Your Dependencies Don't Care About Your FIPS Configuration

Even with properly configured FIPS-compliant base images, precompiled dependencies can bypass cryptographic controls, forcing teams to rethink dependency management for true supply chain security.

FIPS compliance represents a meaningful step toward securing software supply chains, but teams adopting FIPS-enabled container images are encountering unexpected errors that reveal deeper ecosystem challenges. These issues demonstrate that cryptographic correctness at the base layer doesn't guarantee compatibility across dependency graphs—a critical insight for organizations navigating compliance requirements.

The Hidden Vulnerability in Dependency Chains

Modern applications aren't monolithic executables but intricate webs of dependencies, each carrying potential cryptographic baggage. Consider this real-world scenario: A Rails application running in a Docker FIPS-enabled container passed all surface checks—Ruby used OpenSSL 3.x with FIPS provider, configurations were validated, and FIPS mode was active. Yet ActiveRecord operations triggered cryptographic errors from the PostgreSQL Rubygem module.

The root cause? Precompiled binary artifacts. When installing the pg gem, Bundler often downloads prebuilt binaries linked against non-FIPS-compliant OpenSSL versions. These binaries contain statically embedded crypto logic invisible during standard verification. Crucially, the failure only surfaced during ORM operations, not during basic connection tests—proving that superficial validation misses runtime execution paths.

Why Base Images Aren't Enough

The intuitive solution—forcing source compilation via gem "pg", "~> 1.1", force_ruby_platform: true—reveals deeper systemic challenges. While compiling from source ensures linking against the correct OpenSSL, it necessitates including compilers and headers in build stages. Setting BUNDLE_FORCE_RUBY_PLATFORM globally compounds the problem:

Requires adding build toolchains to images
Forces unnecessary compilation of all native gems
Introduces new dependency management overhead

This isn't a tooling flaw but an ecosystem alignment gap. Today's convenience-driven dependency management clashes with FIPS' strict cryptographic boundaries. As one Docker engineer noted: "The hard part isn't enabling FIPS mode—it's ensuring all moving parts actually respect it."

Practical Steps for FIPS Adoption

Teams can mitigate risks without becoming cryptography experts:

Audit precompiled artifacts: Treat binaries as potentially non-compliant. Use ldd to verify dynamic linking against system OpenSSL.
Implement selective compilation: Use multi-stage builds to compile critical dependencies (like database connectors) in controlled environments while keeping runtime images lean.
Test execution paths, not just startup: Validate operations that trigger deep dependency logic (e.g., running actual database queries in Rails).
Allocate debugging resources: Budget time for tracing crypto usage through dependency graphs using tools like strace.

Beyond Compliance: Building Security Muscle

FIPS requirements are expanding beyond government contracts. As supply chain security becomes a board-level concern across industries, the skills developed through FIPS adoption—dependency tracing, artifact verification, boundary enforcement—translate directly to broader security challenges. Teams solving these issues now gain:

Institutional knowledge for future compliance requirements
Patterns for managing cryptographic boundaries in complex systems
Verification methodologies applicable to software provenance checks

The Strategic Opportunity

Current FIPS complexity represents a transitional phase. As ecosystem tooling evolves—through better prebuilt packages, smarter build systems, and dependency awareness—teams investing in these challenges today will lead tomorrow's supply chain security landscape. Treating FIPS not as a checkbox but as a catalyst for dependency management maturity transforms compliance work into competitive security engineering capability.

Related Posts

Your Dependencies Don't Care About Your FIPS Config | Docker A Safer Container Ecosystem with Docker: Free Docker Hardened Images
Christian Dupuis and Michael Donovan | Dec 17, 2025
Security for everyone. Docker Hardened Images are now free to use. Read now

Your Dependencies Don't Care About Your FIPS Config | Docker Making (Very) Small LLMs Smarter
Philippe Charrière | Jan 16, 2026
Run tiny LLMs locally and still get helpful code. Use vector search with Docker Model Runner. Read now

Permission-Aware RAG: End-to-End Testing with the SpiceDB Testcontainer
Sohan Maheshwar | Jan 15, 2026
Validate permissions in RAG pipelines using Testcontainers and SpiceDB. Read now

OpenCode with Docker Model Runner for Private AI Coding
Ignasi Lopez Luna | Jan 15, 2026
Configure OpenCode to use Docker Model Runner for private, cost-aware coding assistance. [Read now](https://docker.com/blog/opencode-docker-model-runner