FIPS 140-3 build cache: run the FIPS image and confirm it

FosterStack Cache has a FIPS build that uses Go's validated FIPS 140-3 cryptographic module. This page shows how to run it and how to see for yourself that it is in FIPS mode. The outputs below are from the real 0.2.2 images.

What the FIPS build is

It is the same source as the standard build, compiled so that it uses Go's validated FIPS 140-3 module (CMVP certificate #5247). It is available as a container image tag ending in -fips, and as Linux binaries for amd64 and arm64. There is no macOS FIPS build.

Run it

docker run -d -p 127.0.0.1:8080:8080 -v fscache-data:/home/nonroot \
  ghcr.io/fosterstack/cache:0.2.2-fips

Pin an exact version, as here, rather than a floating tag. To check you pulled the real image, use the steps in Verify a release yourself. The FIPS image's digest in the release manifest for 0.2.2 is sha256:92fae7f20616e553c5fe24e9b92f186c3d3f28ad89cee5c24864911032e6c05e, and that is what the pull returned.

Confirm it is in FIPS mode

The build says so when it starts, so the property can be seen and not just trusted:

$ docker logs <container>
{"time":"2026-10-10T06:01:33.060189845Z","level":"INFO","msg":"fscache: starting","version":"v0.2.2","addr":":8080","data_dir":"./data","max_bytes":0,"auth":"disabled","fips140":"active (Go validated module v1.0.0, CMVP cert #5247)"}

The status page reports the same:

$ curl -s localhost:8080/statusz | grep -E 'version|fips140'
  "version": "v0.2.2",
  "fips140": true,
  "fips140_note": "active (Go validated module v1.0.0, CMVP cert #5247)",

The standard image, for comparison, reports it as off:

$ curl -s localhost:8080/statusz | grep -E 'version|fips140'
  "version": "v0.2.2",
  "fips140": false,
  "fips140_note": "off",

What this tells you, and what it does not

It shows the running program is using Go's validated module. The validation is of that cryptographic module.
Our own tests run the whole suite against the FIPS build with the module set to refuse any algorithm it does not approve. That proves the code paths the tests reach. Before publishing, the release runs the released FIPS binary (Linux, amd64) and requires its status page to show the active (Go validated module ...) line. It also starts the FIPS image and stores and fetches a test entry through it. No test yet reads the status page of the running FIPS image, so checking it yourself, as shown above, is still worth doing.
FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant". Those attach to your service and your organisation, never to a component you deploy. The FIPS build is validated crypto for your compliance program, not a substitute for it.

Verify a release yourself FosterStack home