Project Hummingbird - Minimal Images, Maximum Trust

Every container image you pull carries a risk - hundreds of packages you didn't explicitly ask for, vulnerabilities you'll spend weeks triaging, and no proof of how it was built. What if you could start from a base image that ships with near-zero CVEs, includes only what your application needs to run, and provides cryptographic evidence of its entire build process?

Project Hummingbird is an open source initiative that produces minimal, hardened container images built from Fedora sources. Every image is distroless by design, built in a SLSA Level 3 pipeline (Konflux), ships with a signed SBOM, and is reproducible -- you can rebuild it locally and verify you get the same bytes. The images are free, redistributable.

This talk introduces Project Hummingbird to an audience that cares about container security.

• You can start using near-zero CVE, distroless container images today

• Supply chain trust (SLSA3, SBOMs, signatures) is built into every Hummingbird image by default

• The distroless approach doesn't mean giving up usability

• Hummingbird images are reproducible: you can independently verify what you're running

• This is open source, built from Fedora, and redistributable