Platform Monkey ctx

Backstage: The Developer Portal Spotify Open-Sourced and Everyone Else Had to Staff

2014–present · · By

Spotify's Tools squad built an internal developer portal called System-Z in 2014 to stop 100+ squads reinventing tooling; renamed Backstage in 2018, open-sourced March 2020, donated to the CNCF that September.

Sources

Spotify didn't set out to build an open-source project. It set out to stop 100+ autonomous squads from drowning in their own tooling sprawl — and the portal that grew out of that internal tantrum, Backstage, became the framework the entire platform-engineering industry now measures itself against. This is the story of System-Z, the sandbox escape that embarrassed a CNCF incubating project, the backend rewrite that taxed every adopter, and the open-core machine Spotify built on top of a foundation gift. It's also the story of why "free" is the most expensive word in the IDP market.

The Origin: A Portal Built Out of Spite for Spreadsheets

Spotify's engineering culture was famously built on squads — small, autonomous teams owning their own services. Autonomy at that scale had a price the company documented honestly on its own Backstage Journey timeline: every squad built or bought its own tooling, and the sprawl had to be tracked somewhere. In 2013 that somewhere was ServiceDB, Spotify's first internal service catalog. In 2014, a newly formed Tools squad went further and started building what the company explicitly called a "developer portal" for authoring and managing backend services end-to-end — System-Z. By 2015 System-Z had absorbed templates for creating components, new component types for data pipelines, and eventually replaced ServiceDB outright.

In November 2018, System-Z officially became Backstage — "one central place for all our software components, resources, tools, tech docs, processes, and best practices," in Spotify's own words, with teams building plugins instead of spreadsheets. Two years later the numbers were the pitch: a 55% decrease in onboarding time (measured as time to a developer's 10th pull request), 280+ engineering teams using it daily to manage 2,000+ backend services, 300+ websites, 4,000+ data pipelines, and 200+ mobile features.

On March 16, 2020, Stefan Ålund published Announcing Backstage and open-sourced the whole thing. The ambition was not subtle: "Our vision for Backstage is for it to become the trusted standard toolbox (read: UI layer) for the open source infrastructure landscape. Think of it like Kubernetes for developer experience." The Hacker News thread hit 146 points; two days later the project was top-trending on GitHub with 1,700 stars. Spotify followed up with What the Heck is Backstage Anyway? to answer the obvious question — a music company? — and laid out the three-phase roadmap the launch actually shipped against:

Phase 1 (now):       Extensible frontend platform — one consistent UI
                     layer over internal infrastructure and tools.
Phase 2 (+2-3 mo):   "Manage your stuff" — service catalog, deployment
                     status, test coverage, Kubernetes tooling in one portal.
Phase 3 (later):     Ecosystem — open source plugin marketplace so adopters
                     "pick the tools that match your stack."

The repo itself (backstage/backstage) was created January 24, 2020, and the first public commits in February are the names that still run the project: Patrik Oldsberg (rugvip), Patrick Balestra, and Raghunandan Balachandran, all porting components out of Spotify's internal monorepo. The catalog, Software Templates, and TechDocs all shipped within six months of launch. The promise was a platform; the delivery, on day one, was a framework.

The Timeline: From System-Z to the Default IDP

Crisis Points & Architectural Pivots

1. The scaffolder trust chain (2021–2023) — the fix that became the next vulnerability

Backstage's ugliest security story is a chain, not an event. In November 2021, GHSA-2g8g-63j4-9w3r disclosed that the Scaffolder's templating library assumed registered templates were trusted — a malice-free assumption in a world where templates come from arbitrary Git repositories. A malicious actor with write access to a registered template could get remote code execution on the scaffolder backend. The patched version sandboxed template JavaScript execution using vm2, a popular Node sandbox library. That fix was the setup.

