SAN JOSE, Calif., July 21, 2026 (GLOBE NEWSWIRE) -- BellSoft, a leading OpenJDK vendor, announces the general availability of a new hardened builder image for Paketo Buildpacks™. Built entirely on BellSoft Hardened Images, the builder gives Paketo Buildpacks™, users a direct path to improved security and compliance posture, including continuous vulnerability management under SLA, signed images, and Software Bill of Materials, all inherited automatically with no changes to existing developer workflows.

Paketo Buildpacks™ is an open-source project, backed by the Cloud Native Computing Foundation, that transforms application source code into production-ready container images automatically, without a Dockerfile. A buildpack inspects application code, determines what it needs, downloads dependencies, compiles where necessary and produces a runnable OCI image, all in a single command.

At the center of the process is a builder, a curated container image that packages the buildpacks, a build environment (the “build stack”), and a runtime environment (the “run stack”) together. The builder is the security foundation of every image produced: the OS packages, libraries and runtime binaries it contains become the base of every application container that uses it. BellSoft’s contribution is a hardened builder that replaces both stacks with Hardened Images, based on Alpaquita, BellSoft's own secure and lightweight OS, so every container produced automatically inherits BellSoft’s full security and compliance posture.

Buildpack tools vs. Dockerfiles: why enterprises are switching

Dockerfiles are written by developers, one per service, updated manually, and are prone to drift. According to a recent BellSoft survey, over 60% of developers are unaware that a poorly written Dockerfile can itself become a security vulnerability. At enterprise scale, with hundreds of services and dozens of teams, Dockerfile sprawl becomes a compliance and maintenance liability. Base image updates must be propagated manually across every repository. Security patches are only as fast as the slowest team.

Paketo Buildpacks™ concentrate container build expertise in a single, reusable layer maintained by platform engineering. Developers push code, and the buildpack tooling auto-detects the language, resolves dependencies, and produces a minimal, reproducible OCI image with a built-in Software Bill of Materials. No Dockerfile is required. When a base image needs updating, buildpack rebasing patches the OS layer across every service on the next build, without touching application code. Among BellSoft’s user base, buildpack tool adoption more than doubled year-over-year from 2024 to 2025.

With BellSoft’s hardened builder, that advantage compounds. When a vulnerability is patched in BellSoft Hardened Images, every application built on the builder picks up the fix on the next build, across every service and every team, simultaneously.

Hardened images should be the default, not the upgrade

The threat landscape has changed. Zero-trust security models, software supply chain attacks, and tightening regulatory requirements, from FedRAMP and DISA STIG to the EU Cyber Resilience Act (CRA) and DORA, have made hardened container bases a practical necessity for any organization running production workloads. The question is no longer whether to harden, but how to do it without adding friction for development teams.

BellSoft Hardened Images are built on Alpaquita, BellSoft's secure, lightweight OS, and ship with a significantly reduced package footprint, non-mutable component set, running as non-root, and other security configurations enabled by default. They are maintained by BellSoft’s security team with a commitment to a zero-CVE window: when a vulnerability is disclosed, a patched image is published typically within 24 hours.

“Vulnerability management is a business problem, not an engineering one,” said Alex Belokrylov, CEO of BellSoft. “It deserves a business answer, not the silent accumulation of toil on already-stretched internal teams. Scanner fatigue is real, and so is the cost of ignoring it. Rather than tracking CVE feeds, triaging which vulnerabilities affect which base images, and coordinating patches across teams, security and platform engineering teams can rely on BellSoft to maintain a clean image baseline. Each published image comes with a full Software Bill of Materials and a verifiable provenance record, making compliance audits straightforward and transparent, and providing the documented evidence that regulators and enterprise procurement teams increasingly demand.”

Availability

BellSoft’s hardened builder for Paketo Buildpacks™ is available now on Docker Hub for six language runtimes: Java (Liberica JDK), native images with Liberica NIK (GraalVM-based tool), Node.js, Python, Go, and Ruby. The builder supports both x86-64 and ARM64 architectures, and is available in two C standard library variants—musl and glibc—to match existing infrastructure requirements. Java workloads on Liberica JDK additionally benefit from a 30% reduction in RAM and disk usage compared to standard OpenJDK images.

Teams already using Paketo Buildpacks™ can switch to the BellSoft hardened builder with a single configuration change. No application code modifications are required.

Buildpacks, the Buildpacks.io logo, and Paketo Buildpacks are trademarks of The Linux Foundation. Please see buildpacks.io and paketo.io for more information.

About BellSoft

BellSoft delivers the most complete Java experience with a more secure, reliable, and cost-effective approach to application development on any platform and in any environment. BellSoft is one of the leading contributors to the OpenJDK, and the only vendor that supports current LTS Java versions, legacy JDK 6 & 7 and Liberica NIK. Liberica JDK is the runtime of choice for VMware, Spring Framework, JetBrains, and millions of users worldwide. For more information, visit www.bell-sw.com.

Contact:
Kevin Wolf
TGPR for BellSoft
kevin@tgprllc.com