Ports main's Dockerfile changes since #41802 was written: pgbouncer 1.26.0, the dashboard vendor folder, rust for the maturin build, libssl3, the packaging/litellm-proxy workspace member, the admin-mcp group and LITELLM_RELEASE_TAG. litellm-proxy, the opt-in Rust forwarding server, stays out of this image.
The Wolfi base now ships OpenSSL 4, so the scan also counts a binary linked against the system libcrypto.so.4 as system-linked. The inventory adds the amd64 binaries from today's lock and keeps #41802's arm64 entries.
Dockerfile.fips builds on chainguard-base-fips with FIPS-provider-linked
python/node/openssl from the org apk repo (CMVP #5132). A fips-check
stage runs openssl-fips-test and an ELF allowlist gate: every native
binary must be in the reviewed fips_elf_inventory.txt or carry an
explicit bundled-crypto waiver, so new native deps fail the build until
reviewed. Known offenders are waived pending the dependency-fix
workstream and the report ships at /fips-scan-report.txt