In August 2022, Oxeye — through Spotify's bug bounty — demonstrated SandBreak, a sandbox escape in vm2 itself (CVE-2022-36067), and chained it straight into Backstage. The mechanics, from the disclosure:

1. Attacker-controlled template yaml reaches NunjucksWorkflowRunner.render
2. SecureTemplater.render executes the template's JavaScript inside vm2
3. Template overrides Error.prepareStackTrace with its own implementation
4. A triggered error hands back a CallSite object created OUTSIDE the sandbox
5. CallSite.getThis() -> host objects -> arbitrary commands on the host

The rating was 9.8 in the Backstage context (the underlying vm2 flaw scored a perfect 10.0), and the kicker was operational: Backstage's APIs were available without authentication by default — Oxeye found internet-exposed instances that required no auth at all, making the RCE pre-auth in practice. Backstage shipped v1.5.1 a day after vm2's own patch. When exploit details went public in November 2022, the standing advice was to be on v1.7.2. The structural lesson survived the patch: a portal that executes templates from arbitrary sources is a code-execution surface, and "we sandbox it" is only as strong as the sandbox library du jour. In June 2023 Backstage switched to isolated-vm — after vm2 3.9.19 hit npm (May 16, 2023) carrying the notice "The maintenance of the project has been discontinued," the final straw after a string of further escapes.

2. The backend-system demolition (2024) — a rewrite taxed to the adopters

Backstage's old backend system — plugins exporting a createRouter — was the architectural debt the project decided to burn down in public. v1.27.0 (May 2024) started deprecating @backstage/backend-common utilities wholesale, with the stated long-term goal of removing the package entirely. The stable release landed in v1.31.0 (September 2024): the New Backend System hit 1.0, and PR #26383 marked "the end of the old backend system based on createRouter exports." Legacy support was deprecated across all plugin packages with removal scheduled by the end of 2024.

For greenfield adopters this was an upgrade. For everyone with custom backend plugins — the exact adopters Backstage's plugin model had encouraged to build them — this was a forced rewrite of the most delicate code they owned, on the project's timeline, not theirs. The pattern repeated in 2025 with the New Frontend System reaching "adoption-ready" in August. Backstage's honest answer to "why is maintenance so expensive?" is that the framework's own evolution requires you to keep paying — a point we make in detail in The Backstage Trap.

3. The TCO crisis (2022–present) — the market built around the difficulty

By late 2022, Gartner was flagging the effort required to stand up and maintain Backstage, and an entire commercial category had formed around the pain. Roadie's founding story is literally titled "From a Spreadsheet and a $2M Bill" — companies standing up Backstage and discovering it "eats up way more engineering time than they expected." Roadie was founded in 2020, the year of the open-sourcing, by a team whose CTO, Martina Iglesias Fernández, had built the internal version of Backstage at Spotify. Red Hat joined the community in October 2022 and productized Red Hat Developer Hub, a supported Backstage distribution. The honest summary: Backstage is a framework you staff, not a product you buy — and the ecosystem of managed wrappers exists precisely because that distinction surprised people. Our own Backstage alternatives guide and IDP vendor landscape map who sells the way out.

4. The open-core squeeze (2022–present) — the steward sells the managed version

Spotify's commercial arc is the most structurally interesting part of this story, because the entity donating the project and the entity monetizing it are the same company. The paid Spotify Plugins for Backstage bundle (Soundcheck, RBAC, Skill Exchange, Insights) launched in December 2022. Then came Spotify Portal for Backstage — first as a beta in February 2025 ("Backstage in a box"), GA October 2025 with SOC 2 compliance, a Catalog Wizard, plugin installer, Scaffolder Workflows, and an agentic assistant (AiKA) with MCP server support. PagerDuty publicly switched to Portal in June 2025; 2K Games adopted after GA.

flowchart TD
    OSS["Backstage OSS core - CNCF Incubating since 2022-03-15"]
    SPOT["Spotify for Backstage"]
    PORTAL["Portal for Backstage - managed IDP, SOC 2"]
    BUNDLE["Plugins bundle - Soundcheck, RBAC, Insights, AiKA"]
    ROADIE["Roadie - managed Backstage SaaS"]
    RHDH["Red Hat Developer Hub - supported distro"]
    OSS -->|"steward monetizes"| SPOT
    SPOT --> PORTAL
    SPOT --> BUNDLE
    OSS -->|"third parties wrap"| ROADIE
    OSS --> RHDH

The open-core question writes itself: when the AI-era features — the Actions Registry, agentic workflows, MCP integrations announced for the "AI-Native Backstage" — show up first in the paid bundle and the managed portal, the free framework's maintainers are also its competitors' supplier. So far Spotify has kept the split reasonably clean (the CNCF project keeps shipping catalog, scaffolder, and TechDocs improvements on a steady cadence — v1.55.0 in September 2026, v1.56 prereleases rolling now), but the incentive structure is permanent, and platform teams should read every "Spotify for Backstage" launch through it.

