FLAMED builds and maintains FIPS-validated, STIG-hardened container images for teams pursuing FedRAMP authorization. Built on apko/melange. Signed with cosign. Shipped with SBOMs.
Most teams assume "use OpenSSL" is enough. It isn't. FedRAMP requires a specific CMVP certificate number tied to the exact binary in your image. Off-the-shelf images don't have it.
Even with a FIPS module present, most runtimes maintain a non-FIPS fallback. A 3PAO assessor will find it. FLAMED images are built to eliminate fallback paths at compile time.
FedRAMP Rev.5 requires documented software supply chain provenance. Every FLAMED image ships with a CycloneDX SBOM attached to the manifest and a cosign signature for tamper evidence.
We solve the container layer of FedRAMP authorization — the part most compliance consultants skip because they don't know how to build images. We do.
Pre-built, pre-scanned, cosign-signed container images for common runtimes. Pull and ship. CMVP cert reference included in every manifest.
We instrument your CI/CD pipeline to enforce FIPS compliance, generate SBOMs, and produce auditable evidence at every build — not just at assessment time.
Send us your images. We deliver a written report documenting every FIPS violation, CVE, and supply chain gap — with prioritized remediation steps and CMVP cert references.
Embedded advisory for teams actively pursuing ATO. We write the container security section of your SSP, support your 3PAO, and stand behind our work during assessment.
You share your current container images and runtime requirements. We pull them, extract the dependency graph, and map every crypto call path.
We identify every non-CMVP-validated crypto module, fallback path, and supply chain gap. You get a written report with NIST control mappings.
We rebuild your images against validated FIPS modules using apko/melange, attach SBOMs, sign with cosign, and publish to your registry.
You receive a compliance evidence package: CMVP cert references, SBOM manifests, cosign signatures, and scan reports — ready for your 3PAO.
All images hosted on GHCR. Signed with cosign. SBOM attached. CMVP cert #4473 (OpenSSL FIPS Module 3.0.x).
| Image | Tag | Base | FIPS Module | SBOM | Status |
|---|---|---|---|---|---|
| flamed-us/node-fips | 20, 20.x.x | wolfi | OpenSSL 3.0 FIPS | CycloneDX | Available |
| flamed-us/node-fips | 18, 18.x.x | wolfi | OpenSSL 3.0 FIPS | CycloneDX | Available |
| flamed-us/java-fips | 21, 17 | wolfi | BC-FJA 1.0.2 | CycloneDX | Available |
| flamed-us/python-fips | 3.12, 3.11 | wolfi | OpenSSL 3.0 FIPS | CycloneDX | Coming Soon |
| flamed-us/go-fips | 1.22, 1.21 | wolfi | BoringSSL / FIPS | CycloneDX | Coming Soon |
| flamed-us/nginx-fips | 1.25 | wolfi | OpenSSL 3.0 FIPS | CycloneDX | Coming Soon |
// All images rebuilt monthly. Pull via: docker pull ghcr.io/flamed-us/node-fips:20
FLAMED images and pipelines are designed to satisfy the container-relevant controls across the major federal compliance frameworks.
FLAMED was built by a platform security engineer with deep hands-on experience building FIPS-compliant container pipelines for government and regulated environments — not a compliance firm that learned containers secondhand.
We work exclusively in the container layer: base image construction, FIPS module integration, supply chain attestation, and the evidence artifacts your 3PAO needs to close findings. We write the SSP language because we wrote the code it describes.
Our images are built using apko/melange on a Wolfi base — the same toolchain used by Chainguard — giving you minimal attack surface, zero legacy package baggage, and daily CVE rebuild capability.