 Hey everyone, thanks for coming to our session and this is gonna be a panel discussion on is your open source project ready to spin off into a company? And it's gonna be really fun and I personally am very excited to ask all of them things they have learned in their journey starting companies which are based on very, very, let's just say like very popular open source projects. So a quick round of introductions first, like I am Ash, I work at Octeto. I am also a CNCF ambassador. I am now gonna ask all of you to like introduce your cells, your companies and the project the company was based on. Can we start with Ramiro first? Yep, hi everybody, my name is Ramiro. I am the founder of Octeto. It's a platform for remote dev environments on Kubernetes and the project is called Octeto as well, github.com slash octeto slash octeto. Hi, I'm Shauli Wozen. I'm the CEO and co-founder of Armoo, which is a security, Kubernetes security company and our open source Cubescape. It's an official CNCF project. It's been very successful with the aim of being like a platform, an open source platform for everybody who wants to secure their Kubernetes. And yeah, we'll talk more about it I guess. Hi guys, I'm Idid Levine. I'm the founder and the CEO of Solo. So we started as an open source project, a lot of open source projects that we open, that's still ours, but it's totally open and being used as well as we are the leaders of STO and now working very closely in Silium community as well as backstage. So that's us. Hey everyone, I'm Madri. I'm founder, CEO of Filotel. We started out with open source project KIP which was a virtual Cubelet extension and some of the lessons learned from not considering business stakeholders while bringing the product to market. We had to pivot out of virtual Cubelet and KIP and start back out from first principles. So I have a lot of strong thoughts on when is the right time in the life cycle of a company to open source your project. So looking forward to this discussion. Thanks Ash. Quick break, I'm trying to connect the project though. You want me to ramble on about virtual Cubelet? Found it. And also Flocker, if any of you are old enough in the ecosystem to remember Flocker. I was one of the engineers on Flocker. How times have changed? Cool, thank you so much for introducing all of yourselves. The way we have structured this talk, I've divided into four sections which I was very curious about. So I'm just gonna ask them questions related to that. The first section is chicken or egg. Like what came first? Was it the project or was it the company? Like did you start the project back of your mind having the fact that you are gonna create a company or did you already have a company and then you decided we need to get into open source and start the project? Madhuri, could you start? Sure, yeah. So like I said, I was working on Flocker project which was super popular. It was the first solution in market to enable you to run stateful apps inside containers. This was back in the Docker era in 2015. The project was super popular. It had a lot of GitHub stars but we didn't make any money and nobody was using it in production. So having coming out of that experience to start a little I was pretty sure that I wanted to figure out product market fit before putting in a lot of taking in a lot of developers time and venture capitalist money in growing the company and growing the project. So the company itself was started with let's figure out the value proposition first and then go to an open core model once we have the product market fit figured out. Hey, so okay, so let's see. So I worked in open source way before I started the company so I had some project that I did that was relatively successful and I was, I don't know, speaker in queue called KoopCon 1, 2, 3, right? I mean, basically was there. So when I started the company first the purpose was we just going to have fun, right? It's going to be a technology company and kind of like reminding what Ashikov did or what they co-ested just do a lot of fun project and have fun and we're not being a big company that's stopping us, we will have kind of like a fun time. So I didn't need money for it, I have three kids that I needed to spend. So I did raise money first but I had like tons of open source project before and I created one in order to raise money, right? But I raised money I think on serverless but I didn't ever meant to do serverless. When I took the money, I was saying, okay, this is the thing that I really want to build and then I went and open source project. So I don't know how to say, I think I'm both in a way. So what I'm getting is like, you all like had open source experience before and then you decided to start a company. Yes, but I open source project before the company during raising money after the company and then I also took over project that always exists. So like, I don't know. Yeah. Oh, you have it. So for us, it was a company first open source later. We got into open source from feedback from the market. We are a security company and we were going to chief security officers telling them about community security and honestly they would know nothing about it and they would kind of like shoot us to the DevOps team and say, hey, you know, speak with our DevOps team. So we needed to figure out a way to get DevOps attention. So quite honestly, open source was that way at the beginning. We said, okay, let's open an open source. Let's do something that would be very easy for them. Will be lean, mean, walking there the way they want to walk. And honestly in the beginning, it was a side project that was intended to get attention from DevOps. Then it got attention from DevOps and it got more attention and it succeeded and it grew very, very quickly. And I think over a period of like six months we turned the company around the open source and built, we changed our go to market around it. It went many different things. State of mind changes for the company. People that we bought in were very different. We bought in people from the communities community, open source contributors. Yeah, and that's, it's been a great shift and I think it's working very well for us. But for us it was that way around. Yeah, I have a lot of questions related to that