Protecting NATS and the integrity of open source
cncf.io
cncf.io
I think nats is a great technology for a number of use cases. It's unfortunate that it's so hard to find the resources to support and maintain open source software while paying developer salaries.
Derek put a ton of work, effort, and money into NATS.
It's a sad story to me; I don't know what the answer is to these sorts of "tragedy of the commons" type issues are.
The irony is how would this have played out if it _did_ turn into a thriving project under CNCF? In that scenario, the NATS brand would have substantially more value and equity. That would have made a relicensing even more impactful, made it even more difficult to claw back from CNCF, and even more controversial. Because NATS remains relatively niche, I suspect the thinking is that not enough people will really care for it to matter, but if that's the case, why not just make a proprietary fork under a new name?
I don't know how this situation doesn't result in a fork. Either the BSL will be a fork or the OSS will be a fork. But because nearly all of the contributors are Synadia employees, I don't know what this will mean for the longevity of the project.
summarising some context for folks;
From Synadia's Cease and Demand Letter:
> As should be clear, the NATS.io project has failed to thrive as a CNCF project, with essentially all growth of the project to date arising from Synadia’s efforts and at Synadia’s expense. It is for this reason that Synadia requests to end its relationship with the Foundation and receive full control of the nats.io domain name and Github repository within two weeks.
From Synadia's exit proposal:
> We propose that NATS.io exit from the CNCF Foundation effective immediately... Upon leaving CNCF, Synadia will adopt the Business Source License (BSL) for the NATS.io server... specific use cases (such as offering NATS as a managed service or integrating it into specific commercial offerings) will require a commercial license.
From CNCF's response:
> Let's be clear: this is not a typical license change or fork. It's an attempt to "take back" a mature, community-driven open source project and convert it into a proprietary product—after years of growth and collaboration under open governance and CNCF's stewardship.
Primary sources:
- Synadia's Cease and Demand Letter: https://github.com/cncf/foundation/blob/main/documents/nats/...
- Synadia's Exit Proposal: https://github.com/cncf/foundation/blob/main/documents/nats/...
- CNCF's Response: https://www.cncf.io/blog/2025/04/24/protecting-nats-and-the-...
From the exit proposal: "Over 97% of contributions to the NATS.io server were made by employees of Synadia and its predecessor company".
Also, when they applied for graduation in 2018, they were told no because most of the contributors work for Synadia (https://github.com/cncf/toc/pull/168). As of now 7 years later, it's still not graduated by CNCF. At this point it likely never will.
Putting yourself in their shoes, are your surprised they want to take it back from CNCF?
While I regret Synadia decision to change the license I have to admit just reading the CNCF reponse was very very misleading.
Ok Synadia says they were not happy with the CNCF collaboration. In the end they were paying for this membership and their services.
So I went and looked at the various member benefits and it doesn't sound really attracting to me [0] The most valuable thing seems to be in their "landscape". They are basically selling brand promotion.
Then you probably have a lot of politics dominated by their Platinium members: Alibaba, Amazon, Apple, Boeing, IBM, Huawei, Microsoft, SAP, Oracle, etc.
CNCF doesn't work for the community, they work for their (Platinium) members. Synadia works for its investors and they decided to change course (regrettably).
The code under Apache License 2.0 is available on the internet, if it is valuable some people will fork and maintain it. But it is not gonna be the CNCF and its staff.
It's not because they're unhappy about the CNCF or that they're not getting their money's worth; that is at best a red herring. If they genuinely thought the CNCF's governance was lacking, there are ways for them to take steps to improve the situation without a license change.
But that's not what they're doing. They cannot continue at the CNCF if NATS is turned into a proprietary product.
All the lofty words about a strong commitment to open source has no merit now. If they were committed to open source, they would stay with the CNCF.
I wish companies had the courage to be forthright: Synadia gave something away for free, they now regret that nobody is paying what they think they deserve, and they want the money. It's as simple as that. Those goals — at least in terms of the chosen strategy — are not compatible with open source, and they might as well admit it.
[1] https://github.com/cncf/foundation/blob/main/documents/nats/...
So they can leave, and make their own fork of the project.
When they joined the CNCF, they agreed to give control of the project to the CNCF, and a big reason for that is to give users of the project assurance that the license won't change if the vendor decides it doesn't want the project to be open source anymore. If a company can change its mind and claw back a project, that undermines the purpose of the CNCF.
Also, membership in CNCF is distinct from having a project contributed to CNCF. As far as I know, there is no requirement that you be a member of the CNCF to submit a project to the organization. And I don't think you have to contribute a project in order to be get membership.
There's a balance to be struck here, but, given that there are not really any users of NATS that are contributing back to the community. It seems very reasonable to me that NATS should be able to relicense their software, and it won't affect any of their commercial users. Free users can be transitioned to a trial license, and the impact from the transition will be minimal.
NATS has basically failed as a community developed project, what's left is whether it's allowed to rug pull the brand.
Having governance and contributions all recorded in the public domain, and the software licensed so that it is free means that the big firms limit the risk of IP infringement and they can control the size of their financial investment to be proportional to their financial benefit.
