BellSoft’s New Blueprint to Automate Container Security at the Source

SAN JOSE, CA – July 21, 2026 – OpenJDK specialist BellSoft today announced a strategic move that extends its reach from Java runtimes deep into the software supply chain, unveiling a hardened builder for Paketo Buildpacks. The new offering promises to deliver zero-CVE container images by automating security at the point of creation, a significant operational innovation aimed squarely at enterprises wrestling with the mounting complexity and risk of cloud-native development.

For years, the containerization boom, led by Docker, has promised efficiency and portability. Yet for many organizations, that promise has been accompanied by the operational drag of “Dockerfile sprawl” and the relentless pressure of vulnerability management. BellSoft’s new builder aims to replace this manual toil with a centralized, automated system that embeds security directly into the development pipeline, a move that could fundamentally alter how platform engineering and security teams approach their work.

The Hidden Costs of Container Sprawl

The core challenge BellSoft is targeting is not a new technology, but a new class of operational debt. In large enterprises, hundreds of services, managed by dozens of teams, each have their own Dockerfile—a script that defines how to build a container image. According to a recent BellSoft survey, over 60% of developers are unaware that a poorly written Dockerfile can itself become a security vulnerability. This creates a vast, fragmented landscape where security posture is inconsistent and difficult to enforce.

When a critical vulnerability like Log4Shell emerges, platform teams face the daunting task of manually propagating patches across every repository. This process is only as fast as the slowest team, leaving critical systems exposed. The result is a state of perpetual “scanner fatigue,” where security teams are overwhelmed by CVE alerts, and platform engineers are buried in the toil of tracking, triaging, and coordinating patches. As one industry analyst noted, this decentralized approach makes it nearly impossible to maintain a consistent compliance posture, turning audits into a forensic exercise.

This operational friction is compounded by a tightening regulatory environment. Mandates like the EU’s Cyber Resilience Act (CRA) and the Digital Operational Resilience Act (DORA) are increasing the pressure on organizations to provide verifiable evidence of their software supply chain's integrity. Simply put, the ad-hoc management of container images is becoming an unacceptable business risk.

Shifting Security Left, Without Shifting the Burden

BellSoft’s solution hinges on the growing adoption of Paketo Buildpacks, an open-source CNCF project that automates the creation of container images without a Dockerfile. Instead of developers writing build instructions, the buildpack intelligently inspects the application code, determines its needs, fetches dependencies, and produces a minimal, reproducible OCI image. This centralizes build logic under the control of the platform team.

The key operational advantage is rebasing. When a vulnerability is found in the base operating system, the platform team can update the buildpack, and every application using it will automatically receive the patched OS layer on its next build—without touching a single line of application code. This transforms vulnerability response from a months-long, cross-team fire drill into a routine, automated process.

BellSoft’s innovation is to replace the standard components of the Paketo builder with its own hardened technology. The new builder uses BellSoft Hardened Images, built on the company’s lightweight and secure Alpaquita Linux OS, for both the build environment and the final runtime environment. This means every container produced automatically inherits a robust security posture, including continuous vulnerability management under an SLA, signed images for provenance, and a complete Software Bill of Materials (SBOM) for compliance audits. For developers, the workflow remains unchanged; they push code, and a secure, compliant container image emerges. For the organization, security becomes an automated, built-in feature of the CI/CD pipeline.

The ‘Zero-CVE’ Promise and a Business-First Approach

At the heart of BellSoft's offering is a bold claim: a commitment to a “zero-CVE window.” The company’s security team maintains the Hardened Images, pledging to publish a patched image, typically within 24 hours of a vulnerability’s disclosure. This is more than a technical feature; it's a business proposition.

“Vulnerability management is a business problem, not an engineering one,” said Alex Belokrylov, CEO of BellSoft, in the announcement. “It deserves a business answer, not the silent accumulation of toil on already-stretched internal teams.” This perspective reframes security from a cost center to a managed service, allowing security and platform teams to offload the undifferentiated work of tracking CVE feeds and focus on higher-value strategic initiatives.

The “hardened” nature of the images stems from Alpaquita Linux, which features a significantly reduced package footprint, immutable components to prevent runtime tampering, non-root execution by default, and other security configurations. This minimalist design shrinks the attack surface area from the start. For Java workloads, the combination of Alpaquita and BellSoft's Liberica JDK also yields significant performance gains, with up to 30% reduction in RAM and disk usage compared to standard OpenJDK images.

This integrated “3-in-1” approach—covering the runtime (Liberica JDK), OS (Alpaquita), and container security under a single SLA—is a key differentiator in a crowded market where enterprises often stitch together solutions from multiple vendors.

A Strategic Expansion into Cloud-Native Security

This launch marks a significant strategic expansion for BellSoft. Long recognized as a leading contributor to OpenJDK and the vendor behind the popular Liberica JDK runtime, the company is now leveraging its deep expertise in secure, high-performance runtimes to address the broader software supply chain. By embedding its technology within the buildpack ecosystem, BellSoft is positioning itself as a critical infrastructure provider for the cloud-native era.

The move taps directly into the industry’s shift toward DevSecOps and the demand for tools that make security a seamless part of development, not an obstacle. BellSoft’s hardened builder for Paketo Buildpacks is available now on Docker Hub for major language runtimes, including Java, Node.js, Python, Go, and Ruby, supporting both x86-64 and ARM64 architectures. For teams already using Paketo, switching requires only a single configuration change, offering a low-friction path to a dramatically improved security and compliance posture.