What is Fedora Hummingbird Linux? | Fedora Podcast 062 Recorded October 14, 2026 Eric Hendricks, host Scott McCarty, Red Hat Jorge Castro, Project Bluefin ---------------------------------------- [00:00:00] Eric Hendricks: Nobody wants to be that person. You know the guy. The one that has to go and talk to the security team about why there was some critical vulnerabilities left in a software package. I've not had to be that guy myself, but I've seen that conversation. It never goes well. Fedora's Hummingbird is an attempt to make that a solved problem instead of a monthly transaction. Hey there, and welcome to the Fedora Podcast. This is episode number 62. I'm Eric, the IT guy Hendricks, and I'll be your host today. Noah is out with a work ordeal, something about running your own business. So I'm going to fly solo, but I decided to bring in a couple of friends, one of which has been on the show, and the other I've been trying to drag onto the show for over a year now. So they know who they are. But today we're going to be talking about an announcement that Red Hat made this past year at Summit. So here it is in October already. This announcement was made in May. And I cannot believe the amount of traction that Hummingbird has gotten in just five-ish months. It has grown. It has changed. And I think it's a real testament to open source and how an idea can spawn just an entire collection of ideas and how those ideas can grow. And it really highlights why open source is something that I love so much. It's something why I love being a part of the Linux community. Because you never know when you put an idea out there what it might turn into. So joining me today are Scott McCarty and Jorge Castro. And we're going to talk about what was announced, what Hummingbird looks like today, and a little bit about how it's changed since. So let me go ahead and bring on Mr. Scott McCarty. Welcome to the Fedora podcast, my friend. [00:02:00] Scott McCarty: Thank you for having me. [00:02:02] Eric Hendricks: Yeah, so four questions I ask everyone every episode. Who are you? What do you do for work? What do you do for Fedora? And what's something you do for fun? [00:02:12] Scott McCarty: Who am I? I'm Scott McCarty. I am a senior principal product manager at Red Hat. I am focused on what we call internally hummingbird and externally sometimes. Red Hat Hardened Images and Red Hat Enterprise Linux, which most people are familiar with. That is the basic gist. I was also the product manager for Podman. I kicked off Podman with the team. And I also launched Red Hat Universal Base Image. So I'm a container guy deep down inside, I guess is what I am probably. I'm a former sysadmin, container guy, and now product manager. [00:02:45] Eric Hendricks: Yeah. In fact, when UBI was becoming more and more of a thing, I was actually the technical product marketing manager working on that project with you. So that's been a few years now. But yeah, it's great to reconnect. The fourth question is, what's something you do for fun? So when you're not PMing, what is Scott McCarty doing? [00:03:03] Scott McCarty: I actually, as of recent, am working on a really important project to me for the park systems in Northeast Ohio. So I built this crazy park system app that weaves together 10 different park systems and shows every event and news item that is happening across probably 100 parks that are all part of a bunch of different park systems. Including a train tracker that tracks a train going up and down north and south through the park and also a water taxi that goes around on the Cuyahoga River. [00:03:33] Eric Hendricks: So oh that's so cool [00:03:34] Scott McCarty: That's been my like passion project as of recently. [00:03:38] Eric Hendricks: That's a lot of fun also all right and so Jorge Castro a returning guest of the fedora podcast welcome back my friend [00:03:48] Jorge Castro: Thanks for having me [00:03:50] Eric Hendricks: And for those that didn't get to see the episode gosh it's been a couple years now i think about bluefin why don't you tell us who you are what you do for work what you do for fedora and what's what's something you do for fun [00:04:03] Jorge Castro: Yeah my name is Jorge Castro i work on project bluefin which is a bootc image the last time i was here was rpm os tree now it's bootc i don't really do anything directly for fedora i guess if you've heard of universal blue Bazzite aurora and bluefin i guess more of a bootc side direct thing going on. And for fun, I'm an automotive enthusiast. [00:04:26] Eric Hendricks: Like working on cars, stealing cars, collecting cars, [00:04:30] Jorge Castro: Racing, you know, Audi's in service right now, getting the winters on, that kind of thing. [00:04:36] Eric Hendricks: That's awesome. [00:04:39] Jorge Castro: I live in Michigan, north of Scott, so more snow. [00:04:44] Eric Hendricks: And so we're kind of like this. You've got Kansas City, Ohio, and then Michigan. [00:04:49] Jorge Castro: Yeah. Back in the day, we fought a war over a city called Toledo, if you can believe that. [00:04:54] Scott McCarty: You guys got the better end of that because you guys got the up. [00:05:00] Eric Hendricks: So don't discount yourself, though, Jorge, because I think one of the things that doesn't get highlighted enough in the community is the fact that Fedora is not just a distribution that eventually becomes Red Hat Enterprise Linux. That is probably what it's best known for, if not for being a Linux and open source focused desktop. But I don't think we talk about the downstream of Fedora often enough. We have the last few episodes of this show, we talked a little bit about CentOS, And today we're going to talk about some things that have a little bit to do with RHEL. But don't discount Bluefin. You almost got me to switch to Bluefin after that episode. It just took a few years because now my home lab is running all bootc. So I've got Fedora server bootc images running in my home lab now. It took some time. I'm still not running Bluefin. [00:05:48] Jorge Castro: No, it doesn't matter. [00:05:50] Eric Hendricks: I think you won't. It doesn't matter. [00:05:51] Jorge Castro: If you're using bootc, you're getting exactly what you want. That's kind of my shtick