Protecting NATS and the integrity of open source(cncf.io)
cncf.io
Protecting NATS and the integrity of open source
https://www.cncf.io/blog/2025/04/24/protecting-nats-and-the-integrity-of-open-source-cncfs-commitment-to-the-community/
44 comments
I worked (briefly) at Apcera as well and on the NATS team as a core contributor on the project. I sympathize because it is really difficult to build a viable business around OSS. But the move to contribute it to CNCF, which put it on a stage that it simply never would have had without the foundation, and now trying to withdraw it because it is still a fledgling project is just not a good look.
The irony is how would this have played out if it _did_ turn into a thriving project under CNCF? In that scenario, the NATS brand would have substantially more value and equity. That would have made a relicensing even more impactful, made it even more difficult to claw back from CNCF, and even more controversial. Because NATS remains relatively niche, I suspect the thinking is that not enough people will really care for it to matter, but if that's the case, why not just make a proprietary fork under a new name?
I don't know how this situation doesn't result in a fork. Either the BSL will be a fork or the OSS will be a fork. But because nearly all of the contributors are Synadia employees, I don't know what this will mean for the longevity of the project.
The irony is how would this have played out if it _did_ turn into a thriving project under CNCF? In that scenario, the NATS brand would have substantially more value and equity. That would have made a relicensing even more impactful, made it even more difficult to claw back from CNCF, and even more controversial. Because NATS remains relatively niche, I suspect the thinking is that not enough people will really care for it to matter, but if that's the case, why not just make a proprietary fork under a new name?
I don't know how this situation doesn't result in a fork. Either the BSL will be a fork or the OSS will be a fork. But because nearly all of the contributors are Synadia employees, I don't know what this will mean for the longevity of the project.
I just finished rearchitecting a core service at work to use NATS for distributed state. Really unsure about the viability of NATS as an open source product if Synadia stops contributing. It's making me reconsider our architecture change, maybe we should stick with a more stable (albeit less aligned) alternative.
summarising some context for folks;
From Synadia's Cease and Demand Letter:
> As should be clear, the NATS.io project has failed to thrive as a CNCF project, with essentially all growth of the project to date arising from Synadia’s efforts and at Synadia’s expense. It is for this reason that Synadia requests to end its relationship with the Foundation and receive full control of the nats.io domain name and Github repository within two weeks.
From Synadia's exit proposal:
> We propose that NATS.io exit from the CNCF Foundation effective immediately... Upon leaving CNCF, Synadia will adopt the Business Source License (BSL) for the NATS.io server... specific use cases (such as offering NATS as a managed service or integrating it into specific commercial offerings) will require a commercial license.
From CNCF's response:
> Let's be clear: this is not a typical license change or fork. It's an attempt to "take back" a mature, community-driven open source project and convert it into a proprietary product—after years of growth and collaboration under open governance and CNCF's stewardship.
Primary sources:
- Synadia's Cease and Demand Letter: https://github.com/cncf/foundation/blob/main/documents/nats/...
- Synadia's Exit Proposal: https://github.com/cncf/foundation/blob/main/documents/nats/...
- CNCF's Response: https://www.cncf.io/blog/2025/04/24/protecting-nats-and-the-...
summarising some context for folks;
From Synadia's Cease and Demand Letter:
> As should be clear, the NATS.io project has failed to thrive as a CNCF project, with essentially all growth of the project to date arising from Synadia’s efforts and at Synadia’s expense. It is for this reason that Synadia requests to end its relationship with the Foundation and receive full control of the nats.io domain name and Github repository within two weeks.
From Synadia's exit proposal:
> We propose that NATS.io exit from the CNCF Foundation effective immediately... Upon leaving CNCF, Synadia will adopt the Business Source License (BSL) for the NATS.io server... specific use cases (such as offering NATS as a managed service or integrating it into specific commercial offerings) will require a commercial license.
From CNCF's response:
> Let's be clear: this is not a typical license change or fork. It's an attempt to "take back" a mature, community-driven open source project and convert it into a proprietary product—after years of growth and collaboration under open governance and CNCF's stewardship.
Primary sources:
- Synadia's Cease and Demand Letter: https://github.com/cncf/foundation/blob/main/documents/nats/...
- Synadia's Exit Proposal: https://github.com/cncf/foundation/blob/main/documents/nats/...
