--- title: Building and running FIPS containers on Ubuntu 18.04 description: Build and run Ubuntu containers that comply with the US and Canada government FIPS140-2 data protection standard. url: https://canonical.com/blog/building-and-running-fips-containers-on-ubuntu18-04?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Massimiliano Gori](https://canonical.com/blog/author/massigori "More about Massimiliano Gori") 21 February 2022 # Building and running FIPS containers on Ubuntu 18.04 [containers](https://canonical.com/blog/tag/containers) [FIPS](https://canonical.com/blog/tag/fips) [Security](https://canonical.com/blog/tag/security) [Security certifications and compliance](https://canonical.com/blog/tag/security-certifications-and-compliance) [Ubuntu Pro](https://canonical.com/blog/tag/ubuntu-pro) --- Share the article Whether running on the public cloud or a private cloud, the use of containers is ingrained in today’s devops oriented workflows. Having workloads set up to run under the mandated compliance requirements is thus necessary to fully exploit the potential of containers. This article focuses on how to build and run containers that comply with the [US and Canada government FIPS140-2 data protection standard](https://ubuntu.com/security/fips). To build Ubuntu 18.04 FIPS140-2 compliant containers you will need the FIPS140-2 certified packages, that can be accessed with an [Ubuntu Advantage subscription](https://ubuntu.com/advantage) or with Ubuntu Pro on [AWS](https://ubuntu.com/aws/pro) or [Azure](https://ubuntu.com/azure/pro) In our example we will demonstrate building a FIPS container on an Ubuntu Pro FIPS image. Ubuntu Pro FIPS images are available in [AWS Marketplace](https://aws.amazon.com/marketplace/search/results?x=0&y=0&searchTerms=Ubuntu+Pro) and [Azure Marketplace](https://azure.microsoft.com/en-us/marketplace/). They are preconfigured and optimized for the US and Canada government’s FIPS140-2 data protection standard. They are premium images designed by Canonical and provide the Ubuntu Advantage benefits, without the need for a subscription. Key features include live kernel patching, enabling longer uptimes, and FIPS140-2 certified components to be used for FedRAMP, HIPAA, and PCI use cases. Ubuntu Pro is backed by a 10-year maintenance commitment by Canonical. # **FIPS requirements** Without getting into details of FIPS140-2 it is important to underline that a key concept of FIPS is that its requirements cover the whole system, from kernel to the cryptographic FIPS packages. So when referring to a FIPS container, we are referring to a container image that contains the Ubuntu FIPS cryptographic packages (e.g., libgcrypt, openssl). As container images use the host kernel, that container *must run* under an Ubuntu FIPS enabled kernel in order to comply with the FIPS requirements . As a rule of thumb, each Ubuntu FIPS container must run under the equivalent Ubuntu version system, with FIPS enabled in the kernel. # **Setting up the system to generate a container** The system that will generate the FIPS container must have an Ubuntu Advantage subscription attached to it, or it can be an Ubuntu Pro FIPS image. Ubuntu Pro FIPS images are available in [AWS Marketplace](https://aws.amazon.com/marketplace/search/results?x=0&y=0&searchTerms=Ubuntu+Pro) and [Azure Marketplace](https://azure.microsoft.com/en-us/marketplace/). To keep things simple, in this article, we will demonstrate how to generate such a container on a public cloud instance (AWS or Azure). On AWS EC2 we will be using the ‘Ubuntu Pro FIPS 18.04 LTS’ AMI, and on Azure the ‘Ubuntu Pro FIPS 18.04 LTS’ image. The example is very similar when using an Ubuntu system with the Ubuntu Advantage subscription attached and FIPS enabled ## **Generate the container with the necessary FIPS components** Launch an ‘Ubuntu Pro FIPS 18.04 LTS’ on AWS or Azure. The instances come with FIPS enabled out of the box. The launched instance will be used to build and run the containers with the FIPS packages. Once your FIPS worker instance is running, you can generate a FIPS-compliant container as follows. You can adjust the list of packages installed, to include only the necessary ones for your workload. ``` $ mkdir -p ubuntu18-fips/packages # install docker $ sudo apt-get update $ sudo apt-get install -y docker.io #start the docker daemon $ sudo systemctl start docker # download the FIPS components to be included in the container $ sudo apt-get clean $ sudo apt-get install -y --reinstall --download-only \ openssh-client openssh-client-hmac openssh-server \ openssh-server-hmac strongswan strongswan-hmac \ openssh-sftp-server libstrongswan libstrongswan-standard-plugins \ strongswan-starter strongswan-libcharon strongswan-charon \ openssl libssl1.1 libssl1.1-hmac kcapi-tools libkcapi1 # Next you’ll want to copy those deb packages to your build directory $ cp /var/cache/apt/archives/*.deb ubuntu18-fips/packages/ $ cd ubuntu18-fips $ cat >Dockerfile <<_EOF_ FROM ubuntu:18.04 RUN apt-get update ADD packages packages/ RUN apt-get install -y ./packages/*.deb RUN apt-get clean RUN rm -rf ./packages _EOF_ $ sudo docker build -t ubuntu18-fips . ``` To test your newly created container, inside the Ubuntu FIPS 18.04 LTS run: ``` $ sudo docker run -it ubuntu18-fips bash ``` Your container is now ready and can be pushed to your private registry and used to drive your workloads. ## **Summary** * You can create and run FIPS-enabled containers on any host with a valid Ubuntu Advantage subscription or on Ubuntu Pro FIPS images. * You can run FIPS-enabled containers only on FIPS-enabled hosts to comply with the FIPS140-2 requirements. [Learn more about FIPS in Ubuntu](https://ubuntu.com/security/fips) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Arduino® VENTUNO™ Q is available for pre-order with Ubuntu pre-installed](https://canonical.com/blog/arduino-ventuno-q-is-available-for-pre-order-with-ubuntu-pre-installed) London, UK – August 25, 2026 – Following our initial collaboration announcement in March 2026, Canonical and Arduino (a subsidiary of Qualcomm Technologies, Inc.) are excited... [Canonical](https://canonical.com/blog/author/canonical) 25 August 2026 [### Canonical announces the Enterprise Store as part of Ubuntu Pro](https://canonical.com/blog/canonical-announces-the-enterprise-store) Canonical introduces a new way to manage software behind firewalls and in air-gapped environments with the Enterprise Store. The Enterprise Store makes software distribution... [Holly Hall](https://canonical.com/blog/author/hollyhall) 21 July 2026 [### Tracing a memory leak bug in PID 1 and contributing an upstream fix: a Linux support story](https://canonical.com/blog/fixing-memory-bug) How Canonical Support helped a global retail organization trace the cause for an unusual memory leak originating in PID 1. By investigating the issue across three separate... [Lidia Luna Puerta](https://canonical.com/blog/author/lidia-luna) 17 July 2026