🐳 Docker FIPS for Node.js and Python

Alpine-based images running Python and Node.js against the OpenSSL FIPS provider built from FIPS 140-3 validated sources (CMVP certificate #4985).

OpenSSL, Python and Node.js come from Alpine packages; only the FIPS provider is compiled. See FIPS.md for the exact compliance posture before making any claim.

Docker Python Node.js FIPS

Images are available at: https://hub.docker.com/r/filigran/alpine-python-nodejs-fips.

Docker Python FIPS

Images are available at: https://hub.docker.com/r/filigran/alpine-python-fips.

Use the images

• For Python, bindings are automatically mapped to the OpenSSL FIPS provider, just run your Python scripts as usual.
• For Node.js, ensure to run your Node.js programs with --enable-fips or --force-fips.
• When installing cryptography, use pip install --no-binary cryptography so that it links the system OpenSSL instead of a bundled one.

Proof of Concept / testing

$ docker run -it filigran/alpine-python-nodejs-fips:latest /bin/sh
$ openssl list -providers
Providers:
  base
    name: OpenSSL Base Provider
    version: 3.5.7
    status: active
  fips
    name: OpenSSL FIPS Provider
    version: 3.1.2
    status: active
$ node --enable-fips -p 'crypto.getFips()'
1
$ python3 -c "import ssl; print(ssl.OPENSSL_VERSION);"
OpenSSL 3.5.7 9 Jun 2026
$ echo test | openssl dgst -md5
Error setting digest

The FIPS provider reports 3.1.2 while the library reports the Alpine version. That difference is expected: the validated module is the provider, and it is supported across OpenSSL library releases.

Previous images

filigran/python-fips and filigran/python-nodejs-fips are no longer published. They remain pullable at their last build but receive no further updates, so pin filigran/alpine-python-fips or filigran/alpine-python-nodejs-fips instead. They differ: npm, yarn and the build toolchain are not installed, and the FIPS provider is built from the OpenSSL 3.1.2 validated sources rather than from the same sources as the libraries, so the set of accepted algorithms differs.