Learn Cloud Native & CNCF - Project Lifecycle: Sandbox → Incubating → Graduated

#Introduction

One of CNCF's most distinctive aspects is its project maturity levels system. Not all projects are treated the same: a week-old project certainly shouldn't be labeled the same as Kubernetes. The three-tier system — sandbox, incubating, graduated — gives an honest signal about how mature a project is.

This signal is very useful for you as a prospective user. When evaluating a new technology, maturity level is one of the first indicators to check. Graduated projects have undergone third-party security audits, whereas sandbox projects may still be changing every week.

By the end of this episode you will understand the meaning of each level, the promotion process, and why the OpenSSF Best Practices Badge is one of the key gateways in this lifecycle.

Keep in mind that maturity level is both a social and a technical process. A project doesn't move up just because its code is good, but because its community is healthy, its governance is proven, and real organizations are willing to vouch for its use.

#Project Maturity Levels

#Sandbox: Early Experiments

Sandbox is a project's entry point into CNCF. This level is for projects still in their infancy: the idea is interesting, the community is just forming, and the technical direction isn't stable yet. Sandbox projects change fast, so they aren't yet suitable for production reliance.

Despite its low status, sandbox is not a dead end. Many major projects started here, and this is actually the ideal place for developers who want to test ideas under CNCF's umbrella without heavy commitment.

The criteria for entering sandbox are deliberately light so innovation isn't choked by bureaucracy. A project just needs to show a clear purpose, a sensible development plan, and a willingness to work with CNCF standards. The rest is a process of learning and growing.

#Incubating: Early Production

Incubating is the intermediate level for projects that have started to be used in production by a number of organizations. Projects at this level demonstrate adequate community health, regular releases, and real early adoption. Many popular projects like Cilium and Crossplane sit at this level.

Incubating status means the project deserves consideration, but you still need to evaluate it carefully. The level of support and guarantees is not yet as strong as for graduated projects.

Moving up to incubating is a major achievement for a project. It signals that the project has passed the experimental phase and is starting to be trusted by real organizations to carry production loads — something far harder than merely attracting community attention.

#Graduated: Peak Maturity

Graduated is the peak of the lifecycle. Projects at this level have passed third-party security audits, have well-documented governance, and demonstrate broad production adoption. Examples include Kubernetes, Prometheus, and containerd.

Reaching graduated is a long process that can take years. It's not just a mark of prestige — it's a quality guarantee that organizations can rely on when making decisions.

If you work in an organization that chooses technologies, graduated status is often the minimum requirement before a project is allowed into production. That's reasonable: with a third-party security audit and documented governance, the technology risk is far more measurable.

#Archived: An Honorable Retirement

There is one additional status that is often forgotten: Archived. Archived projects are no longer actively developed, but their history and code remain available. Archiving a project is not failure — it's an honest way of acknowledging that a project has completed its role.

#The Promotion Process and Criteria

#Application Through cncf/sandbox and cncf/toc

The journey starts with an application. A project applies through the official repositories: github.com/cncf/sandbox to enter sandbox and github.com/cncf/toc for promotion. There, the candidate project writes a proposal explaining its purpose, community, and development plan.

This process is open: anyone can read the proposals and provide feedback. Transparency from the start keeps CNCF's decisions accountable.

#TOC Sponsorship, Public Comment, and Voting

After a proposal is submitted, a project needs to get sponsorship from a TOC member. The sponsor helps the project understand the process and advocates for it within the TOC. Next comes a public comment period where the community can respond, ending with voting by the TOC.

This combination of sponsorship, public input, and voting ensures decisions aren't made unilaterally. It blends technical, social, and strategic considerations in a balanced way.

The process is also unhurried. A project can spend months fulfilling requirements and answering questions from the TOC and community. This long period actually benefits the project: it forces the project's founders to think about governance, security, and sustainability from the start.

#The OpenSSF Best Practices Badge

One of the key gateways is the CII/OpenSSF Best Practices Badge. This badge assesses a project's security practices: CVE management, documentation, testing, and repository hygiene. To reach graduated, a project typically needs to show a badge with a good score, accompanied by a third-party security audit.

The badge has several levels — passing, silver, and gold — each requiring stricter practices. Projects serious about security usually don't stop at the lowest level, because their community and users also demand higher quality.

#Seeing the Process Firsthand

#Exploring the Sandbox Repository

The most concrete way to understand this lifecycle is to read proposals in progress. The cncf/sandbox repository stores the list of sandbox projects and candidates, complete with the reasons they were accepted or rejected:

git clone https://github.com/cncf/sandbox.git
ls cncf/sandbox
grep -l "accepted" cncf/sandbox/sandbox/*.md

The git clone command copies the repository to your computer, then ls shows its contents. Reading a few proposals at random will give you a real sense of what CNCF's acceptance criteria look like — far more useful than merely memorizing the rules.

If you want to see the full project list visually, open cncf.io/projects in your browser. That page shows every project with its maturity level, complete with links to each project's documentation and repositories.

#Using Maturity Levels in Decisions

#Maturity Level as a Signal

Now you know how to read this signal. When evaluating new technology, ask three things: what level is the project at, how long since it last moved up, and whether its promotion history seems reasonable. Projects that move up too quickly deserve suspicion, just like projects stuck in sandbox for years.

Remember that maturity level isn't the only factor. A sandbox project filling an empty niche can be more relevant than a graduated project whose competitors are already more established. Use maturity level as one tool, not the only one.

Combine it with other sources: read the documentation, check community activity, and see who already uses the project. Maturity level gives a trust signal, while independent research gives context — and the best decisions always come from both.

#Closing

Episode 4 explained the CNCF project lifecycle: sandbox for experiments, incubating for early production, graduated for peak maturity, and archived for honorable retirement. You also understood the open promotion process and the role of the OpenSSF badge as a quality gateway.

Key takeaways:

• Sandbox is the entry point for early experimental projects.
• Incubating marks early production adoption with a healthy community.
• Graduated requires a security audit, documented governance, and broad adoption.
• Archived is an honorable retirement status, not failure.
• The promotion process involves TOC sponsorship, public comment, and voting.
• The OpenSSF Best Practices Badge is a quality indicator usable on any project.

In episode 5 we'll open CNCF's showcase catalog: the graduated projects catalog — from Kubernetes, the first to graduate in March 2018, to OpenTelemetry, which followed in May 2026.