Root provides FIPS 140-3 validated base images for workloads running in regulated environments - FedRAMP, DoD, financial services, and healthcare. These images use wolfSSL FIPS v5.8.2 (CMVP Certificate #4718) as the cryptographic provider.
Cryptographic Profile
Approved Algorithms
Blocked Algorithms
SHA-1 and MD5 are blocked at the library level. This is stricter than the base FIPS 140-3 standard, which permits SHA-1 in some legacy contexts. Applications that depend on SHA-1 (older TLS configurations, legacy JWT signing, some Git operations) will fail at runtime.
Blocking SHA-1 is technically outside the FIPS 140-3 approved operating mode. If your compliance requirement demands strict adherence to the approved algorithm list without additional restrictions, contact Root to discuss a build variant without the SHA-1 block.
Supply Chain Artifacts
Every FIPS image ships with a full set of supply chain attestations:
Downloading the SBOM
STIG Compatibility
FIPS images include an OpenSCAP baseline scan against the STIG profile for Ubuntu 22.04. The scan output is available as an artifact alongside the SBOM. This covers the OS-level hardening requirements separate from the cryptographic module certification.
Using FIPS Images
Switch the base image in your Dockerfile:
Pull the image after authenticating:
Attestation Verification Workflow
A reference GitHub Actions workflow for verifying all attestations before deployment:
The full reference workflow (including VEX verification and OpenSCAP report download) is available at github.com/rootio-avr/fips-attestations. 