there. [00:05:56] Eric Hendricks: That's great. [00:05:57] Jorge Castro: You can do whatever you want. I source from Hummingbird, Fedora, don't care. It's fantastic. But I'll let Scott talk about that. [00:06:04] Eric Hendricks: For sure. In fact, on another screen, I have eight pipelines running right now, rebuilding the bulk of my bootc fleet right now. That's what happens when you decide that your service account needs an SSH key. So you've rebuilt the base image and then it has to filter down to all of your active running services. So I shouldn't impact this recording. But if I go offline, And it's because one of my web servers went down. Anyway, so let's jump in our time machine here. You're all's pick. It can be a TARDIS. It can be a DeLorean, whichever. But let's go back to May. Let's talk about Summit 2026. I want to hear about what exactly was announced. Not what it is to date, but let's talk about exactly what was announced at Summit. [00:06:51] Scott McCarty: Yeah. So at Summit, we launched actually two things. We launched Red Hat hardened images as generally available, which is more of a product thing. But then we also launched what we call Fedora Hummingbird Linux, which is a bootc based distribution that is based on Fedora and it moves very quickly. Probably 95% of it is based on Fedora Rawhide and 5%, call it 1% is based off Fedora the major Fedora versions like 45 44, 46 and then another 4% of it is rolls a little bit forward of Fedora a little bit both, both temporally as in time it goes a little bit forward like if the Python 3.15 drops for example faster we would pull it in quick and Hummingbird and then wait and then realign with Fedora. Or sometimes it'll go a little bit wider. Like it might be something that's not supported, like something that doesn't have a package maintainer in Fedora. So we'll go a little bit wider and we'll also go faster a little bit. So it's 95% Fedora, basically. But the idea of it is that it patches really fast. [00:08:00] Eric Hendricks: So for those that aren't aware, Fedora Rawhide is actually, I don't want to call it a distribution or a spin, but it's an addition, if you will, of Fedora that actually moves faster. It's basically built off the nightly build so there's not exactly an ISO that you can go out and download. So for those of you that just don't think that Fedora is fast enough that you don't get your updates fast enough try Fedora Rawhide. [00:08:25] Scott McCarty: I might also add that Fedora Rawhide used to be unstable. It was considered unstable. But as of recent years it's actually pretty stable. Even the nightlies are pretty stable. [00:08:39] Eric Hendricks: That's awesome. [00:08:40] Jorge Castro: Do you, sorry to interrupt, do you all publish a bootc image of Rawhide? [00:08:45] Eric Hendricks: I actually don't know that. [00:08:48] Scott McCarty: I don't know that either. [00:08:49] Jorge Castro: Like it probably doesn't build four times out of the week or whatever, but I'm sure it builds every once in a while. That's interesting. That's a good question. [00:08:57] Eric Hendricks: So we have a hidden guest today who shall remain nameless, but they say that it's more of an intermediate build with bootc. So there isn't a specific Rawhide bootc image. Maybe that's something worth looking into. So so what you're saying is fedora hummingbird was announced as something that pulls in a big chunk of rawhide a little bit of fedora proper for lack of a better term and then some things go all the way out and pull all the way from the upstream yep to to what end [00:09:34] Scott McCarty: To what end the idea is that the. [00:09:37] Eric Hendricks: World has changed [00:09:37] Scott McCarty: In this post-Mythos moment where essentially everyone is now pretty concerned with CVEs, right? You have the challenge of chaining CVEs. So like two lows and a moderate might be as good as a critical now. And the problem is we don't know when they're getting chained together, right? Like there's all kinds of people doing security research, trying to identify those. And then sometimes they'll even identify those as another CVE. But it's a sort of arms race where we're not sure if the good guys are finding those faster than the bad guys. In fact, we're pretty sure they're not right now, which is bad. So everybody basically just wants to stay patched as quickly as possible. So the premise of Fedora Hummingbird Linux is it chases upstream because with CI/CD and automation nowadays, you can make fast things pretty stable. And it's a fast thing that's stable that also balances, if you think about it from a security perspective, confidentiality, availability, integrity. It gives you pretty good integrity and pretty good availability, really good integrity. The idea is you patch faster, but you also make it stable, pretty stable. So you don't want to create so many issues that you're rolling so fast that you break things, but you still get all the CVEs patched as quickly as humanly possible. That's kind of the premise in a nutshell. [00:10:58] Eric Hendricks: Yeah, Mythos really, I've never seen an industry at the same time just have the same panic attack. But yeah, the Mythos, and maybe we can find a blog post or something to explain it a little bit more in depth. But to our audience, Mythos was, was that part of ChatGPT? Was that OpenAI? [00:11:16] Scott McCarty: Anthropic. [00:11:17] Eric Hendricks: Anthropic, sorry. Yeah, so Anthropic released this model, this leading-edge model called Mythos. And had it gone on for about another two or three hours, I think we could have seen Skynet. So they shut it down, and it found tons of vulnerabilities, and it was designing them, fixing them, discovering them. I mean, it was this whole mess, and they were basically told to shut it down. So we almost had Terminators not too long ago. [00:11:48] Scott McCarty: Yeah. And I could give a little bit more detail. The Mythos moment really was, you know, Opus is their sort of like their premier model that was pretty good at coding, right? Like it's, it's really good at coding. Fable and Mythos are the next generation that were even better. What happened was Mythos was so good at not just discovering them, but also exploiting them. And so Opus