Preface
Discover, secure, and deploy hardened container images to significantly reduce attack surface. As a built-in extension, Hummingbird scans your local registry and suggests an alternative hardened image. Combined with the Grype extension, you can compare an image and its alternative including the image size and the number of common vulnerabilities and exposures (CVEs).
The bundled Hummingbird extension provides minimal, hardened, and secure container images. To bring these capabilities into the developer workflow, the Hummingbird extension provides a searchable catalog of these images. The Grype extension integrates Syft and Grype to scan container images and display known security vulnerabilities. The Hummingbird extension uses the Grype extension to provide security scanning and offer a secure image alternative.
The Grype extension is supported outside the core Service Level Agreement (SLA). Bug fixes and feature requests are addressed on a best-effort basis, with a focus on community-led contributions and available technical resources.
Benefits
- Enhanced security visibility: You can easily scan local images to view in-depth details about security vulnerabilities.
- Actionable alternatives: Instead of just reporting issues, the extension provides a dedicated page displaying hardened image alternatives from the Hummingbird catalog.
- Streamlined migrations: A dedicated clone form makes it simple to clone an existing container with a new, secure Hummingbird image. The extension also clones the container configuration and applies it to the new base image.
- Flexible and resilient: The extension supports multiple providers and handles workflows correctly even if the Grype extension is not installed.
Impact
- Proactive risk mitigation: Empowers you to confidently identify and assess known security risks before deployment by seamlessly scanning local container images.
- Streamlined transition to secure containers: Eliminates the friction of adopting secure base images by natively replacing standard APIs with the Hummingbird catalog, providing exact hardened alternatives, and seamlessly automating the cloning process via background tasks.
- Intelligent image management: Automatically manages complex edge cases during migrations, successfully transitioning users even when the secure Hummingbird base image is physically larger than their current local image.