FIPS 140-3 Certification

This image is FIPS-validated to ensure its cryptographic operations meet the Federal Information Processing Standards (FIPS) required for secure government and regulated environments. Its core cryptographic modules are validated under the NIST Cryptographic Module Validation Program (CMVP) and comply with the FIPS 140-3 standard.

To verify that the FIPS 140-3 provider is configured and active, follow the instructions in the FIPS compliance tab.

Try It Out

Spin up ProxySQL-FIPS in front of a MySQL-FIPS backend with Docker Compose. This demonstrates using ProxySQL's admin interface to register a backend server and route client traffic to it.

Save the following to a proxysql-fips-compose.yaml file in your working directory:

services:
  mysql:
    image: reg.mini.dev/mysql-fips:latest
    environment:
      MYSQL_ROOT_PASSWORD: MinimusSecure!!
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h 127.0.0.1 -uroot -pMinimusSecure!!"]
      interval: 5s
      timeout: 5s
      retries: 10

  proxysql:
    image: reg.mini.dev/proxysql-fips:latest
    depends_on:
      mysql:
        condition: service_healthy
    ports:
      - "6032:6032"
      - "6033:6033"

  client:
    image: reg.mini.dev/mariadb-fips:latest
    entrypoint: ["mariadb"]
    network_mode: "service:proxysql"
    profiles: ["tools"]

docker compose -f proxysql-fips-compose.yaml up -d

Wait for the backend to become healthy:

docker compose -f proxysql-fips-compose.yaml ps

Connect to ProxySQL's admin interface (default credentials are admin/admin) and register the MySQL backend as a server in hostgroup 10, then add a user ProxySQL will authenticate client connections as.

ProxySQL's admin user only accepts connections from 127.0.0.1 as a security default, and the admin interface requires the mysql_native_password authentication plugin, which recent MySQL client libraries no longer ship. The client service below works around both: network_mode: "service:proxysql" puts it inside ProxySQL's own network namespace so 127.0.0.1 reaches it as a local connection, and it's a MariaDB client, which still supports mysql_native_password, instead of a mysql client:

docker compose -f proxysql-fips-compose.yaml run --rm client -h 127.0.0.1 -P 6032 -u admin -padmin -e "
INSERT INTO mysql_servers(hostgroup_id, hostname, port) VALUES (10, 'mysql', 3306);
INSERT INTO mysql_users(username, password, default_hostgroup) VALUES ('root', 'MinimusSecure\!\!', 10);
LOAD MYSQL SERVERS TO RUNTIME;
SAVE MYSQL SERVERS TO DISK;
LOAD MYSQL USERS TO RUNTIME;
SAVE MYSQL USERS TO DISK;
"

Query the MySQL backend through ProxySQL's client interface on port 6033, instead of connecting to the backend directly:

docker compose -f proxysql-fips-compose.yaml run --rm client -h 127.0.0.1 -P 6033 -u root -pMinimusSecure\!\! -e "show databases;"

ProxySQL forwards the query to the backend server and returns the result set:

+--------------------+
| Database           |
+--------------------+
| information_schema |
| mysql              |
| performance_schema |
| sys                |
+--------------------+

Check ProxySQL's connection pool stats to confirm the query above was actually routed to the backend server rather than served directly:

docker compose -f proxysql-fips-compose.yaml run --rm client -h 127.0.0.1 -P 6032 -u admin -padmin -e "SELECT hostgroup, srv_host, srv_port, Queries FROM stats_mysql_connection_pool;"

+-----------+----------+----------+---------+
| hostgroup | srv_host | srv_port | Queries |
+-----------+----------+----------+---------+
| 10        | mysql    | 3306     | 1       |
+-----------+----------+----------+---------+

Stop and remove all containers and volumes:

docker compose -f proxysql-fips-compose.yaml down -v

Technical Considerations

The Proxysql-FIPS image provided by Minimus is a slim, security-hardened alternative to the public image from Docker Hub. The images are largely interchangeable, with a few differences as noted below.

Terms & Info

This catalog is published by Minimus. All product names, logos, and marks, other than those belonging to Minimus, shown are owned by their respective rights holders and appear here only to identify the open source software each image contains. Minimus claims no ownership of those marks and implies no affiliation with, endorsement by, certification by, or sponsorship by any rights holder.

Images are provided "as-is" without warranty of any kind. "Hardened" refers to the security configuration applied at the time of build and does not constitute a guarantee of ongoing security or absence of vulnerabilities. The free tier is provided without support, SLA, or guaranteed patching timelines. Security updates may be applied to paid subscriptions before or instead of free tier images. By pulling or using any image you agree to our Terms of Use.