Application containers

An nShield application container is a container with the nShield Security World software installed. These images are intended to serve as examples and as base (FROM) images for production applications.

Creating the application image

Create the application image using the builder tool or directly from the template application Dockerfile located in /opt/nfast/containers/templates. The only required arguments are the path to a directory containing the nShield packages and the type of container (app). The base image and tag can be supplied.

$ python3 /opt/nfast/containers/builder.py \
          --tag nshield-app \
          --base redhat/ubi9-micro:9.8 \
          nshield-packages app
$ docker build --build-arg "PACKAGES_DIR=." \
               --build-arg "BASE_IMAGE=redhat/ubi9-micro:9.8" \
               --file "/opt/nfast/containers/templates/app/Dockerfile" \
               --target app \
               --tag nshield-app \
               nshield-packages

The default base image for nShield application containers is Red Hat UBI10-Micro. When you use the builder tool, the default tag reflects the type of container built (nshield-container/app).

Running the application container with Docker

To run the base application container, you must:

  • Supply a kmlocal folder (if you want to perform operations that require a Security World)

  • Mount a volume for the /opt/nfast/sockets folder (same as the hardserver container)

Different application containers can use different kmdata folders.

$ docker run -it --rm \
    -v nfast_socket:/opt/nfast/sockets \
    -v <path to kmlocal>:/opt/nfast/kmdata/local \
    nshield-app

You can then copy the required Security World and module files for your application into the mounted kmlocal folder.

Java API support

To run Java application containers, create the Java base application image from the template provided. The base image does not include a JDK, so you must install one in any image derived from it. Java 21 or later are supported. If using earlier versions of Java, please contact support.

For example, a Dockerfile for a new Java application might look as follows:

FROM nshield-container/java:latest
RUN apt install myjdkprovider
COPY java-app/app.jar /
ENTRYPOINT "java -jar /app.jar RunApp"