Containers changed how software gets built. Build once, run anywhere, ship faster, scale farther. That part worked. The problem is what comes with the image: pull a base container and you're not just getting a runtime, you're inheriting a full package tree you didn't choose, don't need, and won't maintain when a Common Vulnerabilities and Exposure (CVE) drops. That's the supply chain problem, and it's not abstract. The gap it creates is real: what builds clean on your laptop hits a wall at the platform gate. Not because your code is wrong. Because no one built the container for production.
To address this, the industry is shifting security left, embedding validations directly into the local workflow. Central to this is the Red Hat build of Podman Desktop and its integration with Red Hat Hardened Images, developed and maintained using the pipeline provided by the upstream Project Hummingbird. Through the Hummingbird extension, developers can discover, evaluate, and adopt container images hardened for security without leaving their local development environment. By starting with pre-hardened bases, developers spend significantly less time auditing unneeded dependencies and tracking upstream CVEs, letting them focus on application logic.
Here is how the Hummingbird extension brings hardened base images and 1-click migrations directly into your local Podman Desktop workflow.
What is Project Hummingbird?
Project Hummingbird is the pipeline used to develop and maintain a catalog of minimal, production-ready container base images built for enterprise environments. Each image starts from Fedora Linux components and strips away everything except what a specific runtime needs—eliminating bloat that inflates attack surfaces and accumulates CVEs. Combine that lean footprint with a highly automated update workflow, and you get images targeting near-zero vulnerabilities by design.
Available in both AMD64 and Arm64 architectures, these hardened images work directly with Podman, Docker, or Kubernetes—and you can pull them today, at no cost, from the registry for Red Hat Hardened Images.
The Hummingbird extension: Ship clean, ship fast
Developers best realize the benefits of images hardened for security when they integrate them effortlessly into their daily workflows. The Hummingbird extension for Podman Desktop does exactly this, operating under the philosophy of "ship clean, ship fast."
Identifying hardened base images
Securing a container often requires developers to navigate external registries, verify Software Bills of Materials (SBOMs), and manually construct minimal bases. The Hummingbird extension eliminates this context switching by bringing the catalog of hardened images directly into your local environment.
The extension features a dedicated catalog tab with an integrated search mechanism, as shown in Figure 1. When you search for common runtimes or infrastructure components, the extension badges the Hummingbird alternatives with a visual verification icon. This displays the most secure architectural choices instantly.
Enhanced scanning with Grype
The Hummingbird extension becomes even more effective when paired with Grype. Grype is an open source vulnerability scanner that inspects container images for known security flaws. When added to Podman Desktop, it enables real-time local scanning. To unlock analytical capabilities, you can install the Grype extension through the extension catalog.
Paired with Grype, Hummingbird performs local, real-time vulnerability scanning. It cross-references your local images against continuously updated vulnerability databases and actively intervenes to suggest a security-focused Hummingbird image alternative (Figure 2). This localized process happens entirely on your machine, keeping your proprietary data protected.
The optimization dashboard
To see whether migration is worth the effort, developers need concrete proof that migrating yields tangible benefits. When an image in the user's local registry has a Hummingbird alternative available, a dashboard illustrates the pros and cons of switching.
By eliminating unnecessary software such as package managers and shell environments, Project Hummingbird produces images that are micro-sized compared to standard distributions.
1-click migration and cloning
Transitioning to a new base image can sometimes introduce configuration errors. The Hummingbird extension addresses this operational hurdle through a dedicated cloning mechanism designed for simplified migrations.
The Clone feature lets you spin up an identical container using the hardened image as a base image with a single click (Figure 4). The extension orchestrates the swap, carefully preserving your complex runtime configurations, environment variables, and volume mounts. This non-destructive cloning lets you verify application compatibility.
Conclusion
The Hummingbird extension for Red Hat build of Podman Desktop bridges the gap between local development and production security. By bringing Red Hat Hardened Images into your local workflow, it helps you catch vulnerabilities and cut container bloat before your code ever leaves your workstation.
Explore the Hummingbird extension on GitHub to start using security-focused images in your workflow.
