Heroku Fir: The Kubernetes-Native Successor Nobody Outside Enterprise Can Use

Heroku spent more than a year rewriting its runtime from the ground up — Kubernetes underneath, Cloud Native Buildpacks producing OCI images, OpenTelemetry wired in natively. Then it locked the result behind a price floor most of its own developer base will never clear.

Here's the shape of that gate, and what the same architecture costs when nobody's gating it:

That's not a rounding error, and it's not the whole story either — the enterprise price also buys things a bare cluster doesn't, covered honestly further down. But the architecture itself — Kubernetes, OCI, git-push — is identical on both sides of that table. One side requires an enterprise contract to touch. The other requires a credit card and an afternoon.

What Fir Actually Is​

Fir is Heroku's first genuine architecture change since Cedar shipped in 2011. Cedar was a fleet of dynos — lightweight containers scheduled by Heroku's own orchestrator, built from a bespoke buildpack format, logged over syslog. It was good enough to define an entire category of developer experience, and it's still what almost every Heroku app runs on today.

Fir replaces the orchestrator with Kubernetes. That's the load-bearing change; everything else follows from it:

The buildpack change matters more than it looks. Heroku invented the buildpack contract in 2011 — detect the language, build it, run it — and that contract became the industry standard via Cloud Native Buildpacks, the CNCF-hosted spec that Google, Pivotal, and Paketo all build on. Fir doesn't just keep that contract alive; it outputs a portable, standards-compliant OCI image instead of a Heroku-proprietary slug. Run the same CNB build outside Heroku, on any Kubernetes cluster, and you get the identical artifact. That portability is the whole reason this comparison is possible at all.

OpenTelemetry is the second real change: traces, metrics, and logs now flow through a standard collector instead of a proprietary log stream, which is what lets Fir promise that "all data stays in the region where the app runs" — a compliance claim Cedar's syslog pipeline couldn't make as cleanly.

Everything else in that table — new dyno sizes, IPv6, ARM — is downstream of "we now run on Kubernetes," not a separate achievement.

The Paywall, Itemized​

Fir went generally available on April 14, 2025 — over a year before this post, not the "reached GA in 2026" some coverage implies; what shipped in 2026 was more dyno types and the Heroku-26 stack, not the platform's GA milestone itself. It has been available for exactly one deployment target since day one: Fir Private Spaces, a feature restricted to verified Heroku Teams and Heroku Enterprise accounts. As of mid-2026, Heroku's own Generations documentation still lists Common Runtime — the tier every free-tier and hobby developer actually uses — as "to be added," with no committed date.

The price of admission to that Private Space, independent of anything you actually deploy, runs approximately $1.39/hour for a Standard space, which caps around $1,000/month. A Shield space — Heroku's compliance-hardened tier — caps around $3,000/month. That's the fee for the space itself: before a single dyno-hour, before a database, before a line of your application runs inside it. A regulated app on Shield with otherwise modest requirements routinely lands in the $2,000–3,000/month range once dynos and add-ons are layered on top.

Put plainly: the only way to run a Cloud Native Buildpack, get native OpenTelemetry traces, or touch Kubernetes-backed infrastructure on Heroku is to first clear a four-figure monthly floor that has nothing to do with your workload's size. A solo developer running one web dyno and one worker has no path to Fir at any price — the gate is the contract type, not the bill.

The Same Quarter It Was Built, It Was Frozen​

Here's the part that makes the gating sting more than ordinary enterprise pricing usually does: the architecture that took Heroku roughly a year and a half to build barely got a runway before its own parent company stopped extending it.

On February 6, 2026, Heroku SVP Nitin Bhat published "An Update on Heroku," announcing a shift to "sustaining engineering" — Salesforce's term for bug-fixes-and-security-patches-only mode. New Enterprise contracts are no longer offered to new customers (existing ones can renew). The stated reason is a strategic pivot toward Agentforce and Salesforce's other AI products; Heroku, in the company's own accounting, is no longer where growth investment goes.

Fir — the very product that requires an Enterprise contract to use — was one of the features that update explicitly named as now effectively frozen, alongside Heroku AI and Postgres Advanced. So the sequence runs: build a genuine Kubernetes-native platform for a year and a half, gate it behind the one contract type that funds new feature work, then stop signing that contract type roughly ten months after the gated product went GA. Whatever runway Fir was going to get to reach Common Runtime, it got noticeably shorter that week.

