Project reaches broad production adoption for transforming application source code into OCI-compliant container images across cloud environments

Key Highlights:

SAN FRANCISCO — Aug. 11, 2026 — The Cloud Native Computing Foundation® (CNCF®), which builds sustainable ecosystems for cloud native software, today announced the graduation of Cloud Native Buildpacks, an open source project that builds OCI-compliant container images directly from application source code. The graduation reflects the project’s maturity in production adoption, vendor-neutral governance and security practices. Recent contribution data shows that well-known organizations such as Bloomberg LP and Heroku bySalesforce are not just users of the technology but active participants in its development, contributing code, reviews, and pull request activity across the project. The project’s upcoming roadmap centers on expanding support for OCI Artifacts, strengthening software bill of materials (SBOM) workflows and enhancing compatibility with next-generation workload formats, including WebAssembly.

“As organizations increasingly scale cloud native applications, automating secure and consistent build pipelines is critical for operational success,” said Chris Aniszczyk, CTO, CNCF. “Buildpacks’ graduation solidifies it as a fantastic tool to build standardized container images, providing the operational consistency required to manage and secure modern software supply chains for enterprises. We’re proud to celebrate this milestone with the Buildpacks community and the value it continues to bring to the broader cloud native ecosystem.”

As organizations continue to move software delivery into cloud native environments, they need consistent build workflows that reduce operational complexity. Cloud Native Buildpacks bridges application development and platform engineering by eliminating manual configuration files—automatically detecting languages like Java, Python, Go, Node.js, and Ruby to generate production-ready OCI images. This approach delivers tangible operational impact at scale; in major enterprise financial implementations spanning 500+ applications, teams dropped vulnerability resolution times from weeks down to hours through centralized buildpack patches. The project also works with additional CNCF projects, such as Helm and Harbor, to produce OCI-compliant container images that are ready for deployment on Kubernetes. 

Rooted in Heroku’s buildpack model, then more widely adopted by Cloud Foundry, Cloud Native Buildpacks was jointly created by Pivotal and Heroku in January 2018 before joining the CNCF in October 2018. The project has evolved from a single platform tool into a unified OCI-compliant container specification and its broad community has grown to 535 contributors across 164 organizations and an expanding base of more than 20 adopters, including DigitalOcean, GitLab, Google, HashiCorp, Spring and VMware by Broadcom. 

“When Heroku open-sourced the original Buildpacks project in 2012, our goal was to simplify application packaging across any ecosystem and spread that model beyond a single platform,” said Terence Lee, co-founder & steering committee, Cloud Native Buildpacks. “With Cloud Native Buildpacks, we set out to realize that broader vision by aligning with open standards like OCI and collaborating directly with developers and organizations who shared that mission. Seeing this vision mature and achieve broad industry adoption is deeply rewarding, and CNCF graduation marks an incredible milestone on that journey. We are sincerely thankful to the community of end users, contributors, and maintainers who helped us get here. The CNCF provided the ideal home for open governance, ensuring a vendor-neutral foundation where Buildpacks could evolve into a trusted industry standard. Looking ahead, I’m excited for our next chapter as we expand support for OCI Artifacts, enhance software supply chain security, and adapt to emerging runtimes like WebAssembly.”

To reach graduation, the project completed a third-party security review with Quarkslab,  and the Open Source Technology Improvement Fund (OSTIF), received an OpenSSF Best Practices passing badge, adopted the CNCF Code of Conduct and sustained a broad contributor community across many organizations. 

The CNCF Technical Oversight Committee (TOC) provides technical leadership to the cloud native community, defining its vision and stewarding projects through maturity levels up to graduation.

