Reduce security vulnerabilities
Explore how you can reduce the security vulnerabilities of your container images.
Abstract
Preface
Discover, secure, and deploy hardened container images to significantly reduce attack surface. As a built-in extension, Hummingbird scans your local registry and suggests an alternative hardened image. Combined with the Grype extension, you can compare an image and its alternative including the image size and the number of common vulnerabilities and exposures (CVEs).
The bundled Hummingbird extension provides minimal, hardened, and secure container images. To bring these capabilities into the developer workflow, the Hummingbird extension provides a searchable catalog of these images. The Grype extension integrates Syft and Grype to scan container images and display known security vulnerabilities. The Hummingbird extension uses the Grype extension to provide security scanning and offer a secure image alternative.
The Grype extension is supported outside the core Service Level Agreement (SLA). Bug fixes and feature requests are addressed on a best-effort basis, with a focus on community-led contributions and available technical resources.
Chapter 1. Benefits
- Enhanced security visibility: You can easily scan local images to view in-depth details about security vulnerabilities.
- Actionable alternatives: Instead of just reporting issues, the extension provides a dedicated page displaying hardened image alternatives from the Hummingbird catalog.
- Simplified migrations: A dedicated clone form makes it simple to clone an existing container with a new, secure Hummingbird image. The extension also clones the container configuration and applies it to the new base image.
- Flexible and resilient: The extension supports multiple providers and handles workflows correctly even if the Grype extension is not installed.
Chapter 2. Impact
- Proactive risk mitigation: Identify and assess known security risks before deployment by scanning local container images.
- Transition to secure containers: Adopting secure base images is straightforward. The extension replaces standard APIs with the Hummingbird catalog, provides exact hardened alternatives, and automates the cloning process through background tasks.
- Intelligent image management: Automatically manages complex edge cases during migrations, successfully transitioning users even when the secure Hummingbird base image is physically larger than their current local image.
Chapter 3. Discover, secure, and deploy hardened container images
Using the bundled Hummingbird, you can discover vulnerabilities in your container images and secure those images by replacing them with hardened alternatives. You can then deploy the hardened images in your workflow.
Prerequisites
- You have logged in using the Red Hat Authentication extension. For more details, refer to This content is not included.Access Red Hat content for development.
Procedure
- Go to the Hummingbird page from the left navigation pane.
Perform one of the following steps:
Discover a new secure hardened container image:
- Click the Catalog tab and locate or search for a hardened image.
- Click the Pull button for that extension to use the container image.
Discover a secure alternative to your current base container image and deploy:
- Click the Alternative tab. A list of your current images and their hardened image alternative is displayed. You can see the difference in the image size and CVEs for each image. You can also view detailed insights on the alternative and the base image.
- Click the container image you want to clone.
Click the Clone button.
NoteSelect the Stop existing container before proceeding (recommended) option to stop the container before cloning.
When cloning is complete, a success message is displayed. Also, the configuration of the base image is automatically applied to the alternative container image.
Verification
- Go to the Containers page and verify that the new container with the hardened image is running.