Chainguard Container for azure-functions-python-fips

Azure Functions is a managed platform-as-a-service provider which offers scalable and serverless hosting for Python code projects. It extends the Azure platform with the capability to implement code triggered by many events occurring in Azure, on-premises or other 3rd party services.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/azure-functions-python-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

This image is based on the upstream azure-functions/python image with FIPS-validated cryptographic libraries.

Key differences from the standard azure-functions-python image:

• FIPS Compliance: Ships with validated redistribution of OpenSSL's FIPS provider module for environments requiring FIPS 140-3 compliance

FIPS Support

This Chainguard Container ships with a validated redistribution of OpenSSL's FIPS provider module. For more on FIPS support in Chainguard Containers, consult the guide on FIPS-enabled Chainguard Containers on Chainguard Academy.

These changes are intended to optimize app performance while maintaining FIPS compliance and keeping the image aligned with the latest platform capabilities.

Chainguard's Azure Functions Python FIPS image is smaller in size compared to the original image and has few-to-zero CVEs.

Getting Started

Azure Functions is a managed platform-as-a-service provider which offers scalable and serverless hosting for code projects. The Azure Functions Python FIPS image offers support for writing and running Functions code in Python with FIPS-validated cryptographic libraries.

Creating and running a minimal Function locally

This section outlines how you can run an Azure Function application locally with the Chainguard Azure Functions Python FIPS Image.

Start by creating a sample http triggered function named HelloWolfi:

mkdir HelloWolfi

cat > HelloWolfi/__init__.py <<EOL
import azure.functions as func
import logging

def main(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')

    name = req.params.get('name')
    if not name:
        try:
            req_body = req.get_json()
        except ValueError:
            pass
        else:
            name = req_body.get('name')

    if name:
        return func.HttpResponse(f"Hello, {name}!")
    else:
        return func.HttpResponse(
            "Pass a name in the query string or request body.",
            status_code=200
        )
EOL

cat > HelloWolfi/function.json <<EOL
{
    "scriptFile": "__init__.py",
    "bindings": [
      {
        "authLevel": "anonymous",
        "type": "httpTrigger",
        "direction": "in",
        "name": "req",
        "methods": ["get", "post"]
      },
      {
        "type": "http",
        "direction": "out",
        "name": "\$return"
      }
    ]
}
EOL

Then, create the host.json metadata file which contains configuration options for all functions in a Function App. For more information about the this file check the host.json reference. Make sure to use version 4 of Azure Functions Extension Bundles, since version 3 and 2 are not supported.

cat > host.json <<EOL
{
    "version": "2.0",
    "logging": {
      "logLevel": {
        "default": "Information"
      },
      "console": {
          "isEnabled": true,
          "DisableColors": true
      }
    },
    "extensionBundle": {
      "id": "Microsoft.Azure.Functions.ExtensionBundle",
      "version": "[4.*, 5.0.0)"
    }
}
EOL

Following that, you can create a Dockerfile to copy your Function code to the Chainguard image and build the new image.

cat > Dockerfile <<EOL
FROM cgr.dev/ORGANIZATION/azure-functions-python-fips

COPY . /home/site/wwwroot
EOL

docker build -t wolfi-python-fips-function .

You can now run the image locally with the following command:

docker run -p 8080:80 wolfi-python-fips-function

Now that the function launched properly, you can test it by making a request to the /api/HelloWolfi endpoint:

curl http://127.0.0.1:8080/api/HelloWolfi?name=Chainguard

Hello, Chainguard!

Verifying FIPS Mode

You can test that FIPS mode is active with the following command:

docker run --rm cgr.dev/ORGANIZATION/azure-functions-python-fips -c "openssl-fips-test"

This uses Chainguard's openssl-fips-test tool to test whether or not OpenSSL is properly configured to use its FIPS module:

Checking OpenSSL lifecycle assurance.
*** Running check: FIPS module is available...
    HMAC : (KAT_Integrity) : Pass
    SHA1 : (KAT_Digest) : Pass
    SHA2 : (KAT_Digest) : Pass
    [... additional validation tests ...]
*** Running check: EVP_default_properties_is_fips_enabled returns true... passed.
*** Running check: verify unapproved cryptographic routines are not available by default (e.g. MD5)... passed.

Lifecycle assurance satisfied.

Creating and running a minimal Function in an Azure Function App

The most common use case for an Azure Functions image is deploying it within an Azure Function App. You can use the Chainguard Azure Functions Python FIPS image for this purpose. The following example demonstrates how to deploy a queue-triggered function that responds to messages in an Azure Storage Queue by creating a copy of a file in Azure Blob Storage.

Start by creating the function and its metadata file:

mkdir BlobFunction

cat > BlobFunction/__init__.py <<EOL
import azure.functions as func
import logging

def main(myQueueItem: func.QueueMessage, myInputBlob: func.InputStream, myOutputBlob: func.Out[bytes]):
    logging.warning(f'Python Queue trigger function processed: {myQueueItem.get_body().decode()}')

    # Copy the input blob to the output blob
    blob_content = myInputBlob.read()
    myOutputBlob.set(blob_content)

    logging.info(f'Blob copied successfully')
EOL

cat > BlobFunction/function.json <<EOL
{
    "scriptFile": "__init__.py",
    "bindings": [
      {
        "queueName": "python-function-queue",
        "connection": "AzureWebJobsStorage",
        "name": "myQueueItem",
        "type": "queueTrigger",
        "direction": "in"
      },
      {
        "name": "myInputBlob",
        "type": "blob",
        "path": "python-test-workitems/{queueTrigger}",
        "connection": "AzureWebJobsStorage",
        "direction": "in"
      },
      {
        "name": "myOutputBlob",
        "type": "blob",
        "path": "python-test-workitems/{queueTrigger}-Copy",
        "connection": "AzureWebJobsStorage",
        "direction": "out"
      }
    ],
    "disabled": false
}
EOL

cat > host.json <<EOL
{
    "version": "2.0",
    "logging": {
      "logLevel": {
        "default": "Warning"
      }
    },
    "extensionBundle": {
      "id": "Microsoft.Azure.Functions.ExtensionBundle",
      "version": "[4.*, 5.0.0)"
    }
}
EOL

Then, create a Dockerfile to copy the Function to the Chainguard image and built the image.

cat >Dockerfile <<EOL
FROM cgr.dev/ORGANIZATION/azure-functions-python-fips

COPY . /home/site/wwwroot
EOL

docker build -t wolfi-queue-fips-function .

Next, tag your image as needed and push it to your container registry by following these steps.

Once the image is published, provision the required Azure resources and configure your Function App to use the container image.

After setup, create an Azure Storage Queue named python-function-queue and a Blob Container named python-test-workitems in your storage account. Upload a file to the container.

Ensure the Function App's managed identity has the correct roles assigned to the storage account:

• Storage Queue Data Reader
• Storage Blob Data Contributor

These roles allow the function to read from the queue and write to the blob container.

Restart the Function App to apply the updated configuration. Then, add a message to the queue containing the name of the uploaded file. Within a few seconds, the function should trigger and process the file, creating a copy in the designated container.

You can monitor execution logs in Azure Application Insights (note that logs may appear with a slight delay).

Documentation and Resources

For more information about Azure Functions in container images, please refer to the official documentation.

For FIPS compliance information, consult the FIPS-enabled Chainguard Containers Guide.

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.