fips base image

[akshaydeo]

Summary

Updates the transports Docker configuration to use a FIPS-compliant base image and removes the built-in health check mechanism.

Changes

• Replaced alpine:3.23.3 base image with dhi.io/alpine-base:3.23-alpine3.23-fips for FIPS compliance
• Removed the Docker HEALTHCHECK directive that was monitoring the /health endpoint

Type of change

• Bug fix
• Feature
• Refactor
• Documentation
• Chore/CI

Affected areas

• Core (Go)
• Transports (HTTP)
• Providers/Integrations
• Plugins
• UI (Next.js)
• Docs

How to test

Verify the Docker image builds successfully with the new base image and that the application starts correctly without the health check.

# Build the Docker image
docker build -t transports-test ./transports

# Run the container
docker run -p 8080:8080 transports-test

# Verify the application is running
curl http://localhost:8080/health

Screenshots/Recordings

N/A

Breaking changes

• Yes
• No

The removal of the Docker HEALTHCHECK may affect container orchestration systems that rely on Docker's built-in health checking. External health monitoring will need to be configured if required.

Related issues

N/A

Security considerations

This change enhances security by adopting a FIPS-compliant base image, which provides cryptographic modules that meet Federal Information Processing Standards.

Checklist

• I read docs/contributing/README.md and followed the guidelines
• I added/updated tests where appropriate
• I updated documentation where needed
• I verified builds succeed (Go and UI)
• I verified the CI pipeline passes locally if applicable

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 37750d9d-fdf8-461b-862e-aec4049dca13

📥 Commits

Reviewing files that changed from the base of the PR and between 6ab490e and 77b533a.

⛔ Files ignored due to path filters (6)

• docs/media/security/codeowners.png is excluded by !**/*.png
• docs/media/security/codeql.png is excluded by !**/*.png
• docs/media/security/dep-pinning.png is excluded by !**/*.png
• docs/media/security/hardned-base-image.png is excluded by !**/*.png
• docs/media/security/scout-image-score.png is excluded by !**/*.png
• docs/media/security/step-security.png is excluded by !**/*.png

📒 Files selected for processing (6)

• Makefile
• config.json
• docs/docs.json
• docs/security.mdx
• transports/Dockerfile
• transports/Dockerfile.local

---

📝 Walkthrough

Summary by CodeRabbit

• New Features

  • Added Security documentation covering defense-in-depth practices including vulnerability scanning, container hardening, supply-chain controls, and deployment security.
  • Added optional configuration file support for local deployments.

• Documentation

  • New Security page now accessible in main navigation with detailed best practices and security controls overview.

• Chores

  • Updated container base image for enhanced security compliance.
  • Removed container health check endpoint.

Walkthrough

The PR updates the Makefile to conditionally select between standard and local Dockerfiles and accept optional configuration parameters, introduces a new Security documentation tab, and adds a comprehensive security guide covering defense-in-depth practices including CI/CD, container hardening, supply-chain controls, and deployment security. Both Dockerfiles migrate to a custom FIPS-compliant base image and remove health checks.

Changes

Cohort / File(s)	Summary
Build Configuration Makefile	Updated docker-image target to conditionally use either transports/Dockerfile or transports/Dockerfile.local based on LOCAL variable; added optional CONFIG parameter to docker-run with dynamic path resolution and conditional mount binding.
Documentation Structure docs/docs.json	Added new "Security" navigation tab with shield icon, routed to security page, positioned before "Benchmarks".
Security Documentation docs/security.mdx	New comprehensive security guide describing defense-in-depth approach covering CI/CD vulnerability scanning (Snyk/SARIF), container hardening (FIPS-compliant base, non-root execution, multi-stage builds), supply-chain controls (GitHub Actions pinning, npm provenance, dependency management), CodeQL analysis, and deployment security (least-privilege permissions, Tailscale VPN, StepSecurity hardening, CODEOWNERS gates).
Container Images transports/Dockerfile, transports/Dockerfile.local	Migrated runtime stage from pinned Alpine base with explicit package installation to custom bifrosthq/dhi-alpine-base:3.22-fips_bifrost-v27032026 image; removed container HEALTHCHECK directive; simplified user/permission setup; added explicit entrypoint permissions in build stage.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

Poem

🛡️ A fortress of security now stands tall,
With documentation guiding through it all,
From FIPS compliance to scanning deep,
Defense-in-depth, the promises we keep,
Configuration flows and Docker's gentle dance,
Bifrost's walls strengthen with each advance! 🐰

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 03-26-fips_base_image

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[akshaydeo]

• fips base image #2310 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

🧪 Test Suite Available

This PR can be tested by a repository admin.

