Containers changed how software gets built. Build once, run anywhere, ship faster, scale farther. That part worked. The problem is what comes with the image: pull a base container and you're not just getting a runtime, you're inheriting a full package tree you didn't choose, don't need, and won't maintain when a Common Vulnerabilities and Exposure (CVE) drops. That's the supply chain problem, and it's not abstract. The gap it creates is real: what builds clean on your laptop hits a wall at the platform gate. Not because your code is wrong. Because no one built the container for production.
To address this, the industry is shifting security left, embedding validations directly into the local workflow. Central to this is the Red Hat build of Podman Desktop and its integration with Red Hat Hardened Images, developed and maintained using the pipeline provided by the upstream Project Hummingbird. Through the Hummingbird extension, developers can discover, evaluate, and adopt container images hardened for security without leaving their local development environment. By starting with pre-hardened bases, developers spend significantly less time auditing unneeded dependencies and tracking upstream CVEs, letting them focus on application logic.
Here is how the Hummingbird extension brings hardened base images and 1-click migrations directly into your local Podman Desktop workflow.
What is Project Hummingbird?
Project Hummingbird is the pipeline used to develop and maintain a catalog of minimal, production-ready container base images built for enterprise environments. Each image starts from Fedora Linux components and strips away everything except what a specific runtime needs—eliminating bloat that inflates attack surfaces and accumulates CVEs. Combine that lean footprint with a highly automated update workflow, and you get images targeting near-zero vulnerabilities by design.
Available in both AMD64 and Arm64 architectures, these hardened images work directly with Podman, Docker, or Kubernetes—and you can pull them today, at no cost, from the registry for Red Hat Hardened Images.
The Hummingbird extension: Ship clean, ship fast
Developers best realize the benefits of images hardened for security when they integrate them effortlessly into their daily workflows. The Hummingbird extension for Podman Desktop does exactly this, operating under the philosophy of "ship clean, ship fast."
Identifying hardened base images
Securing a container often requires developers to navigate external registries, verify Software Bills of Materials (SBOMs), and manually construct minimal bases. The Hummingbird extension eliminates this context switching by bringing the catalog of hardened images directly into your local environment.
The extension features a dedicated catalog tab with an integrated search mechanism, as shown in Figure 1. When you search for common runtimes or infrastructure components, the extension badges the Hummingbird alternatives with a visual verification icon. This displays the most secure architectural choices instantly.
Enhanced scanning with Grype
The Hummingbird extension becomes even more effective when paired with Grype. Grype is an open source vulnerability scanner that inspects container images for known security flaws. When added to Podman Desktop, it enables real-time local scanning. To unlock analytical capabilities, you can install the Grype extension through the extension catalog.
Paired with Grype, Hummingbird performs local, real-time vulnerability scanning. It cross-references your local images against continuously updated vulnerability databases and actively intervenes to suggest a security-focused Hummingbird image alternative (Figure 2). This localized process happens entirely on your machine, keeping your proprietary data protected.
The optimization dashboard
To see whether migration is worth the effort, developers need concrete proof that migrating yields tangible benefits. When an image in the user's local registry has a Hummingbird alternative available, a dashboard illustrates the pros and cons of switching.
By eliminating unnecessary software such as package managers and shell environments, Project Hummingbird produces images that are micro-sized compared to standard distributions.
1-click migration and cloning
Transitioning to a new base image can sometimes introduce configuration errors. The Hummingbird extension addresses this operational hurdle through a dedicated cloning mechanism designed for simplified migrations.
The Clone feature lets you spin up an identical container using the hardened image as a base image with a single click (Figure 4). The extension orchestrates the swap, carefully preserving your complex runtime configurations, environment variables, and volume mounts. This non-destructive cloning lets you verify application compatibility.
Conclusion
The Hummingbird extension for Red Hat build of Podman Desktop bridges the gap between local development and production security. By bringing Red Hat Hardened Images into your local workflow, it helps you catch vulnerabilities and cut container bloat before your code ever leaves your workstation.
Explore the Hummingbird extension on GitHub to start using security-focused images in your workflow.
Facts Only
* Containers enabled build once, run anywhere, faster shipping, and farther scaling.
* The problem is inheriting unwanted package trees from base containers, which accumulate unmanaged CVEs.
* The gap exists between local builds and platform gate security checks because containers are not built for production standards.
* Project Hummingbird is a pipeline for developing minimal, production-ready container base images based on Fedora Linux components.
* These images strip away unnecessary components to reduce bloat and attack surfaces.
* Hummingbird images offer automated updates to target near-zero vulnerabilities by design.
* Images are available for AMD64 and Arm64 architectures and work with Podman, Docker, or Kubernetes.
* The Hummingbird extension integrates hardened images into the local Podman Desktop workflow.
* The extension provides a catalog search for hardened alternatives with visual verification icons.
* The extension integrates Grype for local, real-time vulnerability scanning against known flaws.
* A dashboard illustrates the pros and cons of migrating to a Hummingbird alternative.
* A Clone feature allows spinning up identical containers using a hardened image with one click.
Executive Summary
The shift in container security focuses on addressing the vulnerability inherent in inherited base images within the software supply chain. The central problem identified is that standard container practices fail to account for the security state of underlying components, leading to a gap between local development and production deployment where code built locally does not meet platform security standards. To mitigate this, the industry is implementing a "shift left" security strategy by embedding security validations directly into the local workflow.
This approach centers around Project Hummingbird, which provides a pipeline for developing minimal, hardened container base images starting from Fedora components to reduce attack surface and accumulated vulnerabilities. The Hummingbird extension for Podman Desktop integrates these hardened images and migration tools directly into the developer's environment. Key features include a catalog tab for discovering secure alternatives, integration with vulnerability scanners like Grype for real-time local scanning, an optimization dashboard to evaluate migration benefits, and a one-click cloning mechanism for non-destructive migrations.
The overall objective is to allow developers to adopt security-focused images and perform necessary hardening during the development process, thereby reducing time spent auditing dependencies and CVEs, allowing focus to remain on application logic.
Full Take
The narrative pivots on reframing security from a post-deployment gatekeeping function to an integrated, proactive development activity. The core tension lies between the established practice of container abstraction and the necessity of granular, traceable base image provenance. The supply chain issue is not merely a technical one but reflects a systemic failure in process accountability—the gap identified between local execution environments and mandated production security baselines.
The proposed solution attempts to bridge this gap by making security infrastructure discoverable and actionable at the point of creation. The concept that "shipping clean, ship fast" demands automated, localized hardening forces a change in developer mindset from dependency acceptance to dependency verification before deployment. The integration of tools like Grype and the migration cloning feature suggests that the practical adoption depends less on theoretical security benefits and more on minimizing operational friction during the transition.
The implicit assumption is that the complexity of modern software requires context-aware tooling. If this system successfully shifts validation left, the pattern being addressed is the diffusion of responsibility across the deployment lifecycle. The potential implication for human agency is whether this layer of enforced standardization moves security from an optional auditing task to an intrinsic, unavoidable part of the build process, or if it simply creates a new set of mandatory, highly specialized procedures that developers must master to avoid failure. What are the overlooked costs associated with requiring this level of upfront standardization?