Docker build fails in FIPS environments due to apt/libgcrypt aborts

[CrazyBonze]

Description
Building the Nautobot images with poetry run invoke build fails on hosts enforcing FIPS mode. During apt-get update/upgrade, libgcrypt aborts with “requested algo not in md context,” which indicates apt/GnuPG hit a non‑FIPS digest path (e.g., MD5/SHA1) while verifying repository metadata. Because FIPS is system‑wide, container processes inherit these constraints and the build terminates early.

Steps To Reproduce

• Run poetry run invoke build on a host with FIPS enabled.
• Observe apt steps in environments/Dockerfile:7 and environments/Dockerfile:18 and environments/Dockerfile-LDAP:7 and environments/Dockerfile-LDAP:18.
• The build uses Compose args from environments/docker-compose.base.yml:3 and environments/docker-compose.ldap.yml:3.

Actual Behavior

• apt-get update aborts:
  • fatal error in libgcrypt ... requested algo not in md context
  • Exit code 134 from the apt RUN layer.

Expected Behavior

• Image builds succeed on FIPS hosts or provide a supported way to skip/avoid apt paths that trigger non‑FIPS algorithms.

Environment

• Host: Linux with FIPS mode enabled.
• Base images: ghcr.io/nautobot/nautobot:${NAUTOBOT_VERSION}-py${PYTHON_VER}, ghcr.io/nautobot/nautobot-dev:${NAUTOBOT_VERSION}-py${PYTHON_VER}.
• Build command: poetry run invoke build.
• Task env passing: tasks.py:87 sets only PYTHON_VER and NAUTOBOT_VERSION for Compose.

Logs (excerpt)

• Reading package lists...fatal error in libgcrypt ... requested algo not in md context
• Aborted

Impact

• Builds cannot complete on FIPS‑enforced systems.
• LDAP Dockerfile additionally relies on apt for dev libraries (libldap2-dev, libsasl2-dev, libssl-dev), increasing exposure to apt failures.

Proposed Fix

• Make apt steps optional via a build arg and skip by default on FIPS:

  • Add ARG SKIP_APT=0 and wrap apt RUN lines in if [ "$SKIP_APT" != "1" ]; then ...; fi.
  • Pass SKIP_APT through Compose args in environments/docker-compose.base.yml:3 and environments/docker-compose.ldap.yml:3.
  • Update tasks.py:87 to forward SKIP_APT from the user environment (or merge os.environ) so poetry run invoke build can toggle it.

• Reduce/avoid apt usage:

  • Remove apt-get upgrade at build time; only run apt-get update when strictly needed.
  • In Dockerfile-LDAP, prefer binary wheels: pip install --only-binary=:all: django-auth-ldap to avoid installing dev libs via apt.

• Document FIPS guidance:

  • Note that building on a non‑FIPS builder or remote CI is a supported path when apt cannot be avoided.

Workarounds

• Manually comment out apt lines in Dockerfiles (not ideal, breaks reproducibility).
• Set SKIP_APT=1 and run Compose directly if the build arg is added.
• Build the image in a non‑FIPS environment and run it on the FIPS host.