FIPS Related crash on all Noble containers

[icsy7867]

Running any of the noble containers (Such as Tag 11.0.11-jdk25-temurin-noble) is always failing to run in kubernetes and on my podman server where FIPS is enabled.

The older Jammy container tags seem to still work.

...
4-Oct-2025 15:46:03.069 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded Apache Tomcat Native library [2.0.9] using APR version [1.7.2].
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007fbfadee7234, pid=1, tid=5
#
# JRE version: OpenJDK Runtime Environment Temurin-25+36 (25.0+36) (build 25+36-LTS)
# Java VM: OpenJDK 64-Bit Server VM Temurin-25+36 (25+36-LTS, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# C  [libcrypto.so.3+0x1fd234]  EVP_MD_get0_provider+0x4
#
# Core dump will be written. Default location: Core dumps may be processed with "/bin/false" (or dumping to /usr/local/tomcat/core.1)
#
# An error report file with more information is saved as:
# /usr/local/tomcat/hs_err_pid1.log
#
# If you would like to submit a bug report, please visit:
#   https://github.com/adoptium/adoptium-support/issues
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

[error occurred during error reporting (), id 0xb, SIGSEGV (0xb) at pc=0x00007fbfe245d9a2]

Which can be specifically seen with # C [libcrypto.so.3+0x1fd234] ...

[icsy7867]

Pasting this here in case it helps anyone... I noticed the eclipse-temurin base container had a UBI10 version. So I modified the existing Dockerfile for the noble install, migrated it to microdnf, and install the fedora/RH versions of the various dependencies. It seemed to work.

I manually set:
gnuArch="x86_64-linux-gnu";

I also had to include:
redhat-rpm-config for the build/gcc/make portions.

I also had to remove all of the "apt" cleanup that occured. It probably needs a replacement with microdnf.

#
# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
#
# PLEASE DO NOT EDIT IT DIRECTLY.
#

FROM eclipse-temurin:25-jdk-ubi10-minimal

ENV CATALINA_HOME /usr/local/tomcat
ENV PATH $CATALINA_HOME/bin:$PATH
RUN mkdir -p "$CATALINA_HOME"
WORKDIR $CATALINA_HOME

# let "Tomcat Native" live somewhere isolated
ENV TOMCAT_NATIVE_LIBDIR $CATALINA_HOME/native-jni-lib
ENV LD_LIBRARY_PATH ${LD_LIBRARY_PATH:+$LD_LIBRARY_PATH:}$TOMCAT_NATIVE_LIBDIR

ENV TOMCAT_MAJOR 11
ENV TOMCAT_VERSION 11.0.13
ENV TOMCAT_SHA512 cc7cc21a671cb42d0b0f7381d2933c36415bfbe7419bf2561e8f88a5b75c2f5a738f3fcf7a1096c0cec3bac14b08e43c6f37c0983ee545672ffa2888cb8dd61a