- CNCF's Response: https://www.cncf.io/blog/2025/04/24/protecting-nats-and-the-...
Two points:
From the exit proposal: "Over 97% of contributions to the NATS.io server were made by employees of Synadia and its predecessor company".
Also, when they applied for graduation in 2018, they were told no because most of the contributors work for Synadia (https://github.com/cncf/toc/pull/168). As of now 7 years later, it's still not graduated by CNCF. At this point it likely never will.
Putting yourself in their shoes, are your surprised they want to take it back from CNCF?
From the exit proposal: "Over 97% of contributions to the NATS.io server were made by employees of Synadia and its predecessor company".
Also, when they applied for graduation in 2018, they were told no because most of the contributors work for Synadia (https://github.com/cncf/toc/pull/168). As of now 7 years later, it's still not graduated by CNCF. At this point it likely never will.
Putting yourself in their shoes, are your surprised they want to take it back from CNCF?
at the same time, in the graduation application, they seemed to strongly argue that they didnt even want outside contributors - saying that having community-developed client libraries and a synadia-developed core server was both proof of broad adoption and reason for future stability.
not surprised, I agree the decision makes sense for them.
It's just an unfortunate situation for the community. We don't know what the BUSL license would entail, and an open-source fork is unlikely to receive a lot of contribution (if historical contribution data is anything to judge by)
[deleted]
Thank you for pointing to those sources.
While I regret Synadia decision to change the license I have to admit just reading the CNCF reponse was very very misleading.
Ok Synadia says they were not happy with the CNCF collaboration. In the end they were paying for this membership and their services.
So I went and looked at the various member benefits and it doesn't sound really attracting to me [0] The most valuable thing seems to be in their "landscape". They are basically selling brand promotion.
Then you probably have a lot of politics dominated by their Platinium members: Alibaba, Amazon, Apple, Boeing, IBM, Huawei, Microsoft, SAP, Oracle, etc.
CNCF doesn't work for the community, they work for their (Platinium) members. Synadia works for its investors and they decided to change course (regrettably).
The code under Apache License 2.0 is available on the internet, if it is valuable some people will fork and maintain it. But it is not gonna be the CNCF and its staff.
- [0] https://www.cncf.io/about/join/
While I regret Synadia decision to change the license I have to admit just reading the CNCF reponse was very very misleading.
Ok Synadia says they were not happy with the CNCF collaboration. In the end they were paying for this membership and their services.
So I went and looked at the various member benefits and it doesn't sound really attracting to me [0] The most valuable thing seems to be in their "landscape". They are basically selling brand promotion.
Then you probably have a lot of politics dominated by their Platinium members: Alibaba, Amazon, Apple, Boeing, IBM, Huawei, Microsoft, SAP, Oracle, etc.
CNCF doesn't work for the community, they work for their (Platinium) members. Synadia works for its investors and they decided to change course (regrettably).
The code under Apache License 2.0 is available on the internet, if it is valuable some people will fork and maintain it. But it is not gonna be the CNCF and its staff.
- [0] https://www.cncf.io/about/join/
If you read the letter from Synadia to the CNCF committee [1], the license change and taking control back to commercialize NATS is the entire reason for the change.
It's not because they're unhappy about the CNCF or that they're not getting their money's worth; that is at best a red herring. If they genuinely thought the CNCF's governance was lacking, there are ways for them to take steps to improve the situation without a license change.
But that's not what they're doing. They cannot continue at the CNCF if NATS is turned into a proprietary product.
All the lofty words about a strong commitment to open source has no merit now. If they were committed to open source, they would stay with the CNCF.
I wish companies had the courage to be forthright: Synadia gave something away for free, they now regret that nobody is paying what they think they deserve, and they want the money. It's as simple as that. Those goals — at least in terms of the chosen strategy — are not compatible with open source, and they might as well admit it.
[1] https://github.com/cncf/foundation/blob/main/documents/nats/...
It's not because they're unhappy about the CNCF or that they're not getting their money's worth; that is at best a red herring. If they genuinely thought the CNCF's governance was lacking, there are ways for them to take steps to improve the situation without a license change.
But that's not what they're doing. They cannot continue at the CNCF if NATS is turned into a proprietary product.
All the lofty words about a strong commitment to open source has no merit now. If they were committed to open source, they would stay with the CNCF.