Community Engine & Corporate Influence: Who Actually Built It

The core maintainers are Spotify veterans: Patrik Oldsberg (rugvip) — first public committer, bio simply "Maintainer of @Backstage" — and Stefan Ålund, author of the launch announcement, anchor the project's Spotify lineage. Camila Belo (camilaibs) drove the New Backend System to its 1.0 in 2024, closing the meta issue in September of that year. The surrounding cast is the interesting part: the ecosystem's most visible commercial founder, Roadie CTO Martina Iglesias Fernández, is an ex-Spotify engineer who worked on the internal portal before it was ever open-sourced.

External contribution arrived fast and stayed. By the September 2020 CNCF sandbox announcement, roughly 40% of pull requests were already coming from outside Spotify — Matthew Clarke (infrastructure, Spotify) and external contributors were landing Kubernetes and catalog features in the project's first months. By March 2024, Taylor Dolezal told the KubeCon Paris mainstage that Backstage had been the top CNCF project by end-user commits for several months — the metric that separates "vendor project with users" from "user project." The public ADOPTERS.md and the Journey timeline name the weight class: Zalando, Expedia Group, Netflix, PagerDuty, HBO Max, HP, VMware, IKEA, Snyk, LinkedIn, Mercedes-Benz, P&G, Fidelity, Unity, and Epic Games all adopted by end of 2022.

PlayerWhat they actually sellRelationship to the OSS core
Spotify for BackstagePortal (managed IDP, SOC 2), paid plugin bundle, enterprise supportSteward and monetizer — same company, two hats
RoadieManaged Backstage SaaS; repositioned in 2026 as "engineering context for AI agents"First commercial wrapper, founded 2020 by ex-Spotify hands
Red Hat Developer HubSupported Backstage distribution with enterprise lifecycleRed Hat joined the community October 2022, then productized

The governance layer matured in step: CNCF Sandbox (September 2020) → Incubator (March 2022, TOC vote) → the Certified Backstage Associate certification (November 2024, with Linux Foundation Education) and the first ContribFest at KubeCon Salt Lake City the same month. Graduation remains the open question — incubating since 2022 is a long runway for a project this size, and the dual commercial interest gives the TOC a genuinely hard governance puzzle.

Current Trajectory: The Verdict

Backstage won the framework war and lost the product war, on purpose. It is the structurally correct answer to IDP chaos — a catalog, a scaffolder, docs, and a plugin surface that 3,400+ adopters now standardize on — and it remains a framework in the most literal sense: 34,570 stars, 7,666 forks, and a v1.55/v1.56 release cadence that keeps the core honest. But every hard part of running it — the upgrade waves (backend system rewrite, then frontend system), the plugin maintenance treadmill, the security surface that comes from executing untrusted templates — has been converted by its own steward and third parties into a product you can simply buy: Portal, Roadie, or Red Hat Developer Hub.

The 2026 inflection is AI. The "AI-Native Backstage" track (Actions Registry, MCP server support, agentic AiKA) and Roadie's full repositioning as "engineering context for AI agents" say the quiet part loud: the next IDP battle is over whose portal feeds your coding agents trustworthy service context. Backstage's entity model is unusually well-positioned for that — a catalog is exactly the structured context layer an agent needs — which is precisely why the steward is shipping the agentic features into the commercial bundle first.

Verdict: if you're a platform team with engineering capacity and strong opinions, Backstage remains the honest default — nothing else has its ecosystem gravity, and the CNCF governance plus 250+ plugins are real moats against vendor lock-in. If you're a 20-engineer shop shopping for a portal, the framework is a trap we've documented before: buy the managed version (Portal, Roadie, or RHDH) or skip the category entirely. Watch two things going forward: whether incubation converts to graduation, and whether the AI-era features land in the OSS core or stay paid-first — that split is where this project's soul gets decided.