but I'll keep those for a later section. Ramina, what about you? Yeah, interesting that each of us have a different kind of path. Ours was kind of similar to yours. It had two really good friends and I co-founders and we wanted to work together in something fun. We were working on big tech companies. We were kind of tired of the big company shtick. So we went to work together. And for us, the open source project was a cheap, fun way of exploring the ideas we had. We tried a few different things and eventually we hit into what octetal is. The idea of like, hey, you know, like, sync your code into a pod and hard-reload processes and remote debugging. And once we had this initial open source project, we kind of went around meetups, Q of con, just showing it to people, right, like the, and that got a lot of attention and a lot of like initial GitHub stars, issues from other contributors. And that's what kind of set us in the path of like, hey, this is something people are reacting to. You know, people have an opinion. Some people were like, you guys are crazy. That will never work, which is always a good sign because you want to generate passionate discourse, whether it's in favor or not. And that for us was the signal of like, yeah, you're into something. And that's when we started building the kind of idea of a commercial company on top of that. We also went the VC route, got some initial funding on the open source projects. And then we started building a company from there. Yeah, you mentioned a very hot topic and coincidentally, it's like a very good segue to our next section, which is like, so for both of you, like, since you had the project and then you wanted to build a company around it, like, what was the signal? You said like, it was GitHub stars for you, but like, for those of you who already had a company, like, is GitHub stars like a good signal? Like what metrics do you look at? Do you look at how many users are using the project downloads or GitHub stars? Surely I would like to get your take on this one. Yeah, so I think, you know, is your open source project mature? Also the way you measure it matures. In the beginning, you look at stars, okay? Even like when you want to build a company around it, like, well, at that point, just kind of like reminding where we were, it was, you know, it was a side project that we started with the intention of, you know, getting some attention and also, you know, but still doing something useful, right? But then, you know, we, you know, we saw after, I think it was like two weeks, we had 300 stars, four weeks, we had 1000 stars and, you know, if we didn't have that type of, you know, momentum, star-wise, we would probably not start to invest in it more and more. So it was like a self-fulfilling type thing. Well, okay, why? It's working, let's invest more, and then it's working more. And eventually, you know, we started to invest more in it and then we opened a Slack channel, you know, or it was a Discord at the beginning. Guys, I don't know how you're managing, like, engineers using Discord. Like, for me, it's like an HDHD in a box, crazy side note, but I can't manage Discord, but Slack is a little bit better. And then we started to move to, you know, how many Slack members do we have? How many PRs do we get? What is the engagement type that we're getting? And I think those are the more mature way to actually measure the success of your open source. What I'm getting is like, when you're actually working on the project, stars was like a good motivation for you to work on the project, but like, if someone is to take a decision to bring it into a company, it's much more like engagement and like how much the community interacts with you, that sort of thing. Yeah, I would not be blindsided just by stars and say, hey, yeah, I've got so many stars. You know, there are many projects that have many stars and go nowhere, so just as an example, OPA, okay, Open Policy Agent. I think, don't get me, but I think it has less stars than Cubescape, for example. Is it less successful than Cubescape? No, it's one of the most popular open sources out there. So, you know, just, I think there are more important things than stars, but it's very good in the beginning. So I wanted to say that in my opinion, and sorry about my language, it's called BS stars. I think that you see people doing marketing around it, you know, it depends who is the people open source, Google Tomorrow will open source the project, boom, it will go, the code could be crappy, but everybody will like it because Google do it. People standing on stage and doing a demo of, oh, I like my star and then I wish it works, it's all BS. It is what I think people need, and that's my opinion after doing it, unfortunately, a long time, and burning. We need customers. You need people that actually will use their product. They need to tell you how to build their product. They need to tell you what they need, they need to tell you what's not working and what is working. They help you to make their product more useful, and only then you're actually getting it. To me, this is the only problem right there. Eventually, how many people is on hands? How many people are using their product? I really don't care about stars. I have no clue. So I think that's what Charlie also said, right? Like when you have a community and when you have people interacting with you and engaging with you, that sort of gives a signal that this is something people actually want to use and it's just not like out there and people are starting it and using it. And that brings me to my next question, which was that what do you all feel like? Do you feel that every successful open source project, like let's just say successful this time, is like you're getting downloads, you're getting stars. Can we commercialize? Can you theoretically build a company around every open source project? Or does it depend a lot upon the market you are in, the cloud native space you are in? Like Charlie mentioned that, you know, they wanted to get visibility in the security space and open source was a good way for that. So is it like this security cloud ecosystem where this model worked or does any open source project, you know, like if you're passionate enough, can you build a company