After Cockroach Labs went proprietary, one customer took matters into its own hands

At this point, enterprises that built tech stacks around open-source software over the last decade are used to dealing with a steady parade of changes that restrict how that software can be used. But after Cockroach Labs announced earlier this month that CockroachDB would ditch one of those less-than-open licenses, Oxide Computer Company decided to take a unique approach.

Oxide plans to maintain older versions of CockroachDB that remain available under an open-source license rather than switch databases or sign up for Cockroach's new enterprise service, it announced last week. This plan will require the company to deal with any support issues themselves, including writing patches to fix the inevitable problems that pop up when using software over time, and it will prevent Oxide from using new features as they are developed and released by Cockroach Labs.

"Software can be done," said Oxide co-founder and CTO Bryan Cantrill in an interview. "One of the unique properties of software that I have always believed in my career, that we inadequately appreciate, is that when software is done it can really become part of a shared infrastructure, a common infrastructure."

Oxide is not a typical enterprise database user: The company designs and builds servers with custom-built software for companies that want to take advantage of the same cutting-edge infrastructure techniques used by cloud providers that aren't available in standard servers from vendors like Dell, HPE, or Supermicro. It uses CockroachDB to store data needed by the Oxide system's control plane to run the show, and chose that database because of its reputation for performance and resiliency, Cantrill said.

We ultimately have to put the viability of the business, and the long-term success of our customers, ahead of the developing problem that we had with essentially free riders.

When Oxide first decided to use CockroachDB in 2020, it was licensed under the Business Source License, which puts some restrictions on how the code can be used for three years after it was released. But the new licensing changes, which Cockroach co-founder and CEO Spencer Kimball said in an interview were necessary to solve "the free rider problem," will require free users to send telemetry data back to Cockroach and any user generating more than $10 million in annual revenue to purchase a license.

"We ultimately have to put the viability of the business, and the long-term success of our customers, ahead of the developing problem that we had with essentially free riders," Kimball said. It's another sign of the financial pressures that a group of venture-backed infrastructure companies founded around open-source projects during the early days of cloud computing are struggling to solve.

Lack of support

CockroachDB was written by Kimball and two other former Google colleagues in 2014 and released as an open-source project under the permissive Apache 2.0 license, which was extremely common at the time. In 2015 they founded Cockroach Labs, which would go on to raise more than $600 million in venture-capital funding as of this year.

The database quickly gained users drawn to the fact that it was extremely hard to take down, much like its namesake insect. "Turns out modern database systems have a lot to gain by emulating one of nature’s oldest and most successful designs," the founders wrote in their introductory blog post, which is now ironically lost to time but was quoted by Venturebeat.

Like many enterprise startups of that age, open source was a key part of Cockroach Labs' business model. Potential users were able to try out the most basic features of the product for free, and once they got hooked Cockroach Labs could charge them for additional enterprise features and support, a strategy known as "open core."

But as cloud computing became the preferred way to consume computing resources toward the latter half of the 2010s, those startups — some of which had become quite large — found themselves competing with cloud providers and other enterprise tech companies that could simply build their own versions of the permissively licensed open-source projects and generate revenue. In 2019, Cockroach Labs announced it would adopt the BSL, which prevented anyone but Cockroach from building such a service.

That licensing change, however, didn't address the real business problem for Cockroach, Kimball said. As the product matured and became more stable, lots of users — including Oxide — found they actually didn't need the premium enterprise features.

"Our enterprise version has lots of other stuff, including support, of course, but as version after version after version [of our core product] has rolled out, you can get away with not having support," Kimball said. "There was a point where if you didn't have support for Cockroach, you might really run into some significant problems earlier in our history. But we've minimized those."

The new strategy makes all of the features previously reserved for premium customers available to all Cockroach users, but everyone must now sign up for a license. As of right now, Kimball said Cockroach will employ an "honor system" and won't force companies to send in financial statements in order to prove they don't cross the $10 million threshold.

"I think that's a recognition of the changing reality in the business landscape," Kimball said. "We do need to be a company that survives for the future, for our customers, and for no other reason. There was a developing free-rider problem as the software got better, so that's what we're addressing here."

Go your own way

Oxide doesn't disclose its revenue, but Cantrill said the $10 million barrier "was an immediate and obvious non-starter." It was also unable to agree to the telemetry-data requirement of the free license, given that some of its customers are using Oxide computers in very sensitive air-gapped facilities.

However, when Oxide chose to use CockroachDB, "it was with the knowledge that we would be self supporting," Cantrill said. It will simply continue to do that under the BSL, and next year the last version of CockroachDB released before this month's licensing change will convert back to the Apache 2.0 license.

Unprompted, Kimball praised Oxide's plan. "They're forking, which I think is great. There's no reason not to do that."

Yet it doesn't appear that Oxide is going to follow the path blazed this year by former users of Terraform and Redis and produce a proper fork supported by a community of contributors.

"There are a couple of different aspects of the way we use Cockroach that are idiosyncratic to us, not least our choice of operating systems," said Cantrill, who oversaw the development of a homegrown operating system amusingly named Hubris. It will, however, contribute its patches to any community effort and its custom Cockroach build is available on GitHub.

Of all infrastructure software categories, enterprises tend to be the most cautious with their databases.

Oxide's approach to Cockroach Labs' licensing change is certainly unique, and it's unlikely that other enterprise users of the open-source project will be able to maintain their own forks or use Oxide's implementation, said Stephen O'Grady, co-founder of analyst firm Redmonk.

"Of all infrastructure software categories, enterprises tend to be the most cautious with their databases," O'Grady wrote in an email. "To even be considered by most enterprises, a Cockroach fork would require both a viable development plan — i.e., who would be maintaining and improving the code moving forward, given that most of the people qualified to work on it are employed by Cockroach — and alternate commercial vendor options."

But it seems clear that as an era of enterprise open-source software draws to a close, vendors will need to develop new business models and users will have to think differently about how they build their tech stacks.

"I would have liked to build this as a true open-core business forever," Kimball said. "But there are realities here, and I understand that there's some disappointment there, but I think there's plenty of options to mitigate that."