flow-snapshot-worker-fips

packaged by Chainguard

Chainguard Container for flow-snapshot-worker-fips

PeerDB Flow Snapshot Worker - FIPS compliant

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/flow-snapshot-worker-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The flow-snapshot-worker-fips Chainguard Image is a FIPS-compliant variant of the snapshot worker, replacing the upstream ghcr.io/peerdb-io/flow-snapshot-worker image with the following differences:

• Built with FIPS-validated cryptographic modules
• Uses Chainguard's FIPS-hardened Wolfi base
• Includes openssl-config-fipshardened for system-level FIPS compliance
• Maintains the same non-root user configuration (peerdb with UID/GID 65532)
• Provides both standard and -dev variants

While this image includes FIPS-validated system libraries, the Go binary itself uses standard Go cryptography, not FIPS-validated modules. Full FIPS compliance for the application would require upstream PeerDB support for building with go-fips or BoringCrypto.

Getting Started

The FIPS variant functions identically to the standard flow-snapshot-worker image. All configuration and deployment instructions remain the same.

Basic Usage

docker run --rm \
  -e PEERDB_CATALOG_HOST=postgres \
  -e PEERDB_CATALOG_PORT=5432 \
  -e PEERDB_CATALOG_USER=postgres \
  -e PEERDB_CATALOG_PASSWORD=postgres \
  -e PEERDB_CATALOG_DATABASE=postgres \
  -e TEMPORAL_HOST_PORT=temporal:7233 \
  -e PEERDB_TEMPORAL_NAMESPACE=default \
  cgr.dev/chainguard/flow-snapshot-worker-fips:latest

Verifying FIPS Mode

To verify the image is using FIPS-compliant libraries:

docker run --rm --entrypoint sh cgr.dev/chainguard/flow-snapshot-worker-fips:latest-dev -c \
  "openssl version && cat /etc/ssl/openssl.cnf | grep -i fips"

Kubernetes Deployment with FIPS

When deploying to FIPS-compliant Kubernetes clusters:

cat > flow-snapshot-worker-fips-deployment.yaml <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
  name: flow-snapshot-worker-fips
  labels:
    app: flow-snapshot-worker
    fips: "true"
spec:
  replicas: 2
  selector:
    matchLabels:
      app: flow-snapshot-worker
      fips: "true"
  template:
    metadata:
      labels:
        app: flow-snapshot-worker
        fips: "true"
    spec:
      nodeSelector:
        fips-enabled: "true"  # Schedule on FIPS-enabled nodes
      containers:
      - name: flow-snapshot-worker
        image: cgr.dev/chainguard/flow-snapshot-worker-fips:latest
        env:
        - name: PEERDB_CATALOG_HOST
          value: postgres-catalog
        - name: PEERDB_CATALOG_PORT
          value: "5432"
        - name: PEERDB_CATALOG_USER
          valueFrom:
            secretKeyRef:
              name: catalog-credentials
              key: username
        - name: PEERDB_CATALOG_PASSWORD
          valueFrom:
            secretKeyRef:
              name: catalog-credentials
              key: password
        - name: PEERDB_CATALOG_DATABASE
          value: peerdb
        - name: TEMPORAL_HOST_PORT
          value: temporal:7233
        - name: PEERDB_TEMPORAL_NAMESPACE
          value: default
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "1Gi"
            cpu: "500m"
EOF

kubectl apply -f flow-snapshot-worker-fips-deployment.yaml

Configuration

Configuration for the FIPS variant is identical to the standard flow-snapshot-worker image. Refer to the standard image documentation for all environment variables and configuration options.

FIPS Compliance Notes

• System libraries use FIPS-validated OpenSSL
• TLS connections use FIPS-compliant algorithms
• The Go application binary uses standard Go crypto (not FIPS-validated)
• For full application-level FIPS compliance, work with PeerDB upstream to support go-fips builds

Documentation and Resources

• PeerDB Documentation
• Chainguard FIPS Images
• NIST FIPS 140-2 Information

What are Chainguard Containers?

Chainguard Containers are minimal container images that are secure by default.

In many cases, the Chainguard Containers tagged as :latest contain only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager. Chainguard Containers are built with Wolfi, our Linux undistro designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a -dev variant.

Although the -dev container image variants have similar security features as their more minimal versions, they feature additional software that is typically not necessary in production environments. We recommend using multi-stage builds to leverage the -dev variants, copying application artifacts into a final minimal container that offers a reduced attack surface that won’t allow package installations or logins.

Learn More

To better understand how to work with Chainguard Containers, please visit Chainguard Academy and Chainguard Courses.

In addition to Containers, Chainguard offers VMs and Libraries. Contact Chainguard to access additional products.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.