Project Hummingbird - Minimal Images, Maximum Trust

Every container image you pull carries a risk - hundreds of packages you didn't explicitly ask for, vulnerabilities you'll spend weeks triaging, and no proof of how it was built. What if you could start from a base image that ships with near-zero CVEs, includes only what your application needs to run, and provides cryptographic evidence of its entire build process?

Project Hummingbird [1] is an open source initiative that produces minimal, hardened container images built from Fedora sources. Every image is distroless by design, built in a SLSA Level 3 pipeline (Konflux), ships with a signed SBOM, and is reproducible -- you can rebuild it locally and verify you get the same bytes. The images are free, redistributable.

This talk introduces Project Hummingbird [1] to an audience that cares about container security.

Key Takeaways

- You can start using near-zero CVE, distroless container images today

- Supply chain trust (SLSA3, SBOMs, signatures) is built into every Hummingbird image by default

- The distroless approach doesn't mean giving up usability

- Hummingbird images are reproducible: you can independently verify what you're running

- This is open source, built from Fedora, and redistributable

[1] [https://fedoraproject.org/wiki/Hummingbird](https://fedoraproject.org/wiki/Hummingbird)

Speakers: Gaurav Kamathe

Track: [CLS] - OTS