Choosing a Base Image
The Iron Bank offers a range of base images that you can use for your application. This is not a comprehensive list of ALL images that can be used as your base image. Any Iron Bank image can be used as a base image. The table below lists the highest ancestor possible for images.
Image | Variant | FIPS Friendly |
---|---|---|
Alpine | Yes | |
Chainguard | static , node |
|
Debian | Yes | |
Docker/Scratch | ||
Google/Distroless | static , base , cc , java-11 java-17 |
|
Redhat/UBI | ubi , ubi-minimal , ubi-micro |
Yes |
Suse | bci |
Yes |
Ubuntu | Yes |
hardening_manifest.yaml
args:
BASE_IMAGE: "redhat/ubi/ubi9"
BASE_TAG: "9.3"
Dockerfile
ARG BASE_REGISTRY=registry1.dso.mil
ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9
ARG BASE_TAG="9.3"
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
Warning
The pipeline automatically injects the ironbank namespace and must not be included in the hardening_manifest.yaml
. It is included in the Dockerfile to support building images locally. The reason for this is the pipeline injects ironbank-staging for non-production builds.