The Cloud Native Computing Foundation (CNCF), which builds sustainable ecosystems for cloud native software, announced the graduation of Cloud Native Buildpacks, an open source project that builds OCI-compliant container images directly from application source code. The graduation reflects the project’s maturity in production adoption, vendor-neutral governance and security practices. Recent contribution data shows that well-known organizations such as Bloomberg LP and Heroku bySalesforce are not just users of the technology but active participants in its development, contributing code, reviews, and pull request activity across the project. The project’s upcoming roadmap centers on expanding support for OCI Artifacts, strengthening software bill of materials (SBOM) workflows and enhancing compatibility with next-generation workload formats, including WebAssembly.
“As organizations increasingly scale cloud native applications, automating secure and consistent build pipelines is critical for operational success,” said Chris Aniszczyk, CTO, CNCF. “Buildpacks’ graduation solidifies it as a fantastic tool to build standardized container images, providing the operational consistency required to manage and secure modern software supply chains for enterprises. We’re proud to celebrate this milestone with the Buildpacks community and the value it continues to bring to the broader cloud native ecosystem.”
As organizations continue to move software delivery into cloud native environments, they need consistent build workflows that reduce operational complexity. Cloud Native Buildpacks bridges application development and platform engineering by eliminating manual configuration files—automatically detecting languages like Java, Python, Go, Node.js, and Ruby to generate production-ready OCI images. This approach delivers tangible operational impact at scale; in major enterprise financial implementations spanning 500+ applications, teams dropped vulnerability resolution times from weeks down to hours through centralized buildpack patches. The project also works with additional CNCF projects, such as Helm and Harbor, to produce OCI-compliant container images that are ready for deployment on Kubernetes.
Rooted in Heroku’s buildpack model, then more widely adopted by Cloud Foundry, Cloud Native Buildpacks was jointly created by Pivotal and Heroku in January 2018 before joining the CNCF in October 2018. The project has evolved from a single platform tool into a unified OCI-compliant container specification and its broad community has grown to 535 contributors across 164 organizations and an expanding base of more than 20 adopters, including DigitalOcean, GitLab, Google, HashiCorp, Spring and VMware by Broadcom.
“When Heroku open-sourced the original Buildpacks project in 2012, our goal was to simplify application packaging across any ecosystem and spread that model beyond a single platform,” said Terence Lee, co-founder & steering committee, Cloud Native Buildpacks. “With Cloud Native Buildpacks, we set out to realize that broader vision by aligning with open standards like OCI and collaborating directly with developers and organizations who shared that mission. Seeing this vision mature and achieve broad industry adoption is deeply rewarding, and CNCF graduation marks an incredible milestone on that journey. We are sincerely thankful to the community of end users, contributors, and maintainers who helped us get here. The CNCF provided the ideal home for open governance, ensuring a vendor-neutral foundation where Buildpacks could evolve into a trusted industry standard. Looking ahead, I’m excited for our next chapter as we expand support for OCI Artifacts, enhance software supply chain security, and adapt to emerging runtimes like WebAssembly.”
