Choosing a Base Image
The Iron Bank offers a range of base images that you can use for your application. This is not a comprehensive list of ALL images that can be used as your base image. Any Iron Bank image can be used as a base image. The table below lists the highest ancestor possible for images.
| Image | Variant | FIPS Friendly |
|---|---|---|
| Alpine | Yes | |
| Chainguard | static, node | |
| Debian | Yes | |
| Docker/Scratch | ||
| Google/Distroless | static, base, cc, java-11 java-17 | |
| Redhat/UBI | ubi, ubi-minimal, ubi-micro | Yes |
| Suse | bci | Yes |
| Ubuntu | Yes |
yaml
args:
BASE_IMAGE: "redhat/ubi/ubi9"
BASE_TAG: "9.3"dockerfile
ARG BASE_REGISTRY=registry1.dso.mil
ARG BASE_IMAGE=ironbank/redhat/ubi/ubi9
ARG BASE_TAG="9.3"
FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}WARNING
The pipeline automatically injects the ironbank namespace and must not be included in the hardening_manifest.yaml. It is included in the Dockerfile to support building images locally. The reason for this is the pipeline injects ironbank-staging for non-production builds.