The Cloud Native Computing Foundation (CNCF) announced in July 2026 that Cloud Native Buildpacks have officially graduated, marking a significant milestone for the project. This graduation recognizes the maturity and stability of the buildpack system, which is now widely adopted in cloud-native environments.
At the core of this evolution is a fundamental shift in how container security is managed. Traditionally, base images were selected and managed individually within each service’s Dockerfile, leading to inconsistencies and security vulnerabilities. With Buildpacks, this control point has moved away from the per-service Dockerfile to a centralized builder, typically owned and managed by a platform engineering team.
This architectural change enables fleet-wide patching and updates, simplifying the process of applying security fixes across all services. Instead of updating numerous Dockerfiles, platform teams can now modify a single builder, ensuring that all applications built with it receive the latest security updates automatically.
BellSoft’s Hardened Builder
BellSoft, a provider of Java solutions, has released a hardened version of the Paketo builder, specifically designed to meet stringent security requirements. This new builder incorporates security hardening measures at the builder level, further emphasizing the trend that the builder, not the Dockerfile, is now the primary control point for container security.
The Paketo builder from BellSoft is tailored for organizations that require high levels of security and compliance. By centralizing security controls in the builder, BellSoft aims to reduce the attack surface and provide a more secure baseline for containerized applications.
Industry experts note that this move by BellSoft is indicative of a broader trend among vendors, who are increasingly treating the builder as the strategic point for implementing and enforcing security policies. This approach offers a more consistent and manageable way to secure container fleets.
Implications for Platform Engineering
For platform engineering teams, the shift to Buildpacks and centralized builders represents a significant operational advantage. It reduces the cognitive load on developers, who no longer need to be deeply involved in base image selection and patching. Instead, they can focus on writing application code, while the platform ensures a secure and up-to-date runtime environment.
Furthermore, the centralized model improves governance and compliance. Security teams can define and enforce policies once in the builder, and these policies are automatically applied to all built images. This consistency is critical for meeting regulatory and internal security standards.
The graduation of Buildpacks within the CNCF, coupled with vendor innovations like BellSoft’s hardened builder, signals a maturation of the container ecosystem. As more organizations adopt this model, the industry is likely to see further improvements in security, efficiency, and standardization across containerized deployments.
Looking ahead, the adoption of Buildpacks is expected to grow, with more cloud providers and enterprises incorporating them into their platforms. The CNCF’s endorsement provides a strong foundation for broader community support and ongoing development. Future enhancements may include more advanced security features, better integration with existing CI/CD pipelines, and support for additional programming languages and frameworks, further solidifying the builder’s role as the central security control point.
