--- title: Buildpacks Move the Container Hardening Control Point... description: Cloud Native Buildpacks, which graduated within the CNCF in July 2026, shift base image selection and patch cadence from individual Dockerfiles to a... canonical: https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Buildpacks Move the Container Hardening Control Point Away From the Dockerfile | daily.dev og:description: Cloud Native Buildpacks, which graduated within the CNCF in July 2026, shift base image selection and patch cadence from individual Dockerfiles to a... og:url: https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs og:image: https://api.daily.dev/og/posts/MLyRP5qrs.png og:image:alt: Buildpacks Move the Container Hardening Control Point Away From the Dockerfile og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Buildpacks Move the Container Hardening Control Point Away From the Dockerfile **[InfoQ](https://daily.dev/sources/infoq)** · 4 min read · 1 upvotes · 0 comments ## Summary Cloud Native Buildpacks, which graduated within the CNCF in July 2026, shift base image selection and patch cadence from individual Dockerfiles to a centralized platform engineering builder. This enables fleet-wide patching via the rebase command — swapping OS layer digests in milliseconds without a full rebuild — though application-layer vulnerabilities still require a rebuild. BellSoft's hardened Paketo builder (GA July 2026) exemplifies vendors treating the builder as the container security control point, with a 7-day SLA for critical CVE remediation on paid tiers. Docker similarly made its hardened image catalogue free under Apache 2.0, with paid tiers for SLA-backed remediation. The tradeoff: buildpacks reduce per-service Dockerfile control, complicate custom OS package needs, and concentrate trust in whoever maintains the builder — a governance shift increasingly relevant under regulations like the EU Cyber Resilience Act. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does the rebase command in Cloud Native Buildpacks patch container images without a full rebuild? Rebase swaps the OS layer digests of an application image for those of a new run image by rewriting the OCI manifest and configuration, an edit essentially limited to a JSON file. It takes milliseconds, requires very little compute, and needs no rebuild, source access, or CI queue slot. It only replaces compatible run-image layers, so vulnerable application dependencies still require a full rebuild. _daily.dev surfaces builder and patching updates for teams weighing Dockerfiles against buildpack-based hardening._ ### What is BellSoft's SLA for fixing critical vulnerabilities in its hardened Paketo builder images? BellSoft's Standard tier commits to a 7-day remediation SLA for critical vulnerabilities and 14 days for all others, while its free Community tier lists no SLA. The hardened Paketo builder, generally available since 21 July 2026, is built on Alpaquita Linux-based Hardened Images with a reduced package set, non-root defaults, signatures, and SBOM data. _Track hardened image SLAs like this on daily.dev when comparing container security vendors._ ### When did Cloud Native Buildpacks graduate as a CNCF project? Cloud Native Buildpacks graduated within the CNCF on 17 July 2026. The project frames its goal as concentrating container build best practices within a specialized platform team rather than having every application team maintain its own Dockerfile. _Follow CNCF graduation milestones like this on daily.dev to stay ahead of platform engineering shifts._ ## Similar posts on daily.dev - [How buildpacks help enterprises finally operate container security controls at scale](https://daily.dev/posts/how-buildpacks-help-enterprises-finally-operate-container-security-controls-at-scale-eoev0kpfp) · The New Stack · 0 upvotes · 0 comments - [Hardened Images Explained](https://daily.dev/posts/hardened-images-explained-qexp0th6y) · Docker · 2 upvotes · 1 comments --- Tags: [#docker](https://daily.dev/tags/docker), [#containers](https://daily.dev/tags/containers), [#platform-engineering](https://daily.dev/tags/platform-engineering) [View this post on daily.dev](https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Buildpacks Move the Container Hardening Control Point Away From the Dockerfile","url":"https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs"},"datePublished":"2026-08-10T07:03:21.958Z","dateModified":"2026-09-14T07:53:44.358Z","description":"Cloud Native Buildpacks, which graduated within the CNCF in July 2026, shift base image selection and patch cadence from individual Dockerfiles to a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a18ffa8bf813d2707d935524b8b7d0a7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/a18ffa8bf813d2707d935524b8b7d0a7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"InfoQ","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"InfoQ","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/afc3bced3e1e4b188dd9127017a60e0c","url":"https://daily.dev/sources/infoq"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"docker,containers,platform-engineering","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"InfoQ","item":"https://daily.dev/sources/infoq"},{"@type":"ListItem","position":3,"name":"Buildpacks Move the Container Hardening Control Point Away From the Dockerfile"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/buildpacks-move-the-container-hardening-control-point-away-from-the-dockerfile-mlyrp5qrs#faq","mainEntity":[{"@type":"Question","name":"How does the rebase command in Cloud Native Buildpacks patch container images without a full rebuild?","acceptedAnswer":{"@type":"Answer","text":"Rebase swaps the OS layer digests of an application image for those of a new run image by rewriting the OCI manifest and configuration, an edit essentially limited to a JSON file. It takes milliseconds, requires very little compute, and needs no rebuild, source access, or CI queue slot. It only replaces compatible run-image layers, so vulnerable application dependencies still require a full rebuild. daily.dev surfaces builder and patching updates for teams weighing Dockerfiles against buildpack-based hardening."}},{"@type":"Question","name":"What is BellSoft's SLA for fixing critical vulnerabilities in its hardened Paketo builder images?","acceptedAnswer":{"@type":"Answer","text":"BellSoft's Standard tier commits to a 7-day remediation SLA for critical vulnerabilities and 14 days for all others, while its free Community tier lists no SLA. The hardened Paketo builder, generally available since 21 July 2026, is built on Alpaquita Linux-based Hardened Images with a reduced package set, non-root defaults, signatures, and SBOM data. Track hardened image SLAs like this on daily.dev when comparing container security vendors."}},{"@type":"Question","name":"When did Cloud Native Buildpacks graduate as a CNCF project?","acceptedAnswer":{"@type":"Answer","text":"Cloud Native Buildpacks graduated within the CNCF on 17 July 2026. The project frames its goal as concentrating container build best practices within a specialized platform team rather than having every application team maintain its own Dockerfile. Follow CNCF graduation milestones like this on daily.dev to stay ahead of platform engineering shifts."}}]} ```