I wish companies had the courage to be forthright: Synadia gave something away for free, they now regret that nobody is paying what they think they deserve, and they want the money. It's as simple as that. Those goals — at least in terms of the chosen strategy — are not compatible with open source, and they might as well admit it.
[1] https://github.com/cncf/foundation/blob/main/documents/nats/...
> Ok Synadia says they were not happy with the CNCF collaboration. In the end they were paying for this membership and their services.
So they can leave, and make their own fork of the project.
When they joined the CNCF, they agreed to give control of the project to the CNCF, and a big reason for that is to give users of the project assurance that the license won't change if the vendor decides it doesn't want the project to be open source anymore. If a company can change its mind and claw back a project, that undermines the purpose of the CNCF.
Also, membership in CNCF is distinct from having a project contributed to CNCF. As far as I know, there is no requirement that you be a member of the CNCF to submit a project to the organization. And I don't think you have to contribute a project in order to be get membership.
So they can leave, and make their own fork of the project.
When they joined the CNCF, they agreed to give control of the project to the CNCF, and a big reason for that is to give users of the project assurance that the license won't change if the vendor decides it doesn't want the project to be open source anymore. If a company can change its mind and claw back a project, that undermines the purpose of the CNCF.
Also, membership in CNCF is distinct from having a project contributed to CNCF. As far as I know, there is no requirement that you be a member of the CNCF to submit a project to the organization. And I don't think you have to contribute a project in order to be get membership.
The thing is, Synadia has made 97% of the contributions. So they essentially own the copyright to the entire project and the CNCF hasn't helped them to build a community of developers and software support.
There's a balance to be struck here, but, given that there are not really any users of NATS that are contributing back to the community. It seems very reasonable to me that NATS should be able to relicense their software, and it won't affect any of their commercial users. Free users can be transitioned to a trial license, and the impact from the transition will be minimal.
There's a balance to be struck here, but, given that there are not really any users of NATS that are contributing back to the community. It seems very reasonable to me that NATS should be able to relicense their software, and it won't affect any of their commercial users. Free users can be transitioned to a trial license, and the impact from the transition will be minimal.
[deleted]
The branding comes from the graduation process. If a project can navigate its way through graduation, then you can be reasonably sure it will continue to stay alive for a few more years even if a particular company pulls out.
NATS has basically failed as a community developed project, what's left is whether it's allowed to rug pull the brand.
NATS has basically failed as a community developed project, what's left is whether it's allowed to rug pull the brand.
I have always had the impression that the CNCF was founded as a kind of demilitarized zone for large companies to collaborate on big projects.
Having governance and contributions all recorded in the public domain, and the software licensed so that it is free means that the big firms limit the risk of IP infringement and they can control the size of their financial investment to be proportional to their financial benefit.
In Kubernetes related projects for instance, I've seen sensible bug reports asking for features that have been rejected not because of a lack of sponsors, or lack of resources, or lack of expertise, but because it doesn't fit into the projects goals or roadmap. Responses like that never made me feel that these projects were particularly ”open".
Having governance and contributions all recorded in the public domain, and the software licensed so that it is free means that the big firms limit the risk of IP infringement and they can control the size of their financial investment to be proportional to their financial benefit.
In Kubernetes related projects for instance, I've seen sensible bug reports asking for features that have been rejected not because of a lack of sponsors, or lack of resources, or lack of expertise, but because it doesn't fit into the projects goals or roadmap. Responses like that never made me feel that these projects were particularly ”open".
Here is our official response. We also plan to have a public AMA early next week for anyone interested.
https://www.synadia.com/blog/synadia-response-to-cncf
https://www.synadia.com/blog/synadia-response-to-cncf
As someone that recently started trial-running a NATS cluster, this move by Synadia that I just learned of has made sure that I won't continue on with NATS.
> Over 97% of contributions to the NATS.io server were made by employees of Synadia and its predecessor company
Seems like a failed CNCF project. I guess synadia can fork nats and build their own, but the CNCF nats would basically lose all the contributors so what is the point of keeping the trademark?
A good warning for those looking at CNCF projects to audit where the commits are coming from. I passed up using mayastor/OpenEBS, and one of the main reasons was that almost 100% of the commits were from a single for-profit company who could just bail on the project at any time. I ended up going with Rook which has a much healthier spread of commiters.
