FIPS 140-3 build cache: run the FIPS image and confirm it

Your contract asks for FIPS-validated cryptography, and you have to show what your build cache actually runs. FosterStack Cache has a FIPS build that uses Go's validated FIPS 140-3 cryptographic module. This page shows how to run it and how to see for yourself that it is in FIPS mode. The outputs below are from the real 0.2.2 images.

DRAFT for v0.3, private preview, not published and never merged before v0.3.0 is live.

What the FIPS build is

It is the same source as the production build, compiled so that it uses Go's validated FIPS 140-3 module (CMVP certificate #5247). It is available as a container image tag ending in -fips, and as Linux binaries for amd64 and arm64, named fscache-fips_X.Y.Z_linux_amd64.tar.gz and fscache-fips_X.Y.Z_linux_arm64.tar.gz. The FIPS image has no shell. There is no macOS FIPS build.

Run it

docker run -d -p 127.0.0.1:8080:8080 -v fscache-data:/home/nonroot \
  ghcr.io/fosterstack/cache:0.2.2-fips

Pin an exact version, as here, rather than a floating tag. To check you pulled the real image, use the steps in Verify a release yourself. The FIPS image's digest in the release manifest for 0.2.2 is sha256:92fae7f20616e553c5fe24e9b92f186c3d3f28ad89cee5c24864911032e6c05e, and that is what the pull returned.

Confirm it is in FIPS mode

The build says so when it starts, so the property can be seen and not just trusted:

$ docker logs <container>
{"time":"2026-10-10T06:01:33.060189845Z","level":"INFO","msg":"fscache: starting","version":"v0.2.2","addr":":8080","data_dir":"./data","max_bytes":0,"auth":"disabled","fips140":"active (Go validated module v1.0.0, CMVP cert #5247)"}

The status page reports the same:

$ curl -s localhost:8080/statusz | grep -E 'version|fips140'
  "version": "v0.2.2",
  "fips140": true,
  "fips140_note": "active (Go validated module v1.0.0, CMVP cert #5247)",

The production image, for comparison, reports it as off:

$ curl -s localhost:8080/statusz | grep -E 'version|fips140'
  "version": "v0.2.2",
  "fips140": false,
  "fips140_note": "off",

What this tells you, and what it does not

• It shows the running program is using Go's validated module. The validation is of that cryptographic module.
• Our own tests run the whole suite against the FIPS build with the module set to refuse any algorithm it does not approve. That proves the code paths the tests reach. Before a release is published, its pipeline starts both candidate images and reads each status page: the -fips image must report FIPS mode active with module v1.0.0, and the production image must report it off. A release that fails this check is not published. The certificate number is our documented mapping for module v1.0.0, not something a binary reports about itself. Checking it yourself, as shown above, is still worth doing.
• FosterStack Cache is not "FedRAMP compliant" or "CMMC compliant". Those attach to your service and your organization, never to a component you deploy. The FIPS build is validated crypto for your compliance program, not a substitute for it.

Related: for teams entering regulated markets and security policy. Details: SECURITY.md.

Moving off the free Build Cache Node? See what the end of life means and the migration guide.