could discover them pretty well. It could discover them, but it wouldn't figure out how to exploit them. The magic was once, there was always a time to discovery, time to exploit for all CVEs for the history of humanity. And usually we would discover them. You go back to like 2018 and you would discover a CVE and it would take 2.3 years to find a way to exploit it. And it would take a team of seven people working at a three-letter agency for the United States to do that. It was a highly trained team, took them a couple of years to figure that out, right? Now it went from seven people, highly paid, highly trained, very specialized human beings to two years to a single dude in his basement with Mythos discovering it in like a few days. And so it basically democratized exploits in a way that had never been done before. And that's why everybody got sent into a tailspin. And then the solution to that that we started looking at is basically, OK, cool, let's patch things as quickly as possible. It wasn't always worth patching that fast before that because you had two years. You're like, we can patch it as we patch it. Right. But now when, you know, the average time to exploit now is negative seven days for in some cases, which means the bad guys find it seven days before the good guys. That's bad. And so that's when people started wanting to patch really quickly. [00:13:30] Eric Hendricks: So, as a former systems administrator who also doubled as a security guy, we won't talk about all the hats that you wear as a sysadmin, but basically what you're looking at, and Scott knows this too, what you're looking at is basically a vehicle to patch things really, really fast, which back in my day, it was unheard of to patch every quarter. I had to beg and borrow and steal resources to patch quarterly. Now we're talking about patching multiple times a day. Where does that lead us? What kind of use cases are we looking to solve, Scott? [00:14:07] Scott McCarty: Yeah, that's a very good question, Eric. And you're right. There is some kind of break-even point, right, where it's worth it or not worth it. We have found the most interest in this around edge devices, so small devices that need to support different hardware very quickly. Another place that we've seen a lot of interest is around micro VMs, things that can reboot all the time, doesn't really matter, right? Like, you know, Firecracker style thing. So these micro VMs are maybe not super familiar for a lot of some of the traditional Linux community, if you will, but it's basically gotten hot in the cloud native space, right? Like where people are running home labs for LLMs and agents, and they want to put them in these micro VMs, essentially. And so that's a place where we have found interesting use cases. And we're exploring other use cases, basically anything. Jorge has found some interesting use cases to go really far with some of this stuff. [00:15:03] Eric Hendricks: Yeah, I wanted to pick your brain on how that impacts Fedora users, Jorge. You had a pretty good story that I wanted our listeners to. [00:15:10] Jorge Castro: I'm not going to translate Mr. Cloud Native over there. [00:15:12] Scott McCarty: There you go. [00:15:14] Jorge Castro: To everybody else. If you're a Linux user, everything that you want, you need to get a lot faster now than you did nine months ago or even six months ago. You need to have the latest kernel. If you're a professional and you're a Linux client user like I am, you're going to want all this sandboxing stuff because everyone at work is going to want to play with these things. But it's your work laptop. So things like Firecracker, there's a thing just got into the CNCF, the agentic, there's like agentic frameworks and stuff coming in now. Everything that you're going to see at conferences right now, it's going to be about these micro VMs and sandboxes and stuff. And when things in Linux affect cloud, they inevitably affect desktop, especially in the bootc world, where the entire point was to bring the desktop into alignment with the rest of cloud native. So now all of a sudden, as a downstream of Fedora, as Bluefin needs a base image. I have to compete. I have to ship with as little CVEs as possible. We're all under the same constraints, whether you're an enthusiast or not, right? Whether you're playing for it for fun or not. So now I need Python when it comes out, dude. You know, I don't have time to wait the six months. But then you have Fedora, which is basically almost semi-rolling anyway, right? It does releases, but you always get a rolling kernel two weeks after or whatever. So I think the most important thing that this kind of stuff does because it's not just hummingbird it's going to be this micro bms it's going to be there's always kubernetes is always going to be in the conversation podman docker all of this kind of stuff is you got to get the stuff to the users faster now so that they can protect themselves because we need to ship this technology the problem that we're all trying to solve is typically when you move faster right i ran a debian sid machine or those of you who run arch right it's like oh i got something new but now i'm a system administrator every day you know thankfully servers don't work that way. You know, we have test branches. So I think for Linux users, especially Fedora users, I tell them this is get used to not caring about version numbers as much. You are shipping the entire Git tree, right? And in that same tree is CentOS, Alma, Rocky, Fedora, Bluefin, Bazzite, all, it's all related. If you look at everything, it is all related to Git trees, right? And bootc allows you to ship an operating system based on any one of those points. So now we have to account for all of this. So like this static world where it's like, well, it's six months, I guess I'm updating all the software on my old school Debian style or whatever. I mean, that's never going to go away. People are still running Debian stable on Kubernetes to this day, right? It's a dominant force, right? So it's not about displacing as much as it's meeting that use case. There's going to be organizations that are going to keep their Debiens and their RHELs and all that stuff. But there's also going to be