Project Hummingbird - Minimal Images, Maximum Trust

Duration: NaN:NaN:NaN

Speaker: Gaurav Kamathe

Type: CLS - Talk (Open Tech Summit)

Expertise:

Event: Devcon

Date: Nov 2026

Every container image you pull carries a risk - hundreds of packages you didn't explicitly ask for, vulnerabilities you'll spend weeks triaging, and no proof of how it was built. What if you could start from a base image that ships with near-zero CVEs, includes only what your application needs to run, and provides cryptographic evidence of its entire build process? Project Hummingbird [1] is an open source initiative that produces minimal, hardened container images built from Fedora sources. Every image is distroless by design, built in a SLSA Level 3 pipeline (Konflux), ships with a signed SBOM, and is reproducible -- you can rebuild it locally and verify you get the same bytes. The images are free, redistributable. This talk introduces Project Hummingbird [1] to an audience that cares about container security. Key Takeaways - You can start using near-zero CVE, distroless container images today - Supply chain trust (SLSA3, SBOMs, signatures) is built into every Hummingbird image by default - The distroless approach doesn't mean giving up usability - Hummingbird images are reproducible: you can independently verify what you're running - This is open source, built from Fedora, and redistributable [1] [https://fedoraproject.org/wiki/Hummingbird](https://fedoraproject.org/wiki/Hummingbird)