The CNCF Maturity Ladder: Sandbox vs Incubating vs Graduated (and How to Bet)

TL;DR - Every CNCF project sits at one of three maturity levels - Sandbox, Incubating, or Graduated - that map to the "Crossing the Chasm" curve (Innovators → Early Adopters → Early Majority). The CNCF landscape now spans 150+ projects, with 35+ graduated. Knowing what each level signals is how you decide which project to trust in production - and which to bet early on.

The CNCF landscape looks like chaos: 150+ logos, overlapping categories, projects you've never heard of next to Kubernetes. But there's a hidden order. Every project carries a maturity badge that tells you exactly how much to trust it - if you know how to read it.

What are the three CNCF maturity levels?#

CNCF sorts projects into three tiers, deliberately mapped to Geoffrey Moore's Crossing the Chasm technology-adoption curve:

• Sandbox - experimental, early-stage, innovative projects. The Innovators tier. High potential, high churn, expect breaking changes. (kagent, for example, is a Sandbox project.)
• Incubating - projects gaining real adoption, focused on hardening stability and maturity. The Early Adopters tier. Proven enough that serious teams run them, still evolving.
• Graduated - highly mature, robust projects whose adopters have demonstrated production-readiness at scale. The Early Majority tier. Kubernetes, Prometheus, Envoy live here.

The badge isn't marketing. It's a governance signal earned through review. Here's what each tier signals at a glance:

How does a project climb the ladder?#

Projects don't just get promoted for being popular - they pass through a defined project lifecycle with due diligence at each step. Moving up requires evidence: a healthy contributor base (not single-vendor controlled), real production adopters, documented security practices, a clear governance model, and a TAG review.

 Sandbox  ──▶  Incubating  ──▶  Graduated
 innovate      gain adoption     prove at scale
 (Innovators)  (Early Adopters)  (Early Majority)

Going from Sandbox to Incubation, in particular, is a serious bar: the project must show it's more than one company's side project and that a community genuinely depends on it. Graduation is harder still. Fewer than three dozen projects have cleared it.

The kinds of evidence a project assembles at each promotion review:

The point isn't the checklist - it's that promotion is earned adoption, verified by peers, not a popularity vote.

How should you decide which projects to trust?#

Match the maturity level to your risk tolerance and use case, not to hype.

The counter-intuitive move: for contributors, Sandbox is often the best bet even though it's the riskiest for adopters. Small, fast-moving projects are where you can land meaningful work and grow into a maintainer role quickly - which is exactly why WOSS anchors its contribution on a Sandbox project like kagent. If you want the step-by-step on turning that bet into merged PRs, see How to Contribute to CNCF.

What does the maturity ladder tell you about the ecosystem?#

It's a pipeline, not a snapshot. Sandbox is the ecosystem's R&D funnel; Incubation is its proving ground; Graduation is its hall of fame. The health of cloud native shows in the flow - new Sandbox projects entering, a steady trickle graduating.

With 300,000+ contributors and 150+ projects moving through this pipeline, the ladder is how the community collectively decides what's real. Read the badge before you read the README, and the landscape stops being chaos and starts being a map.

How does WOSS read the ladder?#

For Welzin Open Source Software, the ladder is a targeting tool. Adopters read it defensively - "is this safe for production?" We read it offensively - "where can early, honest contribution earn the most reputation?" That points squarely at Sandbox, and specifically at kagent, which sits at the intersection of cloud-native infrastructure and agentic AI. It's also why our broader cloud-native AI (CNAI) thesis tracks the Sandbox funnel closely: today's experimental AI-on-Kubernetes project is tomorrow's incubating standard. Betting early, contributing in public, and letting the ladder validate the choice is the whole WOSS approach.

Frequently asked#

What is the difference between CNCF Sandbox, Incubating, and Graduated?#

Sandbox projects are experimental and early-stage (Innovators tier); Incubating projects have gained real adoption and are hardening (Early Adopters tier); Graduated projects are mature and proven in production at scale (Early Majority tier), like Kubernetes and Prometheus. The levels map to the Crossing the Chasm adoption curve.

How does a CNCF project become graduated?#

It advances through a defined lifecycle with due diligence at each step, demonstrating a healthy multi-vendor contributor base, real production adopters, security practices, and clear governance, with review by a CNCF Technical Advisory Group. Fewer than three dozen projects have graduated.

Should I use a CNCF Sandbox project in production?#

Cautiously. Sandbox projects are innovative but expect breaking changes, so pin versions and track releases closely. For core production infrastructure, prefer Graduated or Incubating projects; use Sandbox where you want early influence or are experimenting.

How many CNCF projects are there at each level?#

The CNCF landscape spans 150+ hosted projects, with 35+ graduated as of 2026 and the remainder split across Incubating and Sandbox. Sandbox is intentionally the largest and most volatile tier - it's the ecosystem's R&D funnel - while Graduated stays small because the bar for reaching it is high. Check the CNCF projects page for the current, authoritative counts.

Written by Aman Mundra - founder of Welzin and the Welzin Open Source Software (WOSS), contributing upstream across the CNCF ecosystem. Part of an ongoing cloud-native open source series.