The open source container packaging toolkit hits top CNCF maturity with 500+ contributors, simplifying secure OCI image creation without Dockerfiles.
On 11 August 2026, the Cloud Native Computing Foundation (CNCF) announced the graduation of the Cloud Native Buildpacks project. The project has reached production-level adoption, vendor-neutral governance, and a high standard of security and quality. Cloud Native Buildpacks passed a third-party security audit conducted by Quarkslab and OSTIF and received an OpenSSF Best Practices badge. The project also adopted the CNCF Code of Conduct.
The project was originally built on top of the open-sourced Buildpacks created by Heroku. It started in January 2018, led by Pivotal and Heroku, and joined the CNCF in October 2018. Since then, 535 contributors from 164 organizations, including Bloomberg LP, Heroku (Salesforce), and 20+ major adopters like DigitalOcean, GitLab, Google, HashiCorp, Spring, and VMware by Broadcom, have contributed. The project has graduated from the CNCF after passing several requirements.
Cloud Native Buildpacks enables developers to build OCI-compatible container images with a source code. It allows developers to avoid writing Dockerfiles since it detects and packages apps written in various programming languages, including Java, Python, Go, Node.js, Ruby, etc. Moreover, Cloud Native Buildpacks allows decoupling an app’s programming code from the operating system image. It implies that a company can rebase the images and address OS-related security vulnerabilities faster within hours than months or weeks.
The images produced via Cloud Native Buildpacks may be deployed to Kubernetes clusters and used with other CNCF tools, including Helm, Harbor, and others. The project will focus on OCI artifact management, SBOMs, Wasm, and other areas in the future.