organizations that are like i have that scott but i also want you to give me the fast thing too And even and for those of us that are enthusiasts we want to get this stuff and we might not have the resources to get it at that level for a very low cost but now we have bootc so we can go enterprise cloud love crop cloud grade you know enough to ship on a device if someone wanted to, you know, versus a traditional Linux. Now we can just give everybody everything, you know? And I think that's, what's exciting because you keep, you keep what you have now, but it, it gives me a place to go. Like my base image has to come from Kubernetes. The fact that you're, Oh, Scott, you didn't mention this. You're using Kubernetes to build the entire pipeline, you know? And as a downstream, that is what I've always wanted, right? I want to stick something in kubernetes and i have a bootc image come out whatever happens in the middle all that distribution tooling for me goes away right it's all podman for me you know and that gives me the speed that i need to consume hummingbird because now we are using agent to make these things the first cut of utah raptor which is the Bluefin built on hummingbird I did in two hours with Fable in a bar on a dare that I said, I could just whip one of these up. And I did. However, now what, what is the date now? It took James and a bunch of other people to sit there and figure out how to actually make that shippable and make sense because you get it when you first get hummingbird, you're like, what's in this thing. It's like half rawhide, but not. And at the time, a lot of packages are missing. Right. So then you start to think, well, it's going to take them a while to spin up, but you all went agent native. So one day Robert shows up to the meeting and is like, I packaged 3000 RPMs in two weeks. Humans aren't going to do any of this anymore, man. That's where I'm at. So for us, it's been, this is the first bluefin that's also been made fully agentic with a tool we use called Hive, which coordinates agents and it's all crazy. But what we are able to do is have people donate their local inference from their framework desktops or whatever and work on a piece of the distribution i have pages of people their agents doing all the rpm packaging and all that stuff and it all gets reviewed and you're kind of living the dream with the local models that we all want and your lab comes up and you can speak it to the mic and it deploys to kubernetes like we have all of this now eric and we are only just getting started. And just to show you the points, I'm very big on metrics. It took 13 people 22 days to make a full bluefin with Hummingbird. 22 days. That's five years worth of universal blue knowledge. And they're just getting started. Yeah. [00:20:58] Eric Hendricks: I can relate just how crazy of a world we live in nowadays because I rebuilt my home lab over the course of about three weeks using Claude Max. I was using Opus and Claude Code, and it started out with I'm fed up with dealing with WordPress plugins, and I'm tired of having to manage this thing. I want to go to static HTML. I was like, hey, Claude Code. So Independence Day weekend, I have an extra day off, and I had basically no plans until the evening of the 4th. And so I spent like three days figuring out how do I build a Hugo website based on my WordPress. And I basically just handed the keys to Claude Code and it went through. And my website looks really, really good. I didn't code any of it. It looks better than it ever did on WordPress. But that wasn't enough because as a sysadmin and as a distro builder, You guys will appreciate this. That wasn't enough because now I have to use Cloud Code to update my website. What if I want to just go and make a change myself? Well, Now I need a pipeline. And so then I stood up Forgejo. I stood up Forgejo Runners. And I was like, well, no, this sucks because I'm still doing RPM-based stuff. I think it's time to jump into bootc. So I spent the summer rebuilding my home lab using all these tools. Opus was basically my paired programmer I basically lay out an outline for what the bootc image should look like, and then it would write the code, and then I'd say, no, that's wrong. And it said, oh, you're absolutely right, and all that nonsense. But I mean, it probably took part-time, just myself and Claude, the better part of three weeks to completely rebuild my home lab, my Plex server, my website, Git repositories, all this kind of stuff. I mean, it took three weeks, working evenings and weekends. And the amount of alcohol that was ingested during that time, we won't talk about because, you know. [00:22:57] Jorge Castro: Tell me next time, man. I just shipped this stuff out of the box. So this is actually great because it's a status meeting for me to report to Scott what we've been working on. We've been doing a lot of the Kubernetes stuff, right? And normally for the home lab, this is over. Like, you're like, no, just use Podman. Like, you know, use a single container. You don't need to bring in this life. But now you have this power, you know? And for us, we've been focusing on those of us that do have access to these frontier models, ensuring that we're documenting the processes so that local models have a chance. So as the local models are getting better and as the documentation improves, Bluefin can be maintained by local models as of today. That means anybody with a Linux distro can have a local model maintain their stuff. So that is where we're at. That is the present. So can you imagine what we're going to build in a year or in two years, you know, so like for us? It's very interesting. We started off kind of being the desktop people, but now that we're in Kubernetes land and we have AI, you notice everybody's Linux computer started working a lot better once AI came around. You know, I have people tell me they're like, I'd rather ask AI than get yelled at on a Linux forum, which is so true. You know, same way, but this is what this allows you to do. And this, I don't, I don't want to tell Fedora what to do, but here's, if you're a Fedora person, here's what you need to ask from Fedora, because Red Hat gives this away for free is in Bluefin, there's a toggle