Seems like a failed CNCF project. I guess synadia can fork nats and build their own, but the CNCF nats would basically lose all the contributors so what is the point of keeping the trademark?
A good warning for those looking at CNCF projects to audit where the commits are coming from. I passed up using mayastor/OpenEBS, and one of the main reasons was that almost 100% of the commits were from a single for-profit company who could just bail on the project at any time. I ended up going with Rook which has a much healthier spread of commiters.
That doesn't provide that much clarity to me (a user of NATS).
This is something that has never happened before.
When you need open source for promotion and fundraising, you embrace open source; when you want to make money, you kick open source to the curb.
That's what we see.
There is a need for a funding base especially when a project grows beyond a single person and needs a team to be maintained.
Either this “somehow” comes from the community or it comes from the investors. If it’s the latter then eventually the pull is more towards revenue.
Either this “somehow” comes from the community or it comes from the investors. If it’s the latter then eventually the pull is more towards revenue.
Synadia was clearly open to being supported by community contributions. But since no-one who used NATS wanted to maintain NATS, a decision has to be made about how to support the project in the long-term.
Very interesting.
NATS is really a great platform but I was always had my reservations regarding its viability as an open source project.
The end of the era of abundance in tech is really having an impact on open source.
The problem here is while one would obviously side with the CNCF taking action and fighting for the trademark, it doesn't really matter at the end. Either there are people willing to maintain the code or it will die as an open source project.
NATS is really a great platform but I was always had my reservations regarding its viability as an open source project.
The end of the era of abundance in tech is really having an impact on open source.
The problem here is while one would obviously side with the CNCF taking action and fighting for the trademark, it doesn't really matter at the end. Either there are people willing to maintain the code or it will die as an open source project.
Die, how? It's a vibrant project with 5.9k stars, 727 forks, 132 contributors:
https://github.com/nats-io/nats.go
Yes, the legal fight may end up permitting the clawback of the trademark, in which case the project will carry on under a different name and repo. But that's not death, that's fork.
The source is out of the bag under Apache 2.0 and there's no putting that back in the bottle.
Yes, the legal fight may end up permitting the clawback of the trademark, in which case the project will carry on under a different name and repo. But that's not death, that's fork.
The source is out of the bag under Apache 2.0 and there's no putting that back in the bottle.
> 5.9k stars, 727 forks, 132 contributors: https://github.com/nats-io/nats.go
That's the NATS Go _client_.
The server project is https://github.com/nats-io/nats-server 17k stars, 1.5k forks, 160 contributors
That's the NATS Go _client_.
The server project is https://github.com/nats-io/nats-server 17k stars, 1.5k forks, 160 contributors
Look at the contribution history, basically all active contributors work for Synadia: https://github.com/nats-io/nats-server/graphs/contributors
That's not a healthy / functioning open source community. Less than 30 people have made more than 10 commits; most of the 160 were "drive by" who fixed a single small thing.
That's not a healthy / functioning open source community. Less than 30 people have made more than 10 commits; most of the 160 were "drive by" who fixed a single small thing.
Good point!
On the face of it, that sounds healthy. But dig in further, and you discover that only the top 10 or so contributors have enough activity to make their personal contribution graph anything other than a flat line on zero.
The vast majority of the work here is being done by a very small group of people - likely those paid by the commercial sponsor (a random sample of the top few suggest that well over half of those top contributors fall into that category).
If those people aren't paid to work on the project any more, it will likely die very quickly.
The vast majority of the work here is being done by a very small group of people - likely those paid by the commercial sponsor (a random sample of the top few suggest that well over half of those top contributors fall into that category).
If those people aren't paid to work on the project any more, it will likely die very quickly.
> On the face of it, that sounds healthy. But dig in further, and you discover that only the top 10 or so contributors have enough activity to make their personal contribution graph anything other than a flat line on zero.
This is something I always do manually and it is annoying. The number of contributors we see on the front page of a project on Github is misleading and can easily be faked by a malicious actor because a user who corrected a typo 5 years ago is counted as a contributor.
Github should really improve that.
This is something I always do manually and it is annoying. The number of contributors we see on the front page of a project on Github is misleading and can easily be faked by a malicious actor because a user who corrected a typo 5 years ago is counted as a contributor.
