Cloud Native Computing Foundation

To move to incubating or graduated, a project opens an application issue in the cncf/toc repository with evidence for each criterion, a self-assessed technical review, a self-assessed governance review, and five to seven adopters willing to be interviewed. A TOC member volunteers as sponsor, meets the project, interviews adopters and writes the due-diligence report as a pull request. After about a week of internal TOC review, the report goes out for two weeks of public comment, and then to a vote, which passes with a two-thirds supermajority of the TOC.

The TOC promises no timetable and doesn’t take applications first come, first served. It tells projects to plan on at least three months once a sponsor has taken the application, and says the whole process can take from 5 to 15 months. In the four weeks before each KubeCon + CloudNativeCon in Europe and North America, no new sponsorships, public comments or votes start. Meeting every criterion doesn’t guarantee promotion either; the TOC has final discretion.

The charter splits the foundation in two. The Governing Board handles marketing, business oversight and the budget, and sets policy on trademarks and other intellectual property, but makes no technical decisions beyond agreeing the CNCF’s scope with the TOC. Its voting members are one representative from each Platinum member, representatives elected by Gold and Silver members (one per five Gold or ten Silver members, up to three each), the TOC chair, the End User Technical Advisory Board chair and two committers elected from CNCF projects. Members can also join as End Users, academic institutions or non-profits.

The Technical Oversight Committee has eleven members serving staggered two-year terms. The Governing Board elects six, end-user members two, maintainers of non-sandbox projects one, and the TOC itself two more. No more than two may come from the same group of related companies; if a job change would put three there, they decide among themselves who steps down, or draw lots. The TOC approves new projects, sets the stage criteria and votes on promotions and archiving, and the charter requires its project decisions to be made in open meetings, on a public mailing list or in public issues.

The Cloud Native Landscape at landscape.cncf.io is a map of the whole field, not a list of what the CNCF hosts. Its data file held 2,438 entries on October 27, 2026: 722 were logos of CNCF members, and the rest were projects and products, open source and closed. Cloud-native projects with at least 300 GitHub stars are generally included, closed-source products are allowed if they link to a clear description, and every Certified Kubernetes distribution is shown.

Only 259 of those entries are CNCF projects: the 231 marked sandbox, incubating or graduated, and 28 archived. A logo on the landscape tells you nothing about who owns a project or how it is governed. The labels also lag the votes: gVisor and KubeRay, both voted into the sandbox in September 2026, were still listed as ordinary entries a month later while their onboarding finished.

The charter’s IP policy applies to every project. It must transfer its trademark and logo to the Linux Foundation, and use only OSI-approved open-source licences for code. All new inbound code must carry a Developer Certificate of Origin sign-off and be contributed under the Apache License 2.0; each project decides whether it also requires a contributor licence agreement, which follows the Apache CLA. All outbound code is released under Apache 2.0 and documentation under Creative Commons Attribution 4.0. The Governing Board can approve another licence as an exception, for example to comply with the licence of code a project builds on.

Because contributions come in under Apache 2.0 rather than being assigned to one company, and the name belongs to the Linux Foundation, no single vendor can move a CNCF project to a source-available licence: a company can fork the code, but not the name. OpenTofu, started by Gruntwork, Spacelift, Harness, env0, Scalr and others after HashiCorp moved Terraform to the Business Source License, says giving the project to the Linux Foundation lowers the risk of adopting it; it joined the CNCF sandbox in April 2025.