Containers changed how software gets built. Build once, run anywhere, ship faster, scale farther. That part worked. The problem is what comes with the image: pull a base container and you're not just getting a runtime, you're inheriting a full package tree you didn't choose, don't need, and won't maintain when a Common Vulnerabilities and Exposure (CVE) drops. That's the supply chain problem, and it's not abstract. The gap it creates is real: what builds clean on your laptop hits a wall at the platform gate. Not because your code is wrong. Because no one built the container for production.
To address this, the industry is shifting security left, embedding validations directly into the local workflow. Central to this is the Red Hat build of Podman Desktop and its integration with Red Hat Hardened Images, developed and maintained using the pipeline provided by the upstream Project Hummingbird. Through the Hummingbird extension, developers can discover, evaluate, and adopt container images hardened for security without leaving their local development environment. By starting with pre-hardened bases, developers spend significantly less time auditing unneeded dependencies and tracking upstream CVEs, letting them focus on application logic.
Here is how the Hummingbird extension brings hardened base images and 1-click migrations directly into your local Podman Desktop workflow.
What is Project Hummingbird?
Project Hummingbird is the pipeline used to develop and maintain a catalog of minimal, production-ready container base images built for enterprise environments. Each image starts from Fedora Linux components and strips away everything except what a specific runtime needs. This keeps the images small, reduces the attack surface, and helps limit the number of CVEs. The automated update process keeps them current, with the goal of maintaining near-zero vulnerabilities.
Available in both AMD64 and Arm64 architectures, these hardened images work directly with Podman, Docker, or Kubernetes. You can pull them today, at no cost, from the registry for Red Hat Hardened Images.
The Hummingbird extension: Ship clean, ship fast
Developers best realize the benefits of images hardened for security when they integrate them into their daily workflows. The Hummingbird extension for Podman Desktop does exactly this.
Identifying hardened base images
Securing a container often requires developers to navigate external registries, verify Software Bills of Materials (SBOMs), and manually construct minimal bases. The Hummingbird extension eliminates this context switching by bringing the catalog of hardened images directly into your local environment.
The extension features a dedicated catalog page with an integrated search mechanism, as shown in Figure 1. You can search for common runtimes or infrastructure components such as Caddy, Postgres, and Git.
Enhanced scanning with Grype
The Hummingbird extension becomes even more effective when paired with Grype. Grype is an open source vulnerability scanner that inspects container images for CVEs. When added to Podman Desktop, it enables real-time local scanning of your images. To unlock analytical capabilities, you can install the Grype extension through the extension catalog.
Paired with Grype, Hummingbird performs local, real-time vulnerability scanning. It cross-references your local images against continuously updated vulnerability databases and can a Hummingbird image alternative (Figure 2). This process happens entirely on your machine, keeping your proprietary data protected.
The optimization dashboard
To see whether migration is worth the effort, developers need concrete proof that migrating yields tangible benefits. When an image in the user's local registry has a Hummingbird alternative available, a dashboard illustrates the pros and cons of switching.
By eliminating unnecessary software such as package managers and shell environments, Project Hummingbird produces images that are smaller compared to standard distributions.
1-click migration and cloning
Transitioning to a new base image can sometimes introduce configuration errors. The Hummingbird extension offers a cloning mechanism designed for simplified migrations.
The Clone feature lets you spin up an identical container using the hardened image as a base image with a single click (Figure 4). The extension orchestrates the swap, preserving your runtime configurations, environment variables, and volume mounts while keeping the existing container to rollback if necessary. This non-destructive cloning lets you verify application compatibility.
Conclusion
The Hummingbird extension for Red Hat build of Podman Desktop bridges the gap between local development and production security. By bringing Red Hat Hardened Images into your local workflow, it helps you catch vulnerabilities and cut container bloat before your code ever leaves your workstation.
Explore the Hummingbird extension on GitHub to start using security-focused images in your workflow.
Last updated: August 13, 2026
