Paketo Buildbacks users can now run Buildpacks on BellSoft's secure base image instead of a generic, less secure one.
BellSoft's Hardened builders for Paketo buildpacks let developers bypass Dockerfiles entirely and bring the zero-CVE (Common Vulnerabilities and Exposure) image to Buildpacks users.
"That's why we have created our own builder, just to provide our secure approach with hardened images, and bring that to [Buildpacks users]," Dmitry Chuyko, senior performance architect at BellSoft, told TechTarget. "The way to use hardened images with buildpacks is to have that special builder."
A zero-CVE builder helps avoid the security concerns tied to Dockerfile management. BellSoft's security team is committed to the zero-CVE design goal, publishing patched images within 24 hours of a vulnerability disclosure.
"Rather than depending on each development team to choose the right base image, keep it patched, and produce the necessary compliance evidence, those controls can be built into the shared development process. That can reduce inconsistency between teams, make security fixes easier to distribute, and limit the number of known vulnerabilities entering production," said Katie Norton, an analyst at IDC, in an email. "Developers also benefit from having less container maintenance work, but the larger value is improved security governance and a more consistent compliance posture across the organization."
Paketo Buildpacks are optimized for Java and Spring. "That's the major critical framework in the Java world," Chuyko said. "[About] 85% of background applications, they just rely on Spring Boot and Spring."
How do buildpacks work?
Paketo Buildpacksis a CNCF-backed, open-source project that transforms source code into a production-ready container image without a Dockerfile. The Builder is based on BellSoft Hardened Images and enables continuous vulnerability management under service-level agreements (SLA), signed images, software bills of materials (SBOM) and a verifiable provenance record for Paketo Buildpacks users.
"If it's fine for you to rely on someone's expertise, and that someone provides you an automated way of building images, that's extremely convenient and it usually keeps you more secure [and] more performant, just because you have all necessary scaffolding performed for you inside the building process," Chuyko said.
In general, a hardened builder is used to create hardened images. It protects the build process from tampering and provides metadata that proves how and where an image was built. Buildpacks are the plugins nested inside the builder that knows how to securely build code for one specific language or technology. For example, the Liberica Buildpack inspects application code, determines what it needs, downloads dependencies, compiles where necessary and produces a runnable open container initiative (OCI) image using single command.
"That builder knows how to turn that kind of application -- like a Spring Boot application, or a Go application, or Python application -- into a container," Chuyko said.
The builder packages buildpacks, the build environment and the runtime environment together. The OS packages, libraries and runtime binaries the builder contains become the secure base of every application container that uses it.
BellSoft's Hardened Builder replaces both the run stack and the build stack with BellSoft Hardened Images, based on Alpaquita, BellSoft's own secure and lightweight OS based on Alpine Linux. Every container produced automatically inherits BellSoft's full security and compliance posture.
"Buildpacks trade some of the flexibility of a bespoke Dockerfile for greater centralization, repeatability and policy consistency," Norton said.
The builder supports both x86-64 and ARM64 architectures and is available in two C standard library variants -- musl and glibc -- to match existing infrastructure requirements. Teams already using Paketo Buildpacks can switch to the BellSoft Hardened Builder with a single configuration change -- no application code modifications are required.
Users can download the builder on Docker Hub for six language runtimes:
Java (Liberica JDK).
Native images with Liberica NIK (GraalVM-based tool).
Node.js.
Python.
Go.
Ruby.
The advantages of buildpack tools over Dockerfiles
Dockerfiles can be a maintenance, compliance and security liability at scale.
"The problem emerges when an organization has hundreds of individually maintained Dockerfiles that have evolved differently across teams. Each file can specify a different base image, package set, user privilege, build toolchain or update strategy. Over time, that creates drift and makes it harder to enforce a consistent security baseline or provide uniform evidence that images were built according to policy," Norton told TechTarget.
Developers have tools to reduce the manual work of Dockerfile maintenance, but updates still need to be reviewed, merged, tested and rebuilt across affected repositories.
"More mature platform engineering organizations may already centralize much of this work through golden images and reusable pipelines," Norton wrote. "The distinction with buildpacks is that they move more of the container construction logic out of each application repository and into a shared platform-maintained layer."
[Buildpacks] move more of the container construction logic out of each application repository and into a shared platform-maintained layer.
Katie NortonAnalyst, IDC
Developers push code, and the buildpack tooling auto-detects the language, resolves dependencies and produces a minimal, reproducible OCI image with a built-in SBOM. When a base image needs updating, buildpacks patch the OS layer across every service on the next build, without touching application code. Platform engineering teams can maintain the reusable layer.
Specifically, BellSoft Hardened Images ship with a significantly reduced package footprint and non-mutable component set, running as non-root with a minimized set of components. "The code that you run in the container won't be able to add something that's poison," Chuyko said.
Ben Lutkevich is an award-winning technology writer and editor covering IT infrastructure, app development and AI.