When you install and it will turn on a local model, right? And it will serve a local model to you. This is using a thing from Eric Curtin called LLM man, but you can use whatever you want. You know, the local model will turn on in your laptop and then you hit a key. And then this thing called goose pops up, which is like a little window, a little chat thing. And then you say, why are my fans spinning up on this machine or whatever's wrong with your computer? And then it will sit there and it will diagnose itself. I have done this at scale. I was having a problem with my laptop. I went and I used it all and I went booth to booth showing people and nobody believed that it was real. And now I see blog reports. People are like, hey, AI totally solved all my Linux problems. I was like, we have this now. It's private. You can run it on your own. And the best part is, is with a smart paste bin, this is what we're doing with Bluefin. With a smart paste bin, you take those logs and you put them in a paste bin. Somebody else with a good model will help you. Like we are finding people like in Bluefin, you can donate inference. So you can just connect your account and fix bugs. We are finding people with the large models with money to spend are more than willing to help people who are doing this. And that's just, I think we also kind of forget with the anti-AI hate going around that there's a huge open source AI community. It's very innovative right now and kind of like fighting the good fight. So for us, I think it's an opportunity to bring those local models. And what excites me about Hummingbird is it's part of a factory. All those ci pipelines and stuff you stick that in a git repo now we are giving users the entire enchilada that's what they want and that's what they pay enterprises for i want to server edge automotive i want all this stuff you want the same things at home except it's mostly just edge home you know run my jellyfin and plex my e-ink you know project that i'll get around to eventually you know all the stuff that we do around nerds first for stuff because i mean what is the base image size for hummingbird it's pretty small it doesn't even come with a desktop that is another difference between other normal regular fedora package fedora [00:26:36] Scott McCarty: Package mode yeah i don't know. [00:26:38] Jorge Castro: How to say versus man you guys marketing man between package mode and the other ones is there's no intermediary step you know [00:26:49] Eric Hendricks: So I knew that with this [00:26:51] Jorge Castro: Group and you have to take Silverblue and delete things. Hummingbird forces doesn't come with a desktop. It's like CentOS. You have to build up. It's more of a builder kit than an end user Fedora thing. Sorry, I interrupted you. [00:27:05] Eric Hendricks: No, you're fine. So I know we've got a hard stop for today's recording and I am not surprised at all that the three of us got so far off topic. I mean, these two guys, different times, I've closed down bars with. Just sitting around a table, sharing a drink, and just swapping open source stories, solving all the world's problems. So let me kind of try and sum up the last 20 minutes of conversation for everyone. And then Scott and Jorge, you guys can jump in and let me know if I've got this right. So basically at Summit this year, what was announced was a way to release a low CVE count container image. We took the idea that it was universal-based images, which Red Hat uses as part of RHEL, where you put RHEL inside the container, and you release, there was minimal and micro, there's different-sized containers for UBI. And then there were specialized containers. There was specific versions that had, gosh, it's been, what, three years since I've worked on Red Hat marketing. So there was, was there like NPM versions, there was Java versions, Just a few other specialized that were built on top of, I mean, all a container is a series of layers of code. And so UBI has been a thing for years. It came out even before I started at Red Hat, I think. And so now Fedora Hummingbird was, or Project Hummingbird was designed to take that to the next level, to further extend that, but with a security focus. There's a lot of organizations out there that are trying to solve the same problem, but Red Hat realized, hey, we've got this UBI thing. Let's just fix some of these security vulnerabilities and release these really, really small, really, really performant, but also more secure containers. I still refuse to say secure because nothing's ever secure. Go ahead. [00:28:57] Scott McCarty: Yeah, I would be careful to call it more secure or less secure. I would say it's different. So I still think risk-based security matters. So risk-based security is the idea that you patch the bare minimum that is necessary or the maximum that you can, if you will, without disrupting the entire environment, right? So Debian stable, Red Hat Enterprise Linux, even the Fedora versions, you know, Fedora 44, 45, 46, whatever, those kind of get patches along the way, right? But you don't roll everything. You patch what's there. You patch the glibc. That's called risk-based patching, where you patch just the important things. And you're like, okay, everything else is not that important. It's not that exploitable. It's fine. That works for most people most of the time still. But there are people that have more, I would call them different requirements where they need to, they, it costs them a lot of time, energy, money to, to basically look at something and go, okay, that's not important. Like it's hard to even determine, is it important, not important. All I know is there's a hundred CVEs and a hundred CVEs is a lot of CVs to look at, you know, and if you're not paying a vendor like Red Hat to figure that out for you and triage them and figure out which ones are important, you just have to look at them all. Right. And so you're like, oh, this is very, this is a lot of work. [00:30:13] Jorge Castro: They have no choice. They don't want to do this, right? Yeah. You know, they're getting audited or whatever. [00:30:18] Scott McCarty: Exactly. So we call those people compliance-based risk, you know, compliance-based patching. They're sort of risk-based