RUN set -eux; \
        \
        microdnf install -y \
                ca-certificates \
                curl \
                gnupg \
        ; \
        \
        ddist() { \
                local f="$1"; shift; \
                local distFile="$1"; shift; \
                local mvnFile="${1:-}"; \
                local success=; \
                local distUrl=; \
                for distUrl in \
# https://apache.org/history/mirror-history.html
                        "https://dlcdn.apache.org/$distFile" \
# if the version is outdated, we have to pull from the archive
                        "https://archive.apache.org/dist/$distFile" \
# if all else fails, let's try Maven (https://www.mail-archive.com/users@tomcat.apache.org/msg134940.html; https://mvnrepository.com/artifact/org.apache.tomcat/tomcat; https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/)
                        ${mvnFile:+"https://repo1.maven.org/maven2/org/apache/tomcat/tomcat/$mvnFile"} \
                ; do \
                        if curl -fL -o "$f" "$distUrl" && [ -s "$f" ]; then \
                                success=1; \
                                break; \
                        fi; \
                done; \
                [ -n "$success" ]; \
        }; \
        \
        ddist 'tomcat.tar.gz' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz"; \
        echo "$TOMCAT_SHA512 *tomcat.tar.gz" | sha512sum --strict --check -; \
        ddist 'tomcat.tar.gz.asc' "tomcat/tomcat-$TOMCAT_MAJOR/v$TOMCAT_VERSION/bin/apache-tomcat-$TOMCAT_VERSION.tar.gz.asc" "$TOMCAT_VERSION/tomcat-$TOMCAT_VERSION.tar.gz.asc"; \
        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
        curl -fL -o upstream-KEYS 'https://www.apache.org/dist/tomcat/tomcat-11/KEYS'; \
        gpg --batch --import upstream-KEYS; \
# filter upstream KEYS file to *just* known/precomputed fingerprints
        printf '' > filtered-KEYS; \
# see https://www.apache.org/dist/tomcat/tomcat-11/KEYS
        for key in \
                'A9C5DF4D22E99998D9875A5110C01C5A2F6059E7' \
                '48F8E69F6390C9F25CFEDCD268248959359E722B' \
        ; do \
                gpg --batch --fingerprint "$key"; \
                gpg --batch --export --armor "$key" >> filtered-KEYS; \
        done; \
        gpgconf --kill all; \
        rm -rf "$GNUPGHOME"; \
        GNUPGHOME="$(mktemp -d)"; export GNUPGHOME; \
        gpg --batch --import filtered-KEYS; \
        gpg --batch --verify tomcat.tar.gz.asc tomcat.tar.gz; \
        tar -xf tomcat.tar.gz --strip-components=1; \
        rm bin/*.bat; \
        rm tomcat.tar.gz*; \
        gpgconf --kill all; \
        rm -rf "$GNUPGHOME"; \
        \
# https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html#Default_web_applications
        mv webapps webapps.dist; \
        mkdir webapps; \
# we don't delete them completely because they're frankly a pain to get back for users who do want them, and they're generally tiny (~7MB)
        \
        nativeBuildDir="$(mktemp -d)"; \
        tar -xf bin/tomcat-native.tar.gz -C "$nativeBuildDir" --strip-components=1; \
        microdnf install -y \
                gcc \
                apr-devel apr-util-devel \
                openssl-devel \
                make \
                redhat-rpm-config \
        ; \
        ( \
                export CATALINA_HOME="$PWD"; \
                cd "$nativeBuildDir/native"; \
                gnuArch="x86_64-linux-gnu"; \
                aprConfig="$(command -v apr-1-config)"; \
                ./configure \
                        --build="$gnuArch" \
                        --libdir="$TOMCAT_NATIVE_LIBDIR" \
                        --prefix="$CATALINA_HOME" \
                        --with-apr="$aprConfig" \
                        --with-java-home="$JAVA_HOME" \
                ; \
                nproc="$(nproc)"; \
                make -j "$nproc"; \
                make install; \
        ); \
        rm -rf "$nativeBuildDir"; \
        rm bin/tomcat-native.tar.gz; \
        \
# sh removes env vars it doesn't support (ones with periods)
# https://github.com/docker-library/tomcat/issues/77
        find ./bin/ -name '*.sh' -exec sed -ri 's|^#!/bin/sh$|#!/usr/bin/env bash|' '{}' +; \
        \
# fix permissions (especially for running as non-root)
# https://github.com/docker-library/tomcat/issues/35
        chmod -R +rX .; \
        chmod 1777 logs temp work; \
        \
# smoke test
        catalina.sh version

# verify Tomcat Native is working properly
RUN set -eux; \
        nativeLines="$(catalina.sh configtest 2>&1)"; \
        nativeLines="$(echo "$nativeLines" | grep 'Apache Tomcat Native')"; \
        nativeLines="$(echo "$nativeLines" | sort -u)"; \
        if ! echo "$nativeLines" | grep -E 'INFO: Loaded( APR based)? Apache Tomcat Native library' >&2; then \
                echo >&2 "$nativeLines"; \
                exit 1; \
        fi

EXPOSE 8080

# upstream eclipse-temurin-provided entrypoint script caused https://github.com/docker-library/tomcat/issues/77 to come back as https://github.com/docker-library/tomcat/issues/302; use "/entrypoint.sh" at your own risk
ENTRYPOINT []

CMD ["catalina.sh", "run"]

[tianon]

To be very explicitly clear, we do not officially support FIPS in these images (and have no plans to, even if we were to add UBI variants as in #299).

[icsy7867]

To be very explicitly clear, we do not officially support FIPS in these images (and have no plans to, even if we were to add UBI variants as in #299).

That makes sense. However using the UBI based images sort of fixes the problem as the openssl libraries are going to (Most likely) have FIPS support. I am not sure what changed between Jammy and Noble though perhaps thats a push from Ubuntu for FIPS requirements to go to Pro.

Thank you for the response.

[icsy7867]

I am going to close this as complete actually, as
#299

encompasses the needed changes (I didnt see UBI listed in the comments/summary, but I didnt realize ubi9 was already there.)

Thank you!