, Community Led Stage
Every container image you pull carries a risk - hundreds of packages you didn't explicitly ask for, vulnerabilities you'll spend weeks triaging, and no proof of how it was built. What if you could start from a base image that ships with near-zero CVEs, includes only what your application needs to run, and provides cryptographic evidence of its entire build process?
Project Hummingbird [1] is an open source initiative that produces minimal, hardened container images built from Fedora sources. Every image is distroless by design, built in a SLSA Level 3 pipeline (Konflux), ships with a signed SBOM, and is reproducible -- you can rebuild it locally and verify you get the same bytes. The images are free, redistributable.
This talk introduces Project Hummingbird [1] to an audience that cares about container security.
Key Takeaways
You can start using near-zero CVE, distroless container images today
Supply chain trust (SLSA3, SBOMs, signatures) is built into every Hummingbird image by default
The distroless approach doesn't mean giving up usability
Hummingbird images are reproducible: you can independently verify what you're running
This is open source, built from Fedora, and redistributable
Seasoned Software and Security Engineering professional.
Primary interests are Security, Linux, Malware, AI/ML
Loves working on the command-line.