Red Hat has launched a preview of Project Hummingbird, a catalog of minimal, hardened container images to help address the need for "zero-CVE" applications.

Available as an early access program for Red Hat customers, the project intends to reduce attack surfaces and bolster supply chain confidence by bridging the gap between accelerating deployment and improving application security.

According to the open source giant, the project does this by offering production ready, micro-sized container images stripped of non-essential components, including languages and runtimes such as Go, Java, and Node, critical developer databases like MariaDB, and web servers and proxies including Nginx, Caddy, and others.

The images are delivered free of known vulnerabilities with a complete software bill of materials (SBOMs), enabling Red Hat users to verify the contents of an image to help meet current compliance requirements.

Project Hummingbird is built using components of Fedora Linux, which serves as the upstream source for Red Hat Enterprise Linux development. Full production support will be made available to subscription customers when the project is released for general availability, while unsupported images will be freely available and redistributable at general availability.

The release expands on Red Hat’s push for stronger software supply chains, having updated its Trusted Software Supply Chain last year in response to an uptick of organizations integrating security protocols directly into their software processes.

The shit-left updates aimed to improve IT teams’ ability to embed security into the application development lifecycle and establish software integrity sooner in the supply chain.

Among them was Red Hat Trusted Artifact Signer, designed to enhance the trustworthiness of software artifacts as they move through the software supply chain by allowing developers and other stakeholders to cryptographically sign and verify each artifact with keyless certificate authority.

A Trusted Application Pipeline, meanwhile, supplied security-focused software supply chain tools by pre-integrating them with self-service templates targeted at developers.