Chapter 8. Enabling FIPS mode in a bootc image build

Procedure

1. Create a 01-fips.toml to configure FIPS enablement, for example:

   # Enable FIPS
   kargs = ["fips=1"]

2. Create a Containerfile with the following instructions to enable the fips=1 kernel argument and adjust the cryptographic policies:

   FROM registry.redhat.io/rhel10/rhel-bootc:latest
   # Enable fips=1 kernel argument: https://bootc-dev.github.io/bootc/building/kernel-arguments.html
   COPY 01-fips.toml /usr/lib/bootc/kargs.d/
   # Install and enable the FIPS crypto policy
   RUN dnf install -y crypto-policies-scripts && update-crypto-policies --no-reload --set FIPS

3. Before running the container, initialize the output folder. Use the -p argument to ensure that the command does not fail if the directory already exists:

   $ mkdir -p ./output

4. Create your bootc <image> compatible base disk image by using Containerfile in the current directory:

   $ sudo podman run \
       --rm \
       -it \
       --privileged \
       --pull=newer \
       --security-opt label=type:unconfined_t \
       -v ./config.toml:/config.toml:ro \
       -v ./output:/output \
       -v /var/lib/containers/storage:/var/lib/containers/storage \
       registry.redhat.io/rhel10/bootc-image-builder:latest \
       --type iso \
       quay.io/<namespace>/<image>:<tag>

5. Enable FIPS mode during the system installation:

   1. When booting the RHEL Anaconda installer, on the installation screen, press the TAB key and add the fips=1 kernel argument. After the installation, the system starts in FIPS mode automatically.