patching and compliance-based patching. Compliance is just give me zero CVEs so I don't even have to think about it. Risk-based is like, yeah, we might have 50 CVEs left, but we know that none of them are that important. I still feel secure in this. I would say both are valid. Both are very secure. [00:30:37] Jorge Castro: Or both. [00:30:39] Scott McCarty: Or both. Sometimes you do the host one way and the container image is another way, et cetera, et cetera. And I actually think that's a very valid strategy for a lot of things. That said, so Fedora Hummingbird Linux chases the CVs, just tries to squash them down to zero as close as it can get. [00:30:52] Jorge Castro: Basically, is the gist. [00:30:54] Scott McCarty: Because some people just, especially in the container world, it's just you're moving them around. You're moving them all over the place. It's hard to even know where they're at. It's hard to even keep track of them. When it's hard to keep track of things, often the compliance-based model of security is just easier. So that's how I would say it. And whether it has a kernel in it or not, a container image has a kernel in it or not, that's basically the difference between Fedora Hummingbird Linux and Red Hat hardened images. It's like, yes, these are container images they will never boot. This is a container image that actually has a kernel in it. I can slap it on disk and boot it. That's the bootc image. You know, they're kind of the same though. [00:31:28] Eric Hendricks: Well, and you used a term that we hadn't even mentioned yet, Hummingbird Linux. And so what I was, the picture that we were painting was the fact that all this started out around the container world. And when Boot C came around, Jorge made this bridge earlier, we talked about how containers, you don't update the individual packages. You don't do a DNF update. You go in and you take the entire image. and that was just accepted with containers. And so now applications are mostly container-based, I would say. And so bootc came along and it was like, what if we did the same thing with the operating system where everything was self-contained and you just ship the operating system and then you build layers on top? And so bootc was kind of this approach to containerizing. I know someone will yell at me in the comments about this, but from an analogy perspective, containerizing the operating system. [00:32:24] Jorge Castro: I would say that's the exact way to describe it. [00:32:27] Eric Hendricks: You're containerizing the operation. Much like we're used to getting over-the-air updates for our mobile devices nowadays, we're doing that for the operating system, whether that's a desktop, laptop, server. So what Scott just alluded to was that was one of the big changes that we've seen since Summit. Summit's announcement, the idea was, let's just produce these CVE-less containers and, And basically take this idea of universal-based images and take it a step further, especially in a both-Mythos-moment world. And so now Hummingbird Linux has evolved out of this process to let's take those same policies, those same principles that we've been using on containers since Summit, and let's do that to the operating system too. Do I have that? Does that sound fair? [00:33:17] Scott McCarty: Yeah, that was the Fedora Hummingbird Linux announcement at Summit. Oh, so it. [00:33:22] Eric Hendricks: Was announced at Summit. [00:33:23] Scott McCarty: That was announced at Summit. Yeah, that's what we've been... That's this. There is still the Red Hat Harden Images that started getting built long before Summit and then, or at least months before Summit, many months before, several months before Summit, and then got launched generally available. [00:33:36] Eric Hendricks: It was the night before. [00:33:38] Scott McCarty: No, no, it was the night. I want to say it was about five months before Summit they started working on it. But yeah, the Fedora Hummingbird Linux actually got launched. Now that said, we're still working on it diligently. It was launched at Summit and it has a kernel. It comes from Fedora. That's a Fedora kernel. We're working on still refining the fine tuning of how to do that, I would say. [00:34:01] Jorge Castro: It's exactly the Fedora kernel right now. [00:34:02] Scott McCarty: It is exactly. The launch at Summit was the Fedora kernel, the ARC kernel. And it is still to this right now. I think the magic is people don't realize you can just add a kernel to a container and it becomes a bootable container. [00:34:14] Jorge Castro: Yeah, 7.299201.slash FC44. It looks like Fedora to me. Yeah. [00:34:22] Eric Hendricks: And so we actually had a planning meeting for this a week before recording. And I was like, are you guys kidding? I just spent all summer rebuilding my entire home lab. Now, if I want this other stuff, I've got to rebuild it again. And what we realized was, no, I have the IT guy base image. ITG is the abbreviation I use just about anywhere. And it's ITG-BASE, which is just my bootc spin of the Fedora base image. And so to do this, all I'd have to do is change what ITG base points to. What is the upstream that I'm pulling from? so instead of pulling from the generic fedora server 44 and we're release is imminent and my brain has fried as to which version we're on i think we're on 44 yeah we're on 44 until and so all all i've got to do is instead of pointing my my entire pipeline my software factory as we're starting to hear things called instead of pointing that at the upstream fedora server 44 all i'd have to do is switch over to the fedora hummingbird linux then you're done stream and then overnight my pipelines will run all those images will be rebuilt and hopefully when things come up the next day Most of my infrastructure is back up and running and the applications that are then containerized using Podman and quadlets don't care what's running underneath. [00:35:46] Jorge Castro: Exactly. [00:35:47] Eric Hendricks: I mean, we have completely changed how we look at IT, how we look at technology. And like Jorge said, there are so many people out there that are just so anti-AI. But I know the things that I've gotten accomplished with it, the things that I've learned, treating