Supporting quotes:

“Cloud Native Buildpacks began with a simple goal: let developers focus on building applications instead of building containers. It’s incredibly rewarding to see how that vision has grown into a CNCF Graduated project that’s helping organizations and developers around the world build and deploy software more securely and efficiently. At Salesforce, Buildpacks have played a key role in accelerating the delivery of our products by simplifying container builds and allowing our engineers to focus on innovation instead of infrastructure. Congratulations to everyone in the community whose contributions made this milestone possible.” —Joe Kutner, co-founder & maintainer, Buildpacks and principal architect, Salesforce 

“Cloud Native Buildpacks has set the bar for what a specification-driven project should look like in the cloud native ecosystem. Whether adopters are building on the reference implementation or implementing the spec independently, the breadth of production usage across major cloud providers and developer platforms speaks volumes about its technical clarity and design. Reproducible, secure container builds at scale is a problem the industry has been trying to crack, and Buildpacks has delivered a solution that has stood the test of real-world production. Graduation is a recognition well earned and shows how deeply Buildpacks has embedded itself into the cloud native toolkit, from CI/CD pipelines to platform engineering workflows. I look forward to seeing the project continue to evolve and grow its impact across the ecosystem.” —Faseela Khan, TOC sponsor, CNCF

“Bloomberg has been a strong proponent, contributor, and user of Cloud Native Buildpacks since we first got involved with the project in 2020. Today, Buildpacks helps power Bloomberg’s AI infrastructure and applications across our engineering environment. In doing so, it has helped us shift controls left in the development lifecycle and apply consistent governance across our software supply chain — without pushing the complexity of infrastructure onto individual application teams.

As a Buildpacks maintainer and member of its Steering Committee, I’ve seen firsthand how the project’s open governance and strong community have helped the technology mature while remaining responsive to the needs of developers and platform teams. Graduation is an important recognition of that maturity, and Bloomberg is proud to have contributed to Buildpacks’ journey.” — Sambhav Kothari, head of foundational AI platforms, Bloomberg engineering department and Cloud Native Buildpacks steering committee member

“I’ve had the privilege to introduce Cloud Native Buildpacks it to several folks for the first time. I’ve seen the project adopted across a wide spectrum of organizations and open source communities. The path to graduation has been fascinating with support flowing in from adopters across the globe!” —Ram Iyengar, chief evangelist, Cloud Foundry

“Epinio has long helped platform engineers and developers ship software via Kubernetes without being aware of the complexities, leveraging Cloud Native Buildpacks to accomplish that. The graduation reaffirms our decision to make CNBs key to our platform, and we’re excited for it to bring renewed confidence to other organizations looking to adopt them. And with this new era where code is becoming accessible to anyone, CNBs serve as an important bridge to get those ideas built and shipped to production safely, so the timing couldn’t be better. Congrats (and thanks!) to the Cloud Native Buildpacks maintainers!” —Colin Griffin, CEO, Krumware, maintainers of Epinio and co-chair CNCF platform engineering TCG

“Building container images shouldn’t distract developers from writing code, which is why Spring Boot introduced support for Cloud Native Buildpacks back in early 2020.

With one simple Maven or Gradle task, Buildpacks deliver secure, optimized container images ready for any runtime environment. They handle all the heavy lifting: intelligent layering, JVM tuning, SBOM creation, and image rebasing, which allows you to patch underlying OS vulnerabilities by swapping base layers without a full rebuild.

For Spring Boot applications, we think this is the most straightforward and secure approach to take your containers to production.” —Moritz Halbritter, software engineer, Spring Boot by Broadcom

For more information about Cloud Native Buildpacks, visit buildpacks.io.

About Cloud Native Computing Foundation

Cloud native computing empowers organizations to build and run scalable applications with an open source software stack in public, private, and hybrid clouds. The Cloud Native Computing Foundation (CNCF) hosts critical components of the global technology infrastructure, including Kubernetes, Prometheus, and Envoy. CNCF brings together the industry’s top developers, end users, and vendors and runs the largest open source developer conferences in the world. Supported by nearly 800 members, including the world’s largest cloud computing and software companies, as well as over 200 innovative startups, CNCF is part of the nonprofit Linux Foundation. For more information, please visit www.cncf.io.

Media Contact

PR@CNCF.io