Is OpenStack Open Source?

The Apache 2.0 License

OpenStack is released under the Apache License, Version 2.0, one of the most permissive open source licenses in widespread use. The Apache 2.0 license grants anyone the right to use, copy, modify, merge, publish, distribute, sublicense, and sell copies of the software, with only two practical requirements: you must include the original copyright notice and license text, and you must state any changes you made to the code. Unlike copyleft licenses such as the GPL, the Apache 2.0 license does not require derivative works to be released under the same license, which means companies can build proprietary products on top of OpenStack without being obligated to open-source their modifications.

This licensing choice was deliberate. The Apache 2.0 license encourages commercial adoption because companies can build proprietary value-added features, management tools, and deployment systems on top of OpenStack without licensing conflicts. This is why organizations like Red Hat, Canonical, SUSE, Huawei, and dozens of others have been able to create commercial OpenStack distributions. The license also includes an explicit patent grant, meaning that contributors cannot later claim patent infringement against users of the software for patents covering their contributions.

Every component of the core OpenStack platform uses the Apache 2.0 license: Nova (compute), Neutron (networking), Cinder (block storage), Swift (object storage), Keystone (identity), Glance (image management), Horizon (dashboard), Heat (orchestration), and all other official OpenStack projects. There are no "community edition" vs "enterprise edition" splits in the OpenStack project itself. The entire platform is available under identical terms for everyone.

Governance and the OpenInfra Foundation

OpenStack is governed by the Open Infrastructure Foundation (OpenInfra Foundation), a non-profit organization that was established in 2012 (originally as the OpenStack Foundation, renamed in 2020 to reflect its broader scope covering additional open infrastructure projects). The foundation provides the organizational structure, legal framework, and community coordination for OpenStack development.

The governance model has several layers designed to prevent any single company from controlling the project. The Technical Committee (TC) oversees all technical decisions, including which projects are officially part of OpenStack, what the release schedule looks like, and which technical standards the projects must follow. TC members are elected by Active Technical Contributors (ATCs), people who have made code contributions to OpenStack repositories during the previous development cycle. This ensures that technical governance is driven by people who actually write the code, not by corporate sponsors.

Each individual OpenStack project (Nova, Neutron, Cinder, etc.) has a Project Team Lead (PTL), also elected by contributors to that specific project. The PTL coordinates development within their project, triages bugs, reviews proposed features, and represents the project in cross-project discussions. PTL elections happen every six months, aligned with the OpenStack release cycle.

The Board of Directors handles organizational, financial, and strategic matters for the foundation. The board includes both appointed members (nominated by Platinum and Gold member companies that provide significant financial support) and elected members (chosen by the broader community of Individual Members, which is free to join). This structure balances the financial realities of sustaining a large open source foundation with the principle that the community should have a meaningful voice in the project's direction.

All governance meetings, decisions, and votes are conducted publicly. Meeting logs are published, mailing list discussions are archived, and code reviews happen on publicly accessible Gerrit and GitHub platforms. This transparency is a core principle of the OpenInfra Foundation and distinguishes OpenStack's governance from "open core" projects where a single company controls the roadmap.

Corporate Involvement and What It Means

A common concern about OpenStack's open source status comes from the heavy corporate involvement in its development. Companies like Red Hat (IBM), Canonical, Huawei, SUSE, and others employ full-time engineers who contribute code to OpenStack as their primary job. This raises a reasonable question: if corporations dominate development, is OpenStack truly community-driven?

The answer requires understanding how open source development works at scale. Large open source projects, including the Linux kernel, Kubernetes, and the Apache Software Foundation's projects, are all primarily developed by employees of corporations. This is not a corruption of the open source model; it is how open source succeeds at enterprise scale. Companies contribute to OpenStack because they sell products and services built on the platform. Their contributions are visible, reviewable, and subject to the same community governance as any individual contributor's work. A Red Hat employee's code must pass the same code review process, meet the same testing standards, and follow the same design guidelines as code from an independent volunteer.

The governance structure explicitly prevents any single company from dominating. The Technical Committee's election system gives voting weight to contributors regardless of their employer. The four-opens principle (Open Source, Open Design, Open Development, Open Community) codifies the project's commitment to transparency. Feature proposals go through public spec review processes where anyone can provide feedback, and features that benefit only one company at the expense of the broader community are routinely rejected or redesigned.

That said, the practical reality is that contributing to OpenStack at a significant level requires substantial time commitment, which means most major contributors are paid to work on the project. Individual hobbyist contributors exist but represent a small fraction of overall development. This is worth understanding because it means that OpenStack's development priorities tend to align with the needs of enterprises and cloud providers who sponsor development, which may not always match the needs of smaller organizations or individual users.

Community vs Commercial Distributions

The distinction between community OpenStack and commercial distributions is where most confusion about OpenStack's open source status arises. Here is how it works.

Community OpenStack is the software released by the OpenStack project itself, available from openstack.org and the project's Git repositories. It includes all the code, documentation, deployment tools (like Kolla-Ansible and DevStack), and testing infrastructure. Anyone can download, install, and run community OpenStack on their own hardware at no cost. The only "cost" is the engineering time and expertise required to deploy, configure, and maintain it, which is considerable for a platform of OpenStack's complexity.

Commercial distributions are products built by companies like Canonical (Charmed OpenStack), Red Hat (Red Hat OpenStack Platform), SUSE (SUSE OpenStack Cloud), and Mirantis. These distributions take the community OpenStack code and add value in several ways: curated and tested package sets that are validated against specific hardware configurations, simplified deployment tools and lifecycle management automation, enterprise support with SLAs and guaranteed response times, security patches backported to older releases (extending support beyond the community's 18-month maintenance window), and certified interoperability with specific hardware and software vendors.

The critical point is that the OpenStack code in these commercial distributions is the same open source code from the community project. Vendors do not ship a different, proprietary version of Nova or Neutron. What they sell is the integration work, testing, support, and operational tooling surrounding the open source core. This is a legitimate and common business model in the open source ecosystem, similar to how Red Hat Enterprise Linux is based on the open source Linux kernel and GNU tools but adds enterprise support, certification, and lifecycle management.

Some commercial distributions do include proprietary components alongside the open source core. For example, a distribution might include a proprietary dashboard that replaces Horizon, proprietary monitoring tools, or proprietary deployment automation. These proprietary additions sit on top of the open source platform and do not change the fact that the underlying OpenStack services are open source. Organizations evaluating commercial distributions should understand which components are open source and which are proprietary, because this affects portability: if you decide to switch vendors or move to community OpenStack, you keep everything built on the open source components but lose access to the proprietary additions.

How OpenStack Compares to Other Open Source Cloud Platforms

OpenStack is not the only open source cloud platform, and understanding how its openness compares to alternatives provides useful context. Apache CloudStack is released under the Apache 2.0 license (the same as OpenStack) and governed by the Apache Software Foundation, which enforces similarly strict open governance rules. OpenNebula uses the Apache 2.0 license for its core platform but offers premium features and support through a commercial entity, OpenNebula Systems. Proxmox VE uses the AGPLv3 license, which is a strong copyleft license requiring anyone who modifies and distributes the software (including offering it as a service) to release their modifications under the same license.

All of these platforms are genuinely open source by any reasonable definition. The differences lie in license permissiveness (Apache 2.0 is more permissive than AGPLv3), governance structure (foundation-governed vs company-governed), and the boundary between the open source core and commercial add-ons. OpenStack's combination of permissive licensing and foundation-based governance makes it one of the most transparently open large-scale software projects in existence.