Project Hummingbird - Minimal Images, Maximum Trust
<p>Every container image you pull carries a risk - hundreds of packages you didn't explicitly ask for, vulnerabilities you'll spend weeks triaging, and no proof of how it was built. What if you could start from a base image that ships with near-zero CVEs, includes only what your application needs to run, and provides cryptographic evidence of its entire build process?</p><p>Project Hummingbird [1] is an open source initiative that produces minimal, hardened container images built from Fedora sources. Every image is distroless by design, built in a SLSA Level 3 pipeline (Konflux), ships with a signed SBOM, and is reproducible -- you can rebuild it locally and verify you get the same bytes. The images are free, redistributable.</p><p>This talk introduces Project Hummingbird [1] to an audience that cares about container security.<br><br>Key Takeaways</p><ul><li><p>You can start using near-zero CVE, distroless container images today</p></li><li><p>Supply chain trust (SLSA3, SBOMs, signatures) is built into every Hummingbird image by default</p></li><li><p>The distroless approach doesn't mean giving up usability</p></li><li><p>Hummingbird images are reproducible: you can independently verify what you're running</p></li><li><p>This is open source, built from Fedora, and redistributable</p></li></ul><p></p><p>[1] <a target="_blank" rel="noopener noreferrer" href="https://fedoraproject.org/wiki/Hummingbird">https://fedoraproject.org/wiki/Hummingbird</a></p><p></p>
