuration enables ALPN and HTTP/2; configure the HTTPS connector for HTTP/1.1 only before setting SOLR_SSL_ENABLED=true.

Getting Started

Deploy with Solr Operator

The recommended way to deploy Solr in Kubernetes is using the official Apache Solr Operator:

helm repo add apache-solr https://solr.apache.org/charts
helm repo update

helm install solr-operator apache-solr/solr-operator \
  --namespace solr-operator \
  --create-namespace \
  --set zookeeper-operator.crd.create=true

Create a SolrCloud manifest that uses the Chainguard FIPS image:

apiVersion: solr.apache.org/v1beta1
kind: SolrCloud
metadata:
  name: solr
spec:
  replicas: 1
  solrImage:
    repository: cgr.dev/ORGANIZATION/solr-fips
    tag: latest

Deploy with Docker

Run Solr with persistent storage:

docker run -d \
  -p 8983:8983 \
  -v solr-data:/var/solr \
  cgr.dev/ORGANIZATION/solr-fips:latest

After starting, access the Solr Admin Console at http://localhost:8983/solr/.

Documentation and Resources

• Apache Solr Documentation
• Solr on Docker Guide
• Solr Operator Documentation

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.