In Kubernetes related projects for instance, I've seen sensible bug reports asking for features that have been rejected not because of a lack of sponsors, or lack of resources, or lack of expertise, but because it doesn't fit into the projects goals or roadmap. Responses like that never made me feel that these projects were particularly ”open".
Seems like a failed CNCF project. I guess synadia can fork nats and build their own, but the CNCF nats would basically lose all the contributors so what is the point of keeping the trademark?
A good warning for those looking at CNCF projects to audit where the commits are coming from. I passed up using mayastor/OpenEBS, and one of the main reasons was that almost 100% of the commits were from a single for-profit company who could just bail on the project at any time. I ended up going with Rook which has a much healthier spread of commiters.
Either this “somehow” comes from the community or it comes from the investors. If it’s the latter then eventually the pull is more towards revenue.
NATS is really a great platform but I was always had my reservations regarding its viability as an open source project.
The end of the era of abundance in tech is really having an impact on open source.
The problem here is while one would obviously side with the CNCF taking action and fighting for the trademark, it doesn't really matter at the end. Either there are people willing to maintain the code or it will die as an open source project.
Yes, the legal fight may end up permitting the clawback of the trademark, in which case the project will carry on under a different name and repo. But that's not death, that's fork.
The source is out of the bag under Apache 2.0 and there's no putting that back in the bottle.
That's the NATS Go _client_.
The server project is https://github.com/nats-io/nats-server 17k stars, 1.5k forks, 160 contributors
That's not a healthy / functioning open source community. Less than 30 people have made more than 10 commits; most of the 160 were "drive by" who fixed a single small thing.
The vast majority of the work here is being done by a very small group of people - likely those paid by the commercial sponsor (a random sample of the top few suggest that well over half of those top contributors fall into that category).
If those people aren't paid to work on the project any more, it will likely die very quickly.
This is something I always do manually and it is annoying. The number of contributors we see on the front page of a project on Github is misleading and can easily be faked by a malicious actor because a user who corrected a typo 5 years ago is counted as a contributor.
Github should really improve that.
Couldn't Synadia just fork what they want to and rebrand for a commercial new product, and go forward from there?
If they wanted to backport or keep contributing to the open source project they could, or leave some parts open source going forward, while forking only the server for example, to do that.
Kind of like how RHEL used to still provide contributions to CentOS for a long time (although I think that ended at some point too).
RHEL contributes to CentOS now more than ever.
CentOS started outside of Red Hat (2003), and didn't get any direct contributions from Red Hat. It built from RHEL sources, which is an indirect contribution that didn't involve any Red Hat employees. Later Red Hat hired most of the CentOS maintainers (2014), and contributed to CentOS by paying their salaries and providing hardware resources, but that was where the contributions ended. This was the status quo until 2021, which is when RHEL maintainers were onboarded to CentOS, drastically increasing the number of people working on CentOS.
Regardless of the complex history of CentOS, RHEL, etc it seems like the original thrust of CentOS lives on rebranded as RockyLinux for example.. and CentOS stream serves Redhat's needs/purposes.
I think forking still is a valid method to resolving challenges for NATS here.
I wonder if they are hoping to become more of a platform and leverage NEX to sell edge functions like cloudflare, bunny.net, etc are doing?
I recommended it to my clients every time it looked like a solution to the problem, but never been able to convince, due to the lack of community or big cloud sponsorship/offerings.
One thing I've learned in my career is that the field is broken into many smaller "bubbles". There is lots of software that flies under the radar if you're not inside the right bubble. Blogs and books aren't necessarily an accurate measurement of how healthy an open source project is.
Sure, there may be less noise around NATS than, say, Kafka. But there could be other explanations for that. From my perspective NATS is one of those well-engineered workhorse technologies that get the job without fuss or hype or (until now) drama. Some tools are just quiet because people are getting stuff done with it. I'm willing to bet it's got decent adoption in Fortune 500 companies.
I don't have any hard numbers. But if you wander into the NATS community Slack, for example (which isn't easy to find, admittedly!), you'll find that it's quite active compared to many other open source projects. Looking at Docker Hub, NATS has very healthy stats, beating prominent projects like Cassandra in terms of absolute pulls, and not far from Kafka.
One thing is certain, Synadia is not going to make NATS more popular by moving to a proprietary license.
As an example, Elastic was a $10B company in 2021 — the year they went dual license — with revenue of around $500-600m. They showed that you can build a huge business on something that's given away for free. I don't know anything about Synadia's financials. It's possible they're successful, but simply want more. It's possible they've not been able to build a sustainable business on NATS. Their commercial offering is basically support plus a closed-source control plane, which isn't exactly a big carrot when the alternative is $0.
I also wonder if there's any VC pressure happening here that could explain the sudden shift. Synadia raised $25m in 2024, and it may be that, one year later, the investors just aren't seeing the progress they were expecting.
- Valkey [0] is a project of the Linux Foundation
- CNCF is part of the Linux Foundation
- The CNCF landscape includes Redis [1] but not Valkey
Do someone understand their logic?
- [0] https://valkey.io/
- [1] https://landscape.cncf.io/?item=app-definition-and-developme...
https://github.com/cncf/landscape?tab=readme-ov-file#new-ent...