> ## Documentation Index > Fetch the complete documentation index at: https://docs.evocloud.dev/llms.txt > Use this file to discover all available pages before exploring further. # Building Fips Enabled Talos Image > Step by step instructions on how to build custom Talos images with FIPS enabled. Talos Linux is a minimal, immutable, and secure operating system designed specifically for running Kubernetes. There might be several reasons to build Talos images from source, and one of them might be to enable FIPS mode or verify image integrity. In this guide, we will walk through the process of cloning the Talos repository, setting up the build environment, and compiling a custom Talos image with FIPS enabled. ## Set up the build environment Before you start building, make sure your development machine meets these requirements: * A **Linux** machine or VM with at least 8 GB of RAM and 100 GB of free disk space. * **Docker** installed and running with the **buildx** plugin. * **Go** 1.26 or later installed. * **Make** utility installed. * **Git**. * Sufficient **disk space**, at least 100 GB of free storage. * Optional - **Crane**, a tool for interacting with remote images and registries can be installed. ## Checkout Talos source code Start by cloning the official Talos Linux repository from GitHub. ```bash theme={null} git clone https://github.com/siderolabs/talos.git cd talos #If building for a specific release, checkout the corresponding tag: git checkout v1.13.9 ``` The repository is organized into several key directories: * **internal** directory contains the core system components * **pkg** directory contains the shared packages * **hack** directory contains the build scripts and utilities Understanding this layout helps when you need to make modifications later. Below is a comprehensive view of the folder structure: ``` talos ├── ADOPTERS.md ├── api ├── CHANGELOG.md ├── cmd ├── CODE_OF_CONDUCT.md ├── CONTRIBUTING.md ├── Dockerfile ├── go.mod ├── go.sum ├── go.work ├── hack ├── internal ├── lefthook.yml ├── LICENSE ├── Makefile ├── pkg ├── README.md ├── RELEASE.md ├── security-insights.yml ├── SECURITY.md ├── tools └── website ``` ## Create a builder instance Set up a builder docker instance with access to the host network, so that it can push to a local container registry. To create a compatible builder instance run: ```bash theme={null} # Create a builder instance with a Docker container engine docker buildx create --name evotalos-builder --driver docker-container --driver-opt network=host --buildkitd-flags '--allow-insecure-entitlement security.insecure' --use ``` > Note: the `security.insecure` flag is only required and used by the unit-tests target. ## Connect to a docker registry If you already have a container registry like ghcr.io, you can use it and all you have to do is login before building the Talos artifacts: ```bash theme={null} # example with ghcr.io registry docker login ghcr.io # then provide your username and password ``` If not, set up a local docker registry for hosting the container image build artifacts: ```bash theme={null} docker run -d -p 5005:5000 --restart always --name evoregistry registry:2 ``` ## Create Talos installer-base image Before we can build the custom Talos installer image, we will need to first, build and push the Talos installer-base image to our private registry: * Talos installer-base: ```bash theme={null} # Talos installer-base make installer-base PUSH=true GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` ## Create Talos imager image Before we can build a custom Talos installer image, we will need to next, build and push the Talos imager image to our private registry: * Talos imager: ```bash theme={null} # Talos installer-base make imager PUSH=true GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` > Note: When building the Talos imager, by default Talos will include the boot assets for both **amd64** and **arm64** architectures. ## Create Talos installer image To build a custom Talos installer image (the image used to deploy Talos Linux on a machine) with FIPS enabled, we have multiple options available to us. > Note💡: If your private registry is well configured, the custom Talos installer image will be pushed to it. If not, you can check the `_out/installer_image` file for the build output. > Note💡: To build for arm64 platform, run: `make PLATFORM=linux/arm64`. > Note💡: To build for arm64 and amd64 platforms, run: `make PLATFORM=linux/arm64,linux/amd64`. In this guide the build artifacts are for a linux/amd64 platform. * **Build a basic Talos installer image:** ```bash theme={null} make installer PUSH=true GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * **Build a Talos installer image with system extensions:** First of all, let's