Kubernetes Underneath Every Git-Push UI​

Fir isn't Heroku discovering something new — it's Heroku arriving somewhere its competitors got to first, and via the same route. Render's control plane runs tenant workloads on Kubernetes underneath its own git-push and buildpack UI. Railway's infrastructure runs on Kubernetes-orchestrated containers behind an equally polished deploy-from-git experience. Coolify, Dokploy, and the newer wave of self-hosted PaaS tools skip Kubernetes in favor of Docker/Swarm specifically because Kubernetes is the default assumption they're deliberately opting out of.

The pattern holds across the category: "git push, get a URL" is a UI decision, not an infrastructure decision. Underneath it, at any real scale, there's a scheduler managing containers across machines — and Kubernetes has become the default answer to what that scheduler is, the same way Linux became the default answer to what the kernel is. Fir is Heroku's version of a convergence every serious hosted PaaS has already made or is actively making. What's unusual isn't the destination — it's that Heroku built the migration and then made the destination enterprise-exclusive.

The Same Stack, Without the Gate​

The three things Fir actually adds — a Kubernetes-backed runtime, an OCI image produced by Cloud Native Buildpacks, and a git-push contract on top of both — aren't proprietary to Heroku. They're open specs and open tooling, and you can run all three today without an Enterprise contract:

Two Hetzner CX22 instances (€3.79/month each, roughly $4) under CAPH gives you a self-healing, declaratively-managed Kubernetes control plane for under $10/month in raw compute — the same primitive Fir charges $1.39/hour to access. Point Paketo at your repository and you get the identical OCI-image build step Fir uses, without a Heroku account of any kind.

What the Enterprise Price Also Buys​

None of that makes the $1,000/month Private Space floor pure markup, and it would be dishonest to pretend otherwise. That price also buys network isolation from every other Heroku customer, compliance postures (Shield's SOC 2 / HIPAA-oriented controls), a support SLA with an actual phone number behind it, and Salesforce's name on a vendor-risk questionnaire — real line items that matter to a regulated enterprise buyer and that a bare CAPH cluster does not hand you by default.

What a self-hosted CAPH cluster does give you, at a fraction of the cost, is architecture-equivalence: the same Kubernetes control plane, the same OCI-image build step, the same git-push contract. It is not compliance-equivalence or support-equivalence — you'd need to build or buy those separately if you need them. But for the very large number of teams who don't need a SOC 2 questionnaire answered, paying an enterprise-contract premium to touch Kubernetes and OpenTelemetry was never buying architecture. It was buying access to architecture that was open-source and self-hostable the entire time.

The Takeaway​

Fir is a real, well-built piece of infrastructure engineering — Heroku's team spent a year and a half getting the Kubernetes migration right, and the OpenTelemetry integration and CNB-native build pipeline are both genuinely good work. But its access model tells you something more useful than its architecture does: when a PaaS finally rebuilds itself on Kubernetes, that capability tends to get sold back to customers as a premium tier rather than passed through as a platform improvement, and it's always the same three primitives — a scheduler, a build-to-image pipeline, a git-push contract — no matter which vendor is doing the gating.

Those three primitives are open specs with mature open-source implementations. You don't need to wait for Heroku's Common Runtime timeline, and you don't need an Enterprise contract to get there first.

Bex.co is the open-source, AI-native Render alternative — push a git repo, get a running HTTPS service on machines you own, built on the same Kubernetes-plus-git-push contract Fir just spent a year rebuilding behind a paywall. Star the repo on GitHub or deploy your first app today.

Sources​

• Planting New Platform Roots in Cloud Native with Fir — Heroku
• Fir: Heroku's next generation platform is now generally available — Heroku Dev Center changelog
• Heroku Generations — Heroku Dev Center
• Heroku Private Spaces — Heroku Dev Center
• Migrating Apps From a Cedar Private Space to a Fir Private Space — Heroku Dev Center
• An Update on Heroku — Heroku
• Heroku future in doubt as Salesforce freezes features to focus on AI — DevClass
• Cluster API Provider Hetzner — GitHub