↓Skip to main content

What is Fedora Hummingbird Linux? | Fedora Podcast 062

·4 mins
Podcasts Fedora Podcast Fedora Podcast Guest Hummingbird Bootc Containers Security Open Source
Table of Contents

Red Hat announced Hummingbird at Summit back in May. I have been trying to get this episode on the calendar ever since, and in the five months it took me, the thing grew sideways into about four different projects. That turned out to be the interesting part.

Fedora Podcast · Episode 62 Open the full episode page →

Scott McCarty is a senior principal product manager at Red Hat. He kicked off Podman with the team and launched Universal Base Image, which is how he and I first crossed paths years ago when I was doing technical product marketing on that project. Jorge Castro runs Project Bluefin and has been on the show once before, back when it was still rpm-ostree. Noah is out this week dealing with the joys of running your own business, so I flew solo with two people I have separately closed down bars with.

A few things worth carrying away:

  • Two things launched at Summit, not one. This is the part everybody conflates, including me before we recorded. Red Hat hardened images went generally available, and Fedora Hummingbird Linux was announced. The hardened images had been in the works for several months before that. They are not the same thing and one did not become the other.
  • The actual difference is whether there is a kernel in it. Scott put it about as plainly as it can be put: a container image will never boot. Add a kernel and it becomes a bootable container. That is Fedora Hummingbird Linux. Everything else, the package channel, the build factory, the chase for near zero CVEs, is shared.
  • Roughly 95 percent of it is Fedora Rawhide. About one percent comes from the major Fedora releases, and the remaining four or so gets pulled forward or pulled wider when Fedora does not have what is needed yet. If Python 3.15 drops, Hummingbird grabs it early and realigns with Fedora later.
  • The reason any of this is urgent is not containers. It is that time to exploit collapsed. Scott walked through the math: in 2018 you might discover a CVE and it would take a specialized seven-person team at a three-letter agency about two and a half years to turn it into a working exploit. Now, in some cases, the average time to exploit is negative seven days, meaning the bad guys get there first. His phrase for what changed was that it “democratized exploits in a way that had never been done before.” When patching took two years to matter, quarterly was fine. It is not fine anymore.
  • Scott pushed back on calling it more secure, and he was right to. He drew the line between risk based patching, where you fix what matters and accept that fifty low-severity CVEs are not going to hurt you, and compliance based patching, where somebody is getting audited and just needs the number to be zero. Both are valid. Hummingbird serves the second group, and the people in it mostly did not choose to be there.
  • Jorge built the first Utah Raptor in a bar on a dare. Two hours, with Fable. Then it took 13 people 22 days to turn that into a shippable Bluefin, which he points out represents five years of accumulated Universal Blue knowledge. Somebody on the team packaged 3,000 RPMs in two weeks. Bluefin merged 1,400 pull requests. His read on it: humans are not going to be doing this part much longer.
  • Switching an existing bootc home lab is a pointer change. This was the question I actually came in with, because I spent my whole summer rebuilding my lab on Fedora Server bootc images and I was not excited about doing it twice. The answer is that I change what ITG-BASE points at, the pipelines run overnight, and the Podman quadlets on top do not care what is underneath.

We also got into micro VMs and why the cloud native crowd suddenly cares about things that reboot constantly, local models maintaining your distro for you, why Hummingbird ships no desktop at all and is better understood as a builder kit, and Jorge’s full Jurassic Park getup, which he defended with “birds are dinosaurs, man.”

Both of them closed with the same ask in different words. Scott wants people on the Fedora discussion threads describing what they would actually build with this, because the team can pivot fast and wants real use cases to pivot toward. Jorge wants builders to just grab the container and try swapping a base image. And after I had already wrapped the episode, he threw out a challenge that I decided to leave in rather than cut: somebody who knows containers could probably build Bazzite on Hummingbird in about 25 minutes.

Who among you will take it?

You might also like