#28 of 28 infrastructure automation tools · Updated October 2026
Tinkerbell review 2026
Tinkerbell · Slow follower
Tinkerbell ranks #28 of 28 infrastructure automation tools in the Infrastructure Automation Ledger 2026, with a Ledger Index of 36.9 out of 100. Tinkerbell is the CNCF Sandbox bare-metal workflow engine that outlived its sponsor Equinix Metal; active 0.x releases, no plan mode, no vendor.
Scores
Source: Infrastructure Automation Ledger 2026, edition 2026-10-16. How each score works: methodology.
Pros
No domain scores 4 or higher out of 5.
Cons
- AI assistance0/5
- Provisioning breadth0.5/5
- Configuration management depth1/5
What the Ledger says
Tinkerbell is the lightest tool in this group: a bare-metal workflow engine with network boot, BMC control and a metadata service, and little else the Ledger measures. Sustainability matters more than capability here: its origin sponsor Equinix Metal shut down on 2026-06-30, the project is still 0.x with no support windows, and the CNCF has not moved it past Sandbox in six years. On the positive side, two serious 2026 advisories were fixed within days and three releases shipped this year. Before adopting it, find out who the current maintainers work for, because the public record does not say.
Tinkerbell has no AI features and no official agent interface beyond the Kubernetes API. Nothing on the record points to AI work.
Capability by area
Buying, lock-in and release record
Buying and licence (commercial risk)(lower is better)
- Maintainer concentration3.5
- Origin sponsor Equinix Metal ended service on 2026-06-30; maintainer employers after that were not found
- Backer health3.5
- No vendor, no paid support; CNCF Sandbox since 2020 without incubation
- Licence-change risk0.5
- Apache-2.0 under the CNCF
- Abandonment signs2
- Three releases in 2026 show activity, but all are 0.x on an irregular rhythm
- Security response1.5
- A critical SSRF and a high template exposure were fixed in July 2026 within days of each other, with published GHSA advisories
Technical lock-in(lower is better)
- Formats1.5
- Kubernetes YAML with Tinkerbell-specific workflow templates
- Export path2.5
- No export to other tools
- Stack coupling2.5
- Requires Kubernetes
- Hardware / cloud coupling0.5
- Any BMC with Redfish, IPMI or Intel AMT; offline capable
- Skills and tooling coupling2.5
- Kubernetes plus project concepts and Go templating; small community
Release credibility
- Cadence2.5
- Irregular: four months between 0.23.0 and 0.24.0, then 0.25.0 two days later; no schedule
- Roadmap transparency3
- Public roadmap repository, governance document and published advisories; no dated roadmap
- Say-do2.5
- Not enough announcements to measure
- Velocity2.5
- Consolidation into one binary and a UI in 2026; otherwise fixes
- Lifecycle stability1.5
- 0.x versions, breaking changes between minors, no support windows published
Partners and services
- Partner programme openness1
- None
- Multi-tenancy and self-service1.5
- Kubernetes namespaces and RBAC only
- API and infrastructure-as-code3
- Kubernetes API and Cluster API provider 0.7.0
- Skills and certification1
- None found
Alternatives to Tinkerbell
Questions about Tinkerbell
Is Tinkerbell any good?
Tinkerbell ranks #28 of 28 infrastructure automation tools in the Infrastructure Automation Ledger 2026, with a Ledger Index of 36.9 out of 100. Its weakest are ai assistance, provisioning breadth, configuration management depth.
What are the best alternatives to Tinkerbell?
The closest by Ledger Index are Cinc (41.6), Digger (42.8), Metal3 (43.9), Salt (47.5).
How is Tinkerbell licensed and sold?
Origin sponsor Equinix Metal ended service on 2026-06-30; maintainer employers after that were not found.
How much lock-in does Tinkerbell bring?
Tinkerbell scores 9.5 out of 25 on technical lock-in (lower is better). Export path: No export to other tools.
User reviews of Tinkerbell
No reviews yet
Be the first to say how Tinkerbell worked for you.
Write a review
No account needed and no email asked. We read every review before it appears and remove adverts, spam and personal attacks.