FIPS 140-3 Certification

This image is FIPS-validated to ensure its cryptographic operations meet the Federal Information Processing Standards (FIPS) required for secure government and regulated environments. Its core cryptographic modules are validated under the NIST Cryptographic Module Validation Program (CMVP) and comply with the FIPS 140-3 standard.

To verify that the FIPS 140-3 provider is configured and active, follow the instructions in the FIPS compliance tab.

Try It Out

Filebrowser needs a directory to serve and a place to persist its database and configuration:

mkdir -p ./srv

docker run -d --name filebrowser \
  --restart=unless-stopped \
  -p 8080:80 \
  -v $PWD/srv:/srv \
  -v filebrowser_database:/database \
  -v filebrowser_config:/config \
  reg.mini.dev/filebrowser-fips

Filebrowser generates a random password for the admin user the first time it initializes its database, and prints it once to the container logs:

docker logs filebrowser

You should see logs such as:

2026/08/16 09:58:46 Performing quick setup
2026/08/16 09:58:46 User 'admin' initialized with randomly generated password: ciOyM-84GGhXN8G0

If you don't see the password in the logs, most likely the container reused an existing filebrowser_database volume and didn't generate a password. Follow the clean up steps below to remove the stale volume and re-run the command.

Visit http://localhost:8080 and log in with admin and the generated password, then change it immediately from the settings page. Filebrowser is not designed to be exposed directly to the internet without a reverse proxy in front of it.

Stop and remove the container and volumes:

docker rm -f filebrowser
docker volume rm filebrowser_database filebrowser_config

Filebrowser can also run as a Kubernetes Deployment backed by persistent storage, fronted by a Service. This requires a running Kubernetes cluster and kubectl configured against it.

Save the following as filebrowser.yaml. It provisions two PersistentVolumeClaims — one for the directory Filebrowser serves, one for its database and config — and exposes the UI through a ClusterIP Service:

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: filebrowser-srv
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 5Gi
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: filebrowser-state
spec:
  accessModes: ["ReadWriteOnce"]
  resources:
    requests:
      storage: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: filebrowser
spec:
  replicas: 1
  selector:
    matchLabels:
      app: filebrowser
  template:
    metadata:
      labels:
        app: filebrowser
    spec:
      containers:
        - name: filebrowser
          image: reg.mini.dev/filebrowser-fips
          ports:
            - containerPort: 80
          volumeMounts:
            - name: srv
              mountPath: /srv
            - name: state
              mountPath: /database
              subPath: database
            - name: state
              mountPath: /config
              subPath: config
      volumes:
        - name: srv
          persistentVolumeClaim:
            claimName: filebrowser-srv
        - name: state
          persistentVolumeClaim:
            claimName: filebrowser-state
---
apiVersion: v1
kind: Service
metadata:
  name: filebrowser
spec:
  selector:
    app: filebrowser
  ports:
    - port: 80
      targetPort: 80

Apply it and wait for the Pod to become ready:

kubectl apply -f filebrowser.yaml
kubectl get pods -l app=filebrowser

As with the Docker setup, Filebrowser generates a random password for the admin user the first time it initializes its database, and prints it once to the Pod logs:

kubectl logs -l app=filebrowser

You should see logs such as:

2026/08/16 09:58:46 Performing quick setup
2026/08/16 09:58:46 User 'admin' initialized with randomly generated password: ciOyM-84GGhXN8G0

If you don't see the password, most likely the PersistentVolumeClaims already held a database from an earlier attempt — delete and recreate them to force a fresh initialization.

Forward the Service to your local machine, then visit http://localhost:8080 and log in with admin and the generated password:

kubectl port-forward svc/filebrowser 8080:80

Change the password immediately from the settings page. It is recommended to put an ingress or reverse proxy in front of the Service rather than exposing it directly since Filebrowser is not designed to be exposed directly to the internet.

Remove the deployment, PVCs, and Service when you're done:

kubectl delete -f filebrowser.yaml

Technical Considerations

The Filebrowser-FIPS image provided by Minimus is a FIPS-validated, slim, security-hardened alternative to the public image.

Terms & Info

This catalog is published by Minimus. All product names, logos, and marks, other than those belonging to Minimus, shown are owned by their respective rights holders and appear here only to identify the open source software each image contains. Minimus claims no ownership of those marks and implies no affiliation with, endorsement by, certification by, or sponsorship by any rights holder.

Images are provided "as-is" without warranty of any kind. "Hardened" refers to the security configuration applied at the time of build and does not constitute a guarantee of ongoing security or absence of vulnerabilities. The free tier is provided without support, SLA, or guaranteed patching timelines. Security updates may be applied to paid subscriptions before or instead of free tier images. By pulling or using any image you agree to our Terms of Use.