The Cloud Native Computing Foundation (CNCF) announced on August 11, 2026, the graduation of the Cloud Native Buildpacks project, an open-source project that creates container images compliant with the OCI standard directly from application source code. The decision reflects the project's maturity in terms of production-environment use, vendor-neutral governance, and security practices.
Cloud Native Buildpacks simplifies the container-building process by automating application-language detection, dependency installation, and image-layer organization. As a result, developers and platform teams gain a standardized build path, while organizations adopting cloud-native infrastructure benefit from a more portable approach across environments, from source code through production.
Automating Image Builds Across Environments
The project supports detecting languages including Java, Python, Go, Node.js, and Ruby, then creating production-ready OCI images without the need for manual configuration files for each application. It also integrates with other CNCF projects, such as Helm and Harbor, to produce OCI-compliant images ready for deployment on Kubernetes.
According to the article, extensive financial-enterprise deployments involving more than 500 applications demonstrated the operational impact of this approach; the time required to address vulnerabilities fell from weeks to hours through the application of centralized patches to Buildpacks. This result offers an example of how a standardized build process can reduce complexity and improve software supply-chain management without exposing infrastructure details to application teams.
Adoption and Participation by Multiple Organizations
The project's roots lie in the Buildpacks model developed by Heroku, before its adoption expanded through Cloud Foundry. Pivotal and Heroku jointly created the project in January 2018, and it joined the CNCF in October of the same year. According to the information provided in the announcement, the community currently includes 535 contributors from 164 organizations, with a growing base of more than 20 adopters, including DigitalOcean, GitLab, Google, HashiCorp, Spring, and VMware by Broadcom.
The CNCF also noted that Bloomberg and Heroku by Salesforce not only use the technology but also participate in its development through code contributions, reviews, and pull-request activity. Chris Aniszczyk, CTO at the CNCF, said that the project's graduation reinforces its position as a tool for building standardized container images and provides the operational consistency needed to manage and secure modern software supply chains.
Graduation Requirements and Next Steps
Cloud Native Buildpacks completed a third-party security review conducted by Quarkslab and the Open Source Technology Improvement Fund (OSTIF), received the OpenSSF Best Practices passing badge, adopted the CNCF Code of Conduct, and maintained a broad contributor community from multiple organizations.
The upcoming roadmap focuses on expanding support for OCI Artifacts, strengthening mechanisms for generating software bills of materials (SBOMs), and improving compatibility with newer workload formats, including WebAssembly. The announcement indicates that these priorities will continue to connect the container-building process with software supply-chain security requirements and the evolution of runtime environments.