FIPS 140-3 build cache: run the FIPS image and confirm it
+FosterStack Cache has a FIPS build that uses Go's validated FIPS 140-3 cryptographic module. This page shows how to run it and how to see for yourself that it is in FIPS mode. The outputs below are from the real 0.2.1 images.
+ +What the FIPS build is
+It is the same source as the standard build, compiled so that it uses Go's validated FIPS 140-3 module (CMVP certificate #5247). It is available as a container image tag ending in -fips, and as Linux binaries for amd64 and arm64. There is no macOS FIPS build.
Run it
+docker run -d -p 127.0.0.1:8080:8080 -v fscache-data:/home/nonroot \
+ ghcr.io/fosterstack/cache:0.2.1-fipsPin an exact version, as here, rather than a floating tag. To check you pulled the real image, use the steps in Verify a release yourself. The FIPS image's digest in the release manifest for 0.2.1 is sha256:e125fe3f6ed2c18c478453300ba2b787a42999edf66a39403877efb39865ab1b, and that is what the pull returned.
Confirm it is in FIPS mode
+The build says so when it starts, so the property can be seen and not just trusted:
+$ docker logs <container>
+{"time":"2026-10-09T01:00:54.861529344Z","level":"INFO","msg":"fscache: starting","version":"v0.2.1","addr":":8080","data_dir":"./data","max_bytes":0,"auth":"disabled","fips140":"active (Go validated module v1.0.0, CMVP cert #5247)"}The status page reports the same:
+$ curl -s localhost:8080/statusz | grep -E 'version|fips140'
+ "version": "v0.2.1",
+ "fips140": true,
+ "fips140_note": "active (Go validated module v1.0.0, CMVP cert #5247)",The standard image, for comparison, reports it as off:
+$ curl -s localhost:8080/statusz | grep -E 'version|fips140'
+ "version": "v0.2.1",
+ "fips140": false,
+ "fips140_note": "off",What this tells you, and what it does not
+-
+
- It shows the running program is using Go's validated module. The validation is of that cryptographic module. +
- Our own tests run the whole suite against the FIPS build with the module set to refuse any algorithm it does not approve. That proves the code paths the tests reach. It does not exercise the released FIPS image itself, which no test currently runs. +
- FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant". Those attach to your service and your organisation, never to a component you deploy. The FIPS build is validated crypto for your compliance program, not a substitute for it. +
Related: for teams entering regulated markets and security policy. Details: SECURITY.md.
+ +