it as a career coach or someone to quiz me before an interview or spending a weekend rebuilding a 10-year-old WordPress site onto static images or onto static HTML sites. There is so much we can do. And so if you look at this from the Homelabers perspective, I think Jorge has got about 52 laptops running in his place right now. [00:36:28] Jorge Castro: There is no better time than Homelab right now. [00:36:31] Eric Hendricks: Right. [00:36:31] Jorge Castro: It's so cool for like 30 years or whatever, however long it's been out. It came out when I was in high school. I've been using it almost. I have never been challenged. I've never been challenged. As much as I have been recently. You have to know everything, man. You know, in that home lab, everything from the file system configuration, all of a sudden, every config you grew up with is now up for grabs. You know, like every default you ever had, you have to question. And, you know, it's still the same Linux, but also like you can see the components and stuff moving faster. And, you know, us getting, I think we merged 1400 pull requests in Bluefin. [00:37:10] Eric Hendricks: Wow. [00:37:11] Jorge Castro: 1,400. The numbers are insane. Commits don't really matter as a number. We're actually talking about units of work now as in like, what feature did you ship? Not, you know, congrats on your 15 commits this month, Eric. Like that doesn't matter. Like what did you ship? You know, because you could do a lot of commits and get nothing done as well. [00:37:33] Eric Hendricks: Well, that's true. So we have a fantastic audience and it has grown more this year than And I've seen it in the three or four years that I've been hosting this podcast. So they are amazing people. Let me tell you, if you haven't met any of the Fedora podcast audience, they're awesome. In fact, two episodes ago, I put out a call that I need some help with scheduling, rounding up guests and getting things on my calendar. So if someone could do that, that would be great. Within about four hours of the release of that episode, I had someone hit me up on Matrix and said, hey, I would love to help you get things scheduled. [00:38:09] Jorge Castro: Can I help you out, Eric? [00:38:11] Eric Hendricks: What's up? [00:38:12] Jorge Castro: Someone out there, especially if one of my folks wants to help Eric out, what you want to do is you want to create a branch. So you have ITG colon Fedora and colon Hummingbird. So you just produce two images. [00:38:23] Eric Hendricks: I'll get there, but I'm currently trying to move all of my Forgeo workloads that I built over the summer over to GitLab, because now I work at GitLab, and it makes sense to be running GitLab, so that Hummingbirds is on the radar. So I was telling you both that the Fedora podcast audience are amazing people, and they love to be a part of the community. They love to help. And so I know that we've got discussion threads, that there's regular meetings, but I want to ask you both individually, specifically, what can the Fedora podcast audience community help? How can we get involved? Do we need use cases? Do we need beta testers? Scott, I'll start with you. What could you use from the Fedora community? [00:39:08] Scott McCarty: Yeah, that's a really good question. I think the most amazing thing that we could get would be to get more people discussing on Fedora discussions. Laura creates threads for our monthly meetings. And we'd love to discuss topics and ideas and use cases and actually understand how this could be useful to people. We're focused on actually making something useful to people and what... It could help them do, right? And so I want people to dream and figure out what they could do with it, right? And I'm with Jorge. I think now is the most amazing time to be a home labber. In fact, I was just trying to look up how many... I'm running 58 containers on a single host in image mode or with bootc, I should say, on Linode. It's not a big Linode for the record. And this thing is crammed full of containers. And I have, we were talking, I have AI helping me tune the performance of that, the kernel, the memory usage, everything else. It is getting more and more containers in there and limiting them. Like I never would have been able to achieve that two years ago. So like to your point, now's the best time in the world to have an interesting use case. And I think just. [00:40:15] Jorge Castro: Your Kubernetes lab, I got a new machine. I just plugged it in and all the workloads just migrated over to it. All the load balances just deployed. It was like magical. All transcoding over hosts it's just automatic it's wonderful yeah [00:40:28] Scott McCarty: Yep i'm actually thinking about going to a bunch of smaller linux for that exact reason because now i can load balance things like why not but those are the kinds of use cases that we're looking for like we want more, upstream use cases things people have what would what would fedora hummingbird linux be useful to you for like we we can move really fast and pivot you know and basically push new use cases and so So that's probably the most exciting thing I think people could do. We can have the AI agents do the actual implementation. It's not annoying anymore. So figure out what's cool that you want to see and then tell us. [00:41:00] Eric Hendricks: So, Jorge, before we get to your call to action, Scott's asking for just people to dream and get engaged on the Fedora discussion boards. But for those of you that have been watching the video version, Jorge has got this whole Jurassic Park getup, literally has a Jurassic Park shirt, has got the safari hat. I think there was a dinosaur sticker on a cup. So before we get to your CTA, you got to tell me what is going on with all the dinosaur stuff. [00:41:27] Jorge Castro: Well, Bluefin is about dinosaurs. So Bluefin's job is to kind of be a bootc reference architecture is technically what it is, but really it's designed to get people into Linux contributors. So that's, we feel asked, why are you using Hummingbird? I was like, well, Scott, you hired everyone from Universal Blue. Thanks. You know, so, you know, the project is designed to evolve, to remind people that software and Linux needs to continue to