BellSoft launches hardened Paketo builder for containers

BellSoft has released a hardened builder image for Paketo Buildpacks, aimed at users building container images with the open-source buildpack system.

The builder is based on BellSoft Hardened Images and is designed to let development teams adopt a different base image for buildpacks without changing application code or existing workflows. It is available for Java, Node.js, Python, Go and Ruby workloads, as well as native images built with Liberica NIK.

Paketo Buildpacks automatically converts application source code into container images, removing the need for developers to maintain Dockerfiles for each service. In this process, the builder serves as the base layer for both the build and runtime environments, so its components shape the security profile of every resulting container.

BellSoft's version replaces both stacks with images based on Alpaquita, its Linux distribution. It includes signed images, a software bill of materials and ongoing vulnerability management inherited from the underlying image base.

Shift from Dockerfiles

The launch reflects a broader effort by platform teams to centralise control over container build processes instead of leaving base image maintenance to individual developers. In larger software estates, organisations can run into operational and compliance issues when each repository has its own Dockerfile and update cycle.

BellSoft cited survey data showing that more than 60% of developers are unaware that a poorly written Dockerfile can introduce a security weakness. It also said adoption of buildpack tools among its users more than doubled between 2024 and 2025.

Under the buildpacks approach, developers push source code while the tooling detects the language, resolves dependencies and creates a runnable OCI image. This allows platform engineering teams to update a shared base layer and apply changes across services on the next build, rather than editing application repositories one by one.

Compliance focus

BellSoft is positioning the builder around regulatory and supply chain concerns that have become more prominent for organisations running production workloads. It cited frameworks and rules including FedRAMP, DISA STIG, the EU Cyber Resilience Act and DORA as drivers of demand for tighter control over container bases.

Its hardened images are maintained with a reduced package footprint, a fixed component set and non-root execution enabled by default. BellSoft added that patched images are typically published within 24 hours of a disclosed vulnerability.

This approach is intended to reduce the work involved in tracking vulnerabilities across multiple teams and repositories. For companies using buildpacks at scale, the builder layer can become the main control point for patching operating system packages, libraries and runtime binaries.

Alex Belokrylov, Chief Executive Officer of BellSoft, set out the company's view of that burden.

"Vulnerability management is a business problem, not an engineering one," said Alex Belokrylov, Chief Executive Officer of BellSoft. "It deserves a business answer, not the silent accumulation of toil on already-stretched internal teams. Scanner fatigue is real, and so is the cost of ignoring it. Rather than tracking CVE feeds, triaging which vulnerabilities affect which base images, and coordinating patches across teams, security and platform engineering teams can rely on BellSoft to maintain a clean image baseline. Each published image comes with a full Software Bill of Materials and a verifiable provenance record, making compliance audits straightforward and transparent, and providing the documented evidence that regulators and enterprise procurement teams increasingly demand."

Technical scope

The builder supports x86-64 and ARM64 architectures. It is also available in musl and glibc variants, giving users a choice aligned with existing infrastructure requirements.

For Java users, BellSoft said workloads running on Liberica JDK can see a 30% reduction in RAM and disk usage compared with standard OpenJDK images. Teams already using Paketo Buildpacks can adopt the new builder through a single configuration change, according to the company.

The release also underlines BellSoft's effort to extend its role beyond Java runtimes and into the container supply chain layer around application delivery. By tying buildpacks to its hardened operating system base, the company is seeking a larger role in how development teams manage software provenance, patching and audit evidence across cloud-native estates.