A podling is a project undergoing incubation at the Apache Software Foundation. The status means its infrastructure, communications and decision making are still being checked, and the foundation has not yet fully endorsed it. It does not by itself say the code is incomplete or unstable. Judge it on its own evidence.
Definition
The Apache Incubator is the entry path for projects and codebases that want to join the foundation. A project in that process is called a podling. Incubation is required of all newly accepted projects until a review shows that the infrastructure, communications and decision making process have stabilized in a way consistent with other successful Apache projects.
The Incubator's policy gives the standard disclaimer a podling must carry. It states that incubation status is not necessarily a reflection of the completeness or stability of the code, but that it does indicate the project has yet to be fully endorsed by the foundation. The disclaimer has to appear on the website, in documentation, in releases and in release announcements.
What the status tells you
Two things are true at once.
- Governance is under review. A podling reports to the Incubator PMC every month for its first three months and every quarter after that, with mentors helping.
- Not every podling finishes. The Attic notes that some projects do not graduate and are retired instead, staying under Incubator oversight.
So a podling is neither a warning sign nor a stamp of approval. It tells you where the project is on its governance path.
How to evaluate one
- Look for the incubation disclaimer in the release you plan to use. If it is missing, ask why.
- Read recent status reports. Active mentors and steady reports suggest the process is working.
- Check the usual health signals: recent releases, more than one maintainer, a security contact. See maintainer health signals before adopting a dependency.
- Check what a release means. The policy distinguishes a standard disclaimer from a work in progress disclaimer for releases that may not follow all foundation policy.
- Write down an exit plan, since retirement is a possible outcome.
Podling versus other maturity labels
Other foundations use different stage names with different meaning. For the cloud native version, see CNCF sandbox, incubating and graduated. Do not assume the word "incubating" means the same thing across foundations. Read each foundation's own policy.
What to record internally
Add a line to your dependency record: the project name, that it is a podling, the date you checked its status, and who owns the review. When the project graduates or retires, the record tells you to revisit. Safeguard can help with the inventory part. Its SBOM and dependency scanning lists what your projects actually pull in, so you can see which components you depend on and decide where to look closer. You can try a free scan at gold.safeguard.sh/scan.
Quick check
Is a podling less secure than a graduated project?
Not automatically. The disclaimer says incubation is not a reflection of code completeness or stability. Check the project's practices directly.
Where do I find the incubation disclaimer?
The policy requires it on the podling's website, in documentation, in releases and in release announcements.
Sources
Last reviewed: 19 October 2026.