get the system extension image (specific to the version of Talos Linux) for `amd-ucode`, `intel-ucode`, `iscsi-tools`, `util-linux-tools`, `kata-containers`, and `tailscale`, for example: ```bash theme={null} crane export ghcr.io/siderolabs/extensions:v1.13.9 | tar -x -O image-digests | grep -E 'amd-ucode|intel-ucode|iscsi-tools|util-linux-tools|kata-containers|tailscale' ``` Then, let's build the installer image with those system extensions: ```bash theme={null} make installer PUSH=true GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci \ IMAGER_SYSTEM_EXTENSIONS="ghcr.io/siderolabs/amd-ucode:20260810@sha256:2f846db3cfe189608ff2d4756243cf6c10f8592d4803c96a5aad6b72fa4e6a7b \ ghcr.io/siderolabs/intel-ucode:20260812@sha256:b319f6440358399fda88f04199b79ed47c3c5975675c4ce35bd584d0c1e82db9 \ ghcr.io/siderolabs/iscsi-tools:v0.2.0@sha256:b3ddf2047eea00b095f03a1f6bc407614e4a4cd9aa5d4136a1cd1a28fb54e3ca \ ghcr.io/siderolabs/kata-containers:3.32.0@sha256:e624d92351bc51cea44a5301ec0f0227083f19aacb5074d5171f6aff5c2ef28b \ ghcr.io/siderolabs/tailscale:1.102.2@sha256:bbcde50aaa3fe655f5d898a4c55ba0170c0ed14b80f26468b4f7d25d2283d1ef \ ghcr.io/siderolabs/util-linux-tools:2.42.2@sha256:97de3b5b55b3ca396a6699f9db2c0f01ef3a94a29684e8f8c191a403763a3186" ``` * **Build a Talos installer image with kernel arguments:** ```bash theme={null} make installer PUSH=true GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci \ IMAGER_ARGS="--extra-kernel-arg=cpufreq.default_governor=performance \ --extra-kernel-arg=net.ifnames=0" ``` * **Build Talos installer image with system extensions and kernel arguments:** ```bash theme={null} make installer PUSH=true GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci \ IMAGER_ARGS="--extra-kernel-arg=cpufreq.default_governor=performance \ --extra-kernel-arg=net.ifnames=0" \ IMAGER_SYSTEM_EXTENSIONS="ghcr.io/siderolabs/amd-ucode:20260810@sha256:2f846db3cfe189608ff2d4756243cf6c10f8592d4803c96a5aad6b72fa4e6a7b \ ghcr.io/siderolabs/intel-ucode:20260812@sha256:b319f6440358399fda88f04199b79ed47c3c5975675c4ce35bd584d0c1e82db9 \ ghcr.io/siderolabs/iscsi-tools:v0.2.0@sha256:b3ddf2047eea00b095f03a1f6bc407614e4a4cd9aa5d4136a1cd1a28fb54e3ca \ ghcr.io/siderolabs/kata-containers:3.32.0@sha256:e624d92351bc51cea44a5301ec0f0227083f19aacb5074d5171f6aff5c2ef28b \ ghcr.io/siderolabs/tailscale:1.102.2@sha256:bbcde50aaa3fe655f5d898a4c55ba0170c0ed14b80f26468b4f7d25d2283d1ef \ ghcr.io/siderolabs/util-linux-tools:2.42.2@sha256:97de3b5b55b3ca396a6699f9db2c0f01ef3a94a29684e8f8c191a403763a3186" ``` ## Build Talos kernel To build the Talos kernel with FIPS enabled, run the following: ```bash theme={null} make kernel GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` > Note: You can check the `_out/vmlinux-amd64` file for the build output. ## Build Talos initramfs To build the Talos initramfs with FIPS enabled, run the following: ```bash theme={null} make initramfs GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` > Note: You can check the `_out/initramfs-amd64.xz` file for the build output. ## Build Talosctl To build a custom Talosctl with FIPS enabled, run the following: ```bash theme={null} make talosctl GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` ## Create cloud provider Talos disk images (Bonus) In this bonus section, we will show you how to build cloud provider specific Talos disk images: * Talos disk image for Akamai Cloud: ```bash theme={null} # Talos disk image for Akamai make image-akamai GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for AWS Cloud: ```bash theme={null} # Talos disk image for AWS make image-aws GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Azure Cloud: ```bash theme={null} # Talos disk image for Azure make image-azure GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Digital Ocean Cloud: ```bash theme={null} # Talos disk image for Digital Ocean make image-digital-ocean GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Exoscale Cloud: ```bash theme={null} # Talos disk image for Exoscale make image-exoscale GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for CloudStack Cloud: ```bash theme={null} # Talos disk image for CloudStack make image-cloudstack GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Google Cloud: ```bash theme={null} # Talos disk image for GCP make image-gcp GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Hetzner Cloud: ```bash theme={null} # Talos disk image for Hetzner make image-hcloud GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image as an ISO for baremetal: ```bash theme={null} # Talos disk image as an ISO make image-iso GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for baremetal as well: ```bash theme={null} # Talos disk image for baremetal make image-metal GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for nocloud: ```bash theme={null} # Talos disk image for nocloud make image-nocloud GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for OpenNebula Cloud: ```bash theme={null} # Talos disk image for OpenNebula make image-opennebula GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for OpenStack Private Cloud: ```bash theme={null} # Talos disk image for OpenStack make image-openstack GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Oracle Cloud: ```bash theme={null} # Talos disk image for Oracle make image-oracle GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Scaleway Cloud: ```bash theme={null} # Talos disk image for Scaleway make image-scaleway GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for UpCloud: ```bash theme={null} # Talos disk image for UpCloud make image-upcloud GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for VMware: ```bash theme={null} # Talos disk image for VMware make image-vmware GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` * Talos disk image for Vultr Cloud: ```bash theme={null} # Talos disk image for Vultr make image-vultr GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci ``` ## Create cloud provider Talos disk images with system extensions You can also embed system extensions into your Talos disk image build like we did for the Talos installer image build. ```bash theme={null} # Talos disk image build with system extensions make image-gcp GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci \ IMAGER_SYSTEM_EXTENSIONS="ghcr.io/siderolabs/amd-ucode:20260810@sha256:2f846db3cfe189608ff2d4756243cf6c10f8592d4803c96a5aad6b72fa4e6a7b \ ghcr.io/siderolabs/intel-ucode:20260812@sha256:b319f6440358399fda88f04199b79ed47c3c5975675c4ce35bd584d0c1e82db9 \ ghcr.io/siderolabs/iscsi-tools:v0.2.0@sha256:b3ddf2047eea00b095f03a1f6bc407614e4a4cd9aa5d4136a1cd1a28fb54e3ca \ ghcr.io/siderolabs/kata-containers:3.32.0@sha256:e624d92351bc51cea44a5301ec0f0227083f19aacb5074d5171f6aff5c2ef28b \ ghcr.io/siderolabs/tailscale:1.102.2@sha256:bbcde50aaa3fe655f5d898a4c55ba0170c0ed14b80f26468b4f7d25d2283d1ef \ ghcr.io/siderolabs/util-linux-tools:2.42.2@sha256:97de3b5b55b3ca396a6699f9db2c0f01ef3a94a29684e8f8c191a403763a3186" ``` > Note: You can also build Talos disk images with system extensions for other cloud providers by just updating `image-gcp` to the desired cloud provider. ## Create cloud provider Talos disk images with kernel arguments You can also embed custom kernel arguments into your Talos disk image. ```bash theme={null} # Talos disk image build with custom kernel arguments make image-gcp GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci \ IMAGER_ARGS="--extra-kernel-arg=cpufreq.default_governor=performance \ --extra-kernel-arg=net.ifnames=0" ``` > Note: You can also build Talos disk images with custom kernel arguments for other cloud providers by just updating `image-gcp` to the desired cloud provider. ## Create cloud provider Talos disk images with system extensions and kernel arguments You can embed both, system extensions and custom kernel arguments into your Talos disk image. ```bash theme={null} # Talos disk image build with both, system extensions and kernel arguments make image-gcp GOFIPS140=latest PLATFORM=linux/amd64 TAG=v1.13.9 REGISTRY_AND_USERNAME=ghcr.io/evocloud-dev/oci \ IMAGER_ARGS="--extra-kernel-arg=cpufreq.default_governor=performance \ --extra-kernel-arg=net.ifnames=0" \ IMAGER_SYSTEM_EXTENSIONS="ghcr.io/siderolabs/amd-ucode:20260810@sha256:2f846db3cfe189608ff2d4756243cf6c10f8592d4803c96a5aad6b72fa4e6a7b \ ghcr.io/siderolabs/intel-ucode:20260812@sha256:b319f6440358399fda88f04199b79ed47c3c5975675c4ce35bd584d0c1e82db9 \ ghcr.io/siderolabs/iscsi-tools:v0.2.0@sha256:b3ddf2047eea00b095f03a1f6bc407614e4a4cd9aa5d4136a1cd1a28fb54e3ca \ ghcr.io/siderolabs/kata-containers:3.32.0@sha256:e624d92351bc51cea44a5301ec0f0227083f19aacb5074d5171f6aff5c2ef28b \ ghcr.io/siderolabs/tailscale:1.102.2@sha256:bbcde50aaa3fe655f5d898a4c55ba0170c0ed14b80f26468b4f7d25d2283d1ef \ ghcr.io/siderolabs/util-linux-tools:2.42.2@sha256:97de3b5b55b3ca396a6699f9db2c0f01ef3a94a29684e8f8c191a403763a3186" ``` > Note: You can also build Talos disk images with custom kernel arguments for other cloud providers by just updating `image-gcp` to the desired cloud provider. ## References: * [https://github.com/siderolabs/talos/blob/main/Makefile](https://github.com/siderolabs/talos/blob/main/Makefile) * [https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/building-images](https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/building-images) * [https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos](https://docs.siderolabs.com/talos/v1.13/build-and-extend-talos/custom-images-and-development/developing-talos)