Github should really improve that.
I would wonder if paying for a legal fight to recapture the trademark is even worth it.
Couldn't Synadia just fork what they want to and rebrand for a commercial new product, and go forward from there?
If they wanted to backport or keep contributing to the open source project they could, or leave some parts open source going forward, while forking only the server for example, to do that.
Kind of like how RHEL used to still provide contributions to CentOS for a long time (although I think that ended at some point too).
Couldn't Synadia just fork what they want to and rebrand for a commercial new product, and go forward from there?
If they wanted to backport or keep contributing to the open source project they could, or leave some parts open source going forward, while forking only the server for example, to do that.
Kind of like how RHEL used to still provide contributions to CentOS for a long time (although I think that ended at some point too).
> Kind of like how RHEL used to still provide contributions to CentOS for a long time (although I think that ended at some point too).
RHEL contributes to CentOS now more than ever.
CentOS started outside of Red Hat (2003), and didn't get any direct contributions from Red Hat. It built from RHEL sources, which is an indirect contribution that didn't involve any Red Hat employees. Later Red Hat hired most of the CentOS maintainers (2014), and contributed to CentOS by paying their salaries and providing hardware resources, but that was where the contributions ended. This was the status quo until 2021, which is when RHEL maintainers were onboarded to CentOS, drastically increasing the number of people working on CentOS.
RHEL contributes to CentOS now more than ever.
CentOS started outside of Red Hat (2003), and didn't get any direct contributions from Red Hat. It built from RHEL sources, which is an indirect contribution that didn't involve any Red Hat employees. Later Red Hat hired most of the CentOS maintainers (2014), and contributed to CentOS by paying their salaries and providing hardware resources, but that was where the contributions ended. This was the status quo until 2021, which is when RHEL maintainers were onboarded to CentOS, drastically increasing the number of people working on CentOS.
I was not up to speed, there seemed to be a period of time when CentOS support was dwindling and it even looked like the project might no longer have upstream support.
Regardless of the complex history of CentOS, RHEL, etc it seems like the original thrust of CentOS lives on rebranded as RockyLinux for example.. and CentOS stream serves Redhat's needs/purposes.
I think forking still is a valid method to resolving challenges for NATS here.
Regardless of the complex history of CentOS, RHEL, etc it seems like the original thrust of CentOS lives on rebranded as RockyLinux for example.. and CentOS stream serves Redhat's needs/purposes.
I think forking still is a valid method to resolving challenges for NATS here.
I only use NATS as part of my home automation architecture but I have found it very nice to use and would have been happy to use it at work if we weren't so entrenched in AWS proprietary services.
I wonder if they are hoping to become more of a platform and leverage NEX to sell edge functions like cloudflare, bunny.net, etc are doing?
I wonder if they are hoping to become more of a platform and leverage NEX to sell edge functions like cloudflare, bunny.net, etc are doing?
I'm not against this kind of move (Synadia's) by itself, but it seems too early. I've been following NATS for some time, and undeservedly, it hasn't taken off. I could find only two books; documentation is clean but I think it could be improved; blog posts, tutorials, videos are few and sparse in time; community tools are nil (from what I could find). A non-open source license is going to restrict adoption even more.
I recommended it to my clients every time it looked like a solution to the problem, but never been able to convince, due to the lack of community or big cloud sponsorship/offerings.
I recommended it to my clients every time it looked like a solution to the problem, but never been able to convince, due to the lack of community or big cloud sponsorship/offerings.
I think NATS is definitely popular. What is your standard for "taken off", though?
One thing I've learned in my career is that the field is broken into many smaller "bubbles". There is lots of software that flies under the radar if you're not inside the right bubble. Blogs and books aren't necessarily an accurate measurement of how healthy an open source project is.
Sure, there may be less noise around NATS than, say, Kafka. But there could be other explanations for that. From my perspective NATS is one of those well-engineered workhorse technologies that get the job without fuss or hype or (until now) drama. Some tools are just quiet because people are getting stuff done with it. I'm willing to bet it's got decent adoption in Fortune 500 companies.
I don't have any hard numbers. But if you wander into the NATS community Slack, for example (which isn't easy to find, admittedly!), you'll find that it's quite active compared to many other open source projects. Looking at Docker Hub, NATS has very healthy stats, beating prominent projects like Cassandra in terms of absolute pulls, and not far from Kafka.
