dracut | dracut the event driven initramfs infrastructure | Microservice library

Found the solution

WHY this issue was coming: Docker build (to create the image) was run on a machine (the other machine, where cmake was working inside the docker container)... i.e. where FIPS was not installed. During the build step, Docker file was running zypper install cmake (or yum install cmake).

As FIPS was disabled on the machine where docker image was built, cmake was installed in docker image, without understanding FIPS being enabled / dracut-fips being installed.

Then, when you copy this image and consume it on a machine where FIPS is actually ENABLED, then cmake was failing with that error mesg: crypto/fips/fips.c:153: OpenSSL internal error: FATAL FIPS SELFTEST FAILURE

--

Solution #1: Tag your docker image appropriately.

Summary:

PS: If you do install cmake using the above, then it'll only work on target machine where you run container, if that machine's FIPS is disabled or enabled at build time. i.e. if FIPS was enabled, you install cmake and run it on a machine where it's NOT same FIPS setting as the host, where image was built, then you'll be reading this post for help.

Better way in case you want to install cmake using the above package managers, would be, tag your docker image appropriately during image creation time i.e.:

docker build -t -fips-enabled ... if FIPS is enabled

and

docker build -t -fips-disabled ... if FIPS on that that machine is disabled.

That way, you can pick the correct docker image imagename-fips-enabled vs imagename-fips-disabled acc. to what your target machine FIPS setting is (where you'll actually perform docker run ... using this image).

--

Solution #2: Don't use zypper (OpenSuse) or yum if you have RedHat container. and this solution is flexible in the sense, that it's independent of FIPS setting = 0 / 1 on the host, where image was built.

I didn't use zypper/yum to install cmake inside Dockerfile, but just grabbed cmake-3.18.2-Linux-x86_64.tar.gz bundle file.

Within Dockerfile, I simply extracted this .tar.gz file inside some directory. Also I set export PATH:/path/where/I/installed/cmake-3.18.2../bin:/..some_other_paths:/...:/.... in Dockerfile inside RUN statement.

i.e. RUN export PATH=/path/where/I/installed/cmake-3.18.2../bin:/...... && && && ... etc, so it can find the extracted cmake 3.18.2 for any buil-time (cmake operations) and also SET the same PATH=/... variable as ENV PATH=/.... same value used during RUN for PATH so at runtime, when the container runs, $PATH is all set for finding cmake (3.18.2 version) rather than using any existing /usr/bin/cmake or some other shit).

Dockerfile snapshot: