Learn Cloud Native & CNCF - Incubating & Sandbox Projects

#Introduction

Episode 5 covered the top of the pyramid — graduated projects. But most of the innovation in the CNCF ecosystem actually happens below the top: at the incubating and sandbox levels. This is where rising projects grow and the boldest ideas start being tested.

Many projects that sound modern and popular among users are not yet graduated. Cilium for networking, Dapr for distributed applications, and Crossplane for control planes — all sit at the incubating level. This status isn't a sign of weakness; on the contrary, it shows a healthy ecosystem dynamic.

By the end of this episode you will know examples of incubating and sandbox projects, understand the difference in experience between the two, and know how to monitor their development quarter by quarter.

#Incubating Projects: On the Rise

#Notable Incubating Projects to Know

The incubating level is home to projects already used in production by a number of organizations but that don't yet meet all the graduated requirements. Some of the most prominent names include:

• Cilium — eBPF-based networking and security for Kubernetes.
• Dapr — a runtime for building portable microservices applications.
• Crossplane — a control plane for provisioning cloud resources via Kubernetes.
• cert-manager — automatic TLS certificate management in the cluster.
• Tekton — a Kubernetes-based CI/CD framework, accepted in March 2026.
• Thanos — a large-scale metrics system built on Prometheus.
• Strimzi — an operator for running Apache Kafka on Kubernetes.
• Karmada — multi-cluster orchestration for distributed workloads.

This lineup shows that the incubating level isn't "second class." Many technologies that are the industry's top choices actually occupy this level.

Also notice how diverse these names are: some handle networking, distributed applications, certificates, and observability. This diversity shows that incubating covers almost every domain in the cloud native landscape — it's the busiest area in the ecosystem.

#Why Popular Projects Aren't Necessarily Graduated

The path to graduation takes years because the requirements are demanding: third-party security audits, documented governance, and evidence of broad adoption. Meanwhile, a project can become very popular before all those formal requirements are met.

So don't judge a project's quality only by its maturity level. Cilium, for example, is adopted by almost every major cloud provider even though it's still incubating. Maturity level signals something about process, not automatically about quality.

The same pattern applies to Tekton, which was just accepted in March 2026. It has been used by many CI/CD teams for a long time, but the formal path to graduation takes its own time. What matters most is the combination: a good project generally stays good regardless of level, and vice versa.

#Sandbox Projects: The Experiment Incubator

#Early Experiments Under CNCF's Umbrella

Sandbox is where the earliest projects stand. Here ideas are tested, communities start forming, and technical direction can still change drastically. Classic examples that have been or still are in sandbox include WasmEdge for the WebAssembly runtime and Microcks for API mocking.

The defining trait of sandbox projects is the speed of experimentation. Since there aren't many production users yet, project teams are free to change designs drastically without worrying about breaking the ecosystem. This is the most "wild" phase in a CNCF project's lifecycle.

#Don't Rely on It in Production

Important message: sandbox projects aren't yet suitable for production reliance. You may try them to learn and experiment, but choosing a sandbox project as the foundation of a production architecture is a very risky decision.

Think of sandbox as a research laboratory: people freely test hypotheses and fail without major loss there. Once an idea is proven, it "graduates" to a higher level and becomes suitable for more serious environments.

This is actually where your opportunity lies: following a sandbox project from early on gives you an edge — you watch a technology being born, understand its design rationale, and can build rare expertise before most people even know it exists.

#The Difference in Experience Between the Two Levels

#Maturity Levels Offer Different Experiences

To make things clear, let's compare the three main levels:

• Sandbox: early experiments, APIs can change at any time, not yet safe for production.
• Incubating: starting to be used in production, healthy community, but security guarantees not yet as high as graduated.
• Graduated: peak maturity with security audits and documented governance.

These three levels aren't a sequence every project must follow. A project can stay in incubating for years, and some projects even choose not to move up for certain reasons.

#Monitoring Project Development

#Official Catalogs and Public Repositories

Maturity level changes every quarter, so you need to know how to monitor it. The two most useful official sources are cncf.io/projects for the complete picture and sandbox.cncf.io for the newest projects. The cncf/sandbox repository also stores detailed project acceptance history:

git clone https://github.com/cncf/sandbox.git
ls cncf/sandbox
grep -rl "Proposed" cncf/sandbox/sandbox | head -n 10

The git clone command copies the repository, then grep searches for files indicating a project is being proposed. Reading these files gives you a feel for the kinds of projects CNCF is currently considering.

#Make Monitoring a Habit

Make it a habit to check the CNCF catalog every few months. Watch which projects move up, which projects just entered sandbox, and which projects were archived. From this you can read industry trends long before the big news breaks.

The ability to read trends is one of the most valuable skills you can take from this conceptual series. It makes you not just a technology user, but an ecosystem observer who understands which way the wind is blowing.

One thing to remember: maturity status is a decision made by humans, complete with its nuances and delays. Treat it as a guide, not gospel — and always pair it with independent research before making important decisions.

Start with a simple step: mark a date on your calendar to check the CNCF catalog every two months. Note the new projects entering sandbox and the projects moving up. Within a year, you'll have a record of trends most people don't have — and interesting discussion material in any community.

#Closing

Episode 6 completed the picture of the CNCF project catalog: the incubating level where projects like Cilium, Dapr, and Crossplane grow, and the sandbox level as an incubator for early experiments. You also know how to monitor the development of both quarter by quarter.

Key takeaways:

• Incubating projects are used in production but don't yet meet graduated requirements.
• Cilium, Dapr, Crossplane, cert-manager, and Tekton are leading incubating examples.
• Sandbox is a place for early experiments not yet safe for production.
• Popularity doesn't always correlate with maturity level.
• cncf.io/projects and sandbox.cncf.io are official monitoring sources.
• Reading promotion trends is a valuable ecosystem-observer skill.

In episode 7 we'll move to CNCF's technical structure beyond the TOC: Technical Advisory Groups (TAGs) and working groups — the ten TAGs that provide a forum for cross-project discussion, from security to AI.