I've got a similar question in #masacms, but does anybody know of any US Federal Gov't agencies that use Lucee? The last discussion I know of was 6 years ago, but it was pretty inconclusive.

NASA uses Lucee

thanks, zackster! looking forward to hearing what gert has to say, too.

All of the govt projects I have utilized have been restricted to ACF; Lucee not in the approved category as of last year or so since setting up a new app. Also housed environment is a key role in what can be utilized. But until an agency fully backs and rigorously confirms it as a stable app to meet their standards then it is still not approved.

just saw this from @malcolmokeeffe: https://dev.lucee.org/t/companies-organizations-using-lucee/3617/7

There are a few that use Lucee. Not through our services but through companies that mainly use Lucee as their main CFML engine. Like the US Senate used to use Lucee. I personally have not been involved with any other government agency than Nasa.

You can add Apple to that list

Well I wouldn’t dare calling them a government agency 😄

deep state

😄

Alternative Servlet Engines!!!

There are a number of Gov agencies that run Lucee and serve applications, but the mechanism of how it is run becomes more important as you get in to different echelons of the Federal Government infrastructure. NASA and the Senate can run it under a standalone install, because they have different IA processes. Once you get in to the executive branch or the DoD, they have different processes. Many of these branches require that OSS software used have some sort of support agreement in place to be run on their systems. For DoD ( and some other Exec branches ), this also require that the software be whitelisted in DADMS, for use in systems with classification. The support piece can be problematic, running Lucee as standalone, because the hoops required to pay money to a foreign entity - even a non-profit - are massive. As such, many choose to purchase Adobe licensing, because the support piece is included and the barrier of entry is lower for IA approval. So, to give you an example, CommandBox is whitelisted in DADMS. Any Lucee Server running as a service started by CommandBox has that origin as a process meaning that software scans of the machine, picking up that process, are OK to run, as long as the group running the software has added CommandBox as part of their IA ( Infrastructure Accreditation ) package. A standalone Lucee instance, running from the installer, would require an accreditation exception, in order for the branch/group/application to use it - because it’s not in DADMS. So, with all that in mind, we have clients that run Lucee servers using CommandBox services. There is also a Lucee Iron Bank image which is approved for use in AWS/Azure Gov Clouds

Thanks for all of that info, @jclausen! I'm asking because I want to do my best to figure out which hurdles we might face with our application when we undergo the ATO process. It seems like there's good precedent for Lucee within the executive branch. FYI, my project is for a federal civilian executive branch agency. Why is it that CommandBox is a path of less resistance for Lucee? If there's a support contract requirement, how does that differ from Lucee, itself? (Is Ortus necessarily involved?) What's the difference between running the CommandBox docker image (for the purpose of running Lucee) versus running the Lucee Iron Bank image, both in the eyes of the Gov't, and as an implementer? Right, now, I run the official (non-CommandBox) Lucee docker image.

Why is it that CommandBox is a path of less resistance for Lucee? If there’s a support contract requirement, how does that differ from Lucee, itself?

If Lucee is in the pre-approved sofware list for the branch you are working with, then there is no resistance. The certification for machine-level software is at the binary level, and Lucee’s installer, service, all run through that binary - which needs to be certified. In the case of, for example, the DoD, CommandBox is already in DADMs and so, when the scanners hit that process, it’s known and pre-approved for usage.

What’s the difference between running the CommandBox docker image (for the purpose of running Lucee) versus running the Lucee Iron Bank image, both in the eyes of the Gov’t, and as an implementer?

There is currently no IronBank image for the Lucee images you use. Having a pre-approved image in IronBank bypasses a lot of the accreditation process, because everything in there is approved for usage in Gov cloud. The onboarding process is lengthy and requires a government sponsor but, once they get approved and published, no additional accreditation is required to use those images in GovCloud. For on-prem usage, most branches whitelist IronBank images, even if Docker has to be on the accreditation package.