Run tests for PR #2310

[akshaydeo]

Merge activity

• Mar 30, 7:35 AM UTC: A user started a stack merge that includes this pull request via Graphite.
• Mar 30, 7:35 AM UTC: @akshaydeo merged this pull request with Graphite.

[greptile-apps]

Confidence Score: 2/5

Not safe to merge — the main Dockerfile has a path error that will break the Docker build, and missing chown will cause runtime permission failures.

There is a P0 issue (wrong chmod path causes build failure) and a P1 issue (missing chown causes appuser to lack write access to /app) in the primary deliverable of this PR. Both must be resolved before the image can be successfully built and run.

transports/Dockerfile requires the most attention: the wrong chmod path on line 49 and the missing chown on line 84. transports/Dockerfile.local also needs the chown fix.

Important Files Changed

Filename	Overview
transports/Dockerfile	Switches runtime base to FIPS-compliant image and removes HEALTHCHECK; has two blocking issues: wrong chmod path in builder stage (build will fail) and missing chown leaving /app root-owned when running as appuser.
transports/Dockerfile.local	Same FIPS base image switch and HEALTHCHECK removal as Dockerfile; chmod path is correct here (WORKDIR is /build), but the same missing chown issue applies.
Makefile	Adds LOCAL=1 flag to select Dockerfile.local and improves docker-run to support an optional CONFIG path mount — looks correct.
config.json	An empty file added to the repository root — likely an accidental artifact from local testing of the new docker-run CONFIG flag.
docs/security.mdx	New security documentation page covering FIPS hardening, SHA pinning, Snyk/CodeQL scanning, Dependabot, and GitHub Actions permissions — content is accurate and well-structured.
docs/docs.json	Adds the new Security tab/page to the documentation navigation — straightforward and correct.

Comments Outside Diff (1)

1. config.json, line 1 (link)

   Empty config.json committed to repository root

   An empty config.json file has been added to the repository root. This appears unintentional — it has no content and may be a leftover artifact from local testing (e.g. related to the updated docker-run target in the Makefile). If this file is not meant to be tracked, it should be removed and added to .gitignore.

_{Reviews (1): Last reviewed commit: "fips base image" | Re-trigger Greptile}

[greptile-apps]

Wrong path for chmod in builder stage

The builder's WORKDIR is /app and the transports directory is copied there with COPY transports/ ./, so docker-entrypoint.sh lands at /app/docker-entrypoint.sh. The path /build/transports/docker-entrypoint.sh does not exist in this build stage — chmod will fail with a non-zero exit code, causing the Docker build to fail entirely.

This path is correct for Dockerfile.local (where WORKDIR is /build), but it was incorrectly copied verbatim here.

Suggested change

	RUN chmod +x /build/transports/docker-entrypoint.sh
	RUN chmod +x /app/docker-entrypoint.sh

[greptile-apps]

Missing chown for appuser after removing user-creation block

The previous Dockerfile included chown -R appuser:appuser /app alongside the adduser call. Both were removed here, meaning /app (including /app/data/logs and the copied binaries/scripts) is now owned by root. Since the container switches to appuser immediately after, the application may fail at runtime when attempting to write logs or any other data into /app/data/logs.

The FIPS base image is expected to provide appuser, but without chown, that user will not have write access to directories created as root in this stage. The same issue exists in Dockerfile.local (line 94–95).

Consider adding the missing ownership fix:

RUN mkdir -p $APP_DIR/logs && chown -R appuser:appuser /app
USER appuser

[greptile-apps]

New base image not pinned to a digest

The original base image was digest-pinned (alpine:3.23.3@sha256:25109...), which the project's own security documentation highlights as a best practice to prevent supply-chain attacks via mutable tags. The new FIPS base image uses only a mutable version tag (bifrosthq/dhi-alpine-base:3.22-fips_bifrost-v27032026) with no @sha256:... digest.

Consider pinning to the image digest for reproducible and tamper-resistant builds:

FROM bifrosthq/dhi-alpine-base:3.22-fips_bifrost-v27032026@sha256:<digest>

The same applies to Dockerfile.local line 72.