One thing is certain, Synadia is not going to make NATS more popular by moving to a proprietary license.
One thing I've learned in my career is that the field is broken into many smaller "bubbles". There is lots of software that flies under the radar if you're not inside the right bubble. Blogs and books aren't necessarily an accurate measurement of how healthy an open source project is.
Sure, there may be less noise around NATS than, say, Kafka. But there could be other explanations for that. From my perspective NATS is one of those well-engineered workhorse technologies that get the job without fuss or hype or (until now) drama. Some tools are just quiet because people are getting stuff done with it. I'm willing to bet it's got decent adoption in Fortune 500 companies.
I don't have any hard numbers. But if you wander into the NATS community Slack, for example (which isn't easy to find, admittedly!), you'll find that it's quite active compared to many other open source projects. Looking at Docker Hub, NATS has very healthy stats, beating prominent projects like Cassandra in terms of absolute pulls, and not far from Kafka.
One thing is certain, Synadia is not going to make NATS more popular by moving to a proprietary license.
On the other hand, if they're pouring money into a project that doesn't make them enough money to make it worthwhile, that does seem unsustainable. Maybe NATS should get less popular but become an option in EKS/AKS/GKE that Synadia runs.
The sustainability of open source doesn't seem to come down to whether the product is open source or not.
As an example, Elastic was a $10B company in 2021 — the year they went dual license — with revenue of around $500-600m. They showed that you can build a huge business on something that's given away for free. I don't know anything about Synadia's financials. It's possible they're successful, but simply want more. It's possible they've not been able to build a sustainable business on NATS. Their commercial offering is basically support plus a closed-source control plane, which isn't exactly a big carrot when the alternative is $0.
I also wonder if there's any VC pressure happening here that could explain the sudden shift. Synadia raised $25m in 2024, and it may be that, one year later, the investors just aren't seeing the progress they were expecting.
As an example, Elastic was a $10B company in 2021 — the year they went dual license — with revenue of around $500-600m. They showed that you can build a huge business on something that's given away for free. I don't know anything about Synadia's financials. It's possible they're successful, but simply want more. It's possible they've not been able to build a sustainable business on NATS. Their commercial offering is basically support plus a closed-source control plane, which isn't exactly a big carrot when the alternative is $0.
I also wonder if there's any VC pressure happening here that could explain the sudden shift. Synadia raised $25m in 2024, and it may be that, one year later, the investors just aren't seeing the progress they were expecting.
Maybe - I wasn't making a point about open source particularly. But you can also have a few unusual examples in times of zero interest rates and they don't necessarily make useful reference points. Only the people in charge will know the whole story and how it relates to their company.
ugh... Yet another rug pull of beloved software that so many people have based their projects - and, in this case, entire architecture - on... Hopefully CNCF will prevail - most notably in creating a viable OSS team around it, as happened with Redis -> Valkey etc...
I am confused because:
- Valkey [0] is a project of the Linux Foundation
- CNCF is part of the Linux Foundation
- The CNCF landscape includes Redis [1] but not Valkey
Do someone understand their logic?
- [0] https://valkey.io/
- [1] https://landscape.cncf.io/?item=app-definition-and-developme...
- Valkey [0] is a project of the Linux Foundation
- CNCF is part of the Linux Foundation
- The CNCF landscape includes Redis [1] but not Valkey
Do someone understand their logic?
- [0] https://valkey.io/
- [1] https://landscape.cncf.io/?item=app-definition-and-developme...
nobody bothered to submit it https://github.com/cncf/landscape/pulls
They actually explicitly allow adding closed source projects to the landscape.
https://github.com/cncf/landscape?tab=readme-ov-file#new-ent...
https://github.com/cncf/landscape?tab=readme-ov-file#new-ent...
See also the issue: https://github.com/nats-io/nats-server/issues/6832
Archived version: https://web.archive.org/web/20250425154144/https://github.co...
[deleted]
I think nats is a great technology for a number of use cases. It's unfortunate that it's so hard to find the resources to support and maintain open source software while paying developer salaries.
Derek put a ton of work, effort, and money into NATS.
It's a sad story to me; I don't know what the answer is to these sorts of "tragedy of the commons" type issues are.