sentry-relay-fips

packaged by Chainguard

Chainguard Container for sentry-relay-fips

FIPS-enabled Relay, Sentry's event forwarding and ingestion service, which receives, scrubs, and forwards SDK events, with TLS routed through the system OpenSSL FIPS provider.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/sentry-relay-fips:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

Chainguard's sentry-relay-fips image is comparable to the upstream Relay image and is designed to be a drop-in replacement for it. It keeps the same entrypoint (/bin/relay) and default command (run), working directory (/work), non-root user (UID 65532), port (3000), and writable /etc/relay and /work directories. Like the upstream image, it has no shell.

The upstream release statically links its own copy of OpenSSL. This image is built against the system OpenSSL library instead, linked dynamically, so OpenSSL security fixes reach the image through regular updates.

In Kubernetes, a Service named relay makes the kubelet inject RELAY_PORT=tcp://... into pods, which Relay reads as its own port setting and rejects with invalid config value (field port). Set enableServiceLinks: false on Relay pods, or give the Service a different name.

FIPS Support

The sentry-relay-fips Chainguard Container routes TLS, including connections to the upstream, Kafka, and Redis, through the system OpenSSL FIPS provider, which openssl-config-fipshardened configures.

Some cryptography in Relay runs outside the OpenSSL FIPS module, none of it for TLS:

• Relay signs its registration and requests to the upstream with Ed25519. This is on the default path for Sentry self-hosted, which runs Relay in managed mode, the Relay default.
• When an objectstore is configured, Relay signs objectstore tokens with a pure-Rust JWT implementation.
• PII scrubbing rules that hash values (@*:hash) use HMAC-SHA1 to pseudonymize data, which is data masking rather than a security boundary.

For more on FIPS support in Chainguard Containers, consult the guide on FIPS-enabled Chainguard Containers on Chainguard Academy.

Getting Started

Relay reads config.yml from its configuration folder, /etc/relay in a typical deployment. Create a configuration that runs Relay in proxy mode, forwarding everything to your Sentry instance:

mkdir relay
cat > relay/config.yml <<EOF
relay:
  mode: proxy
  upstream: https://sentry.example.com/
  host: 0.0.0.0
  port: 3000
EOF

Start Relay with the configuration folder mounted:

docker run -d --name relay -p 3000:3000 -v "$PWD/relay:/etc/relay:ro" \
  cgr.dev/ORGANIZATION/sentry-relay-fips:latest run --config /etc/relay

Check that it is live:

curl -s --retry 10 --retry-all-errors http://localhost:3000/api/relay/healthcheck/live/

{"is_healthy":true}

Point your SDKs' DSN at Relay (for example http://<key>@localhost:3000/<project_id>), and Relay forwards their events to the upstream.

A managed Relay, which is the default mode and the one Sentry self-hosted uses, authenticates to Sentry with a key pair. Generate one with the credentials command:

docker run --rm cgr.dev/ORGANIZATION/sentry-relay-fips:latest credentials generate --stdout

To store credentials alongside the configuration instead, generate them on standard output and save them next to config.yml. Self-hosted Sentry does the same and mounts the folder read-only at /work/.relay, the default configuration path under the /work working directory:

docker run --rm cgr.dev/ORGANIZATION/sentry-relay-fips:latest credentials generate --stdout > relay/credentials.json

Configuration

Relay's mode decides how much it trusts and processes: proxy forwards events unchanged, static uses project configurations from local files, and managed fetches them from Sentry and must be registered with the credentials above. Sentry self-hosted runs a managed Relay with processing.enabled: true, which also needs Kafka and Redis settings in config.yml. The configuration folder must be writable by UID 65532 when Relay should store generated credentials there.

Refer to the Relay configuration options for every setting.

Documentation and Resources

• Relay documentation
• Relay on GitHub
• Sentry self-hosted

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.