evolve. It needs to, you know, it needs to keep pushing. We need to be fighting, you know, as top predators. So like we very much are the personas that we push, we push modern Linux to where it needs to be. And that's where cloud native takes us. And AI is dragging us all along with it, you know? So for us, it's kind of like evolving with the state of the art. What do you bring to the table? You know, what can we compete with versus proprietary offerings? And then, I don't know, hunting, I guess. I don't know. [00:42:16] Eric Hendricks: Yeah, we're definitely the predators of the technology world. We're not still trying to figure out how to get Chrome installed on a Windows machine. So I love the theme. Although I won't point out on air that dinosaurs are dead. [00:42:34] Jorge Castro: No, birds are dinosaurs, man. Come on. [00:42:37] Eric Hendricks: So what about Bluefin and what about Utah Raptor? What kind of help can you use in your space? [00:42:44] Jorge Castro: Yeah, for us, try it. If you're a builder, you're a sysadmin, grab that container and you can build this thing pretty easy. Grab blue build is popular as a thing that people use. You can just swap back and forth between Fedora if you want base images and try it. We package GNOME and a bunch of desktop-y stuff that that the hummingbird team is it's there's no overlap it's great they can handle the fast moving stuff and then we kind of handle the stuff that the community wants to be passionate about and that's just a matter of building rpms and people got that figured out so whatever you want to build with hummingbird you can do it today [00:43:18] Eric Hendricks: That's awesome and that is available to download right now the the full iso is available [00:43:22] Jorge Castro: Yeah we have a full iso there's a full that's this a full bluefin it runs podman great i've i've been taking it out on the road here i'm going on a long trip with it to give it its final test. But yeah, it went to alpha almost immediately. And this probably will be our shortest beta that we've ever done. So yeah, come check it out. [00:43:44] Eric Hendricks: That's awesome. So I know we covered a lot of ground and maybe confused a few people. So Scott, let's do this. Do me a favor. And for our listeners, give me a 30-second pitch on what Project Hummingbird is. [00:44:01] Scott McCarty: Project Hummingbird is basically a fast moving Linux distribution that can pivot really fast and patch things really fast. And so it can expand to do new use cases quicker than anything we've seen. And that's kind of what Jorge is doing. He's pivoting even further and doing that. [00:44:20] Eric Hendricks: Perfect. Jorge, you want to add anything to that? [00:44:23] Jorge Castro: Yeah. Look, server nerds need this stuff. So they're going to get a bunch of things faster than normal. And if you're using a Linux desktop, that means you will get stuff. The only thing we got to be careful is with that level of speed, you have to have testing. And it's all going to be about automated testing in Kubernetes. So if you're interested in that, we are working on that. We have a full test suite and all that good stuff. [00:44:44] Eric Hendricks: That's awesome. And if you have any questions about Fedora Hummingbird, the Red Hat hardened images, anything that's going on in the Hummingbird community, make sure you head over to the Fedora discussion board. It is always active. There's always a lot of activity going on there. In fact, every community meeting, there is a discussion thread looking with a call for topics or discussion of the previous meeting. And actually, if you didn't know, every episode of this show is actually linked in the description below. And there is a discussion thread for every episode. So that would also be a great place to throw in some use cases If you have an idea of what you might use Hummingbird for, please head over there and share. The show is recorded about every two weeks. And we've been talking about Framework. We've been talking about CentOS. We've been talking about some of the community positions that have kind of shuffled. So there's an amazing backlog of topics that you can catch with this show. So make sure you download those, give them a listen, give us a like and a subscribe, you know, all the usual things. Just help us grow this community. The podcast, like I said, has grown more in the past year than I've seen it in the last several years. So we're definitely excited. So if you have anything you want to hear about, definitely put those in the discussion thread or in the comments below and with that that brings us to the end of episode number 62 i cannot believe we've been doing 62 episodes of the show and i think i've been around for about 40 of them so it's been awesome so thank you to everyone that listens and on behalf of my guests scott mccarty from red hat and Jorge Castro from project bluefin thank you all for joining us today and we will see you again in a couple weeks take care [00:46:17] Scott McCarty: Thank you for having us. [00:46:18] Jorge Castro: Hey oh we forgot to mention 100 000 live bootc devices did you know that scott No, [00:46:23] Scott McCarty: I didn't know that. [00:46:24] Jorge Castro: There are 110,000 live bootc devices in the field right now. [00:46:27] Eric Hendricks: You're killing me, Smalls. [00:46:29] Jorge Castro: Why didn't I need to do that before? You're recording it like a snippet, you know? [00:46:36] Eric Hendricks: No, I'm going to leave it in as a fake outro. You thought we were done, but no, we're not. This is the part where we go on for about three hours. [00:46:44] Jorge Castro: Oh, here's a call to action. Actually, put this one in. Ready? Here's a call to action. it would take someone who knows containers about 25 minutes to make Bazite on Hummingbird. Who among you will take the challenge? [00:46:59] Eric Hendricks: All right, y'all. Thank you all for joining us. We will see you online, joining our Matrix Room, joining the Fedora discussion. There are plenty of places to engage with us. So once again, on behalf of my guests, Scott McCarty and Jorge Castro, thank you for joining me. I've been Eric, the IT guy Hendricks, your host, and we'll see you again in a couple of weeks.