around it? GitHub stars are like Instagram likes. Take it for what you want. So I think if adding on to what Edith said about finding that repeatable problem that is solving a problem for a business stakeholder and you actually have the testimonials from business stakeholders that, okay, this is solving a business problem for me and you have 10 of the business stakeholders from 10 different companies telling you that it's solving the same problem. If you're starting to see that repeatable pattern, then that is a really strong signal that, okay, there's something in there, there's some meat in this thing to flesh out, but otherwise looking at anything else other than repeatability of the problem that you're trying to solve and path to commercialization kind of might not be clear, but it's like you have a little vague path to commercialization, whether it's a hub and spoke model where your core is open source and the spoke is where you're adding on enterprise components, things like that. I think those are the kind of signals that are stronger signals. I feel for, is it a commercially viable business that you're going to build out of this? Yeah, I wanted to add to that what you said, customers is very important. Initially, what would you say to them? Like when you just have a project, they are not customers, right? I think of them and that's a mistake we made at the beginning of like focusing too much on stars and on like this kind of early engagement. And at the end of the day for a commercial open source project to be successful, you were saying, you need to find those business stakeholders that need their problem solved, but you also need to figure out if this is a problem that they're willing to spend money on to be solved. Because we've run into a lot of these issues where you have this great project, it solves a great problem, but nobody has budget to fix that problem. And that's something that is hard at the beginning of to figure out whether you are in like the category creation world where you're gonna get them to eventually pay or if you can like quickly the risk and find yes, this is something that the VP of Edge cares about that will put money or not. And that's one of the biggest challenges is understanding one, if you're solving a real problem and two, if there's money. Is that enough like solving a real problem? Like you could take something like home brew and say that it is solving a very real problem. Like it is saving engineers so much time, but like I don't see any successful company build around that project. So yeah, so I wanted to say something. Here's the fun thing, right? I don't, first of all, every project can have a company around it. You can always make money. And I will say more than this, I will take it to a crazy thing, which is I don't think it's have to be valuable and people should want to pay for it. Let's take an example, okay? CNI, right? You all know, you're using it. Usually you're getting it for free, it's commodity. What is the other excitement about Cilium? It's a CNI. That's what it is. Why everybody right now on this low? And this is what I'm trying to say to you. It's all about marketing. What are you marketing it? What are you telling people about it? Is people who went now wanted to pay for CNI? Why? We're getting it for free for every CNI provider. You're getting it for free for colleagues, damn good CNI. Why everybody right now talking about Cilium? You know why? Because they make you believe that this is something innovative. And that's what you need to understand. It's like every market in there there is and you can make money from everything. And I'm just picking up on Cilium. I can pick up on something else, right? And I'm selling it by the way, so. But what I wanted to say is that it's very important to understand. In my opinion, if you want me to make money, I will find out how to make money from everything. It's all about, are you positioned or are you packaging it? So if anyone has an open source project, they are familiar with, like, I'm doing it after the panel. But yeah, so let's bring me to my next section. Like when you identify that, you know, like you there's this project and money can be made around it. How do you go about assessing like how big is like, how much money can you make? Like, and do you need VC funding for it? If yes, then how much should you ask for? Like, what's the market potential of the project? How do you judge that? Amidu, you wanna go? Sure, I mean, that's one of the big questions that everybody thinking about when a company has to make is, which path you wanna take? You know, the VC path is one of many different ways to fund a company, right? You can like bootstrap a company, you can go the services route, get some early money, you can go the VC backed and build something for us. And I think VC, VC backed money is a good path. If you're building something long-term that requires a large upfront investment, for us, it made sense because when we were studying Octeto, platform engineering wasn't really a thing. It was not a concept, it was a thing, but nobody had named it yet. So we needed to do a lot of like building at the beginning, convince a lot of people that were not crazy and that required years and time and you know, also learn how to market, how to position all those things. So I think for me, that's one of those questions where if you don't have a good reason to get VC money, it's better to not. And you can start the other paths because you can always go and raise if you have enough traction and a long-term vision. But I think, you know, Venture Capital expects very large returns, hundreds of millions of dollars, billion dollar companies. And not every market is that big. And sometimes projects benefit from like smaller companies who can like be more nimble and keep things running rather than the huge returns. But it is one of many paths. Yeah, I think the question is not really an open source or not open source question. It's a question that every company needs to deal with. Is the problem that you're solving big enough to create a company? But what I'm looking to learn is that since this is open source and you're already getting some traction we established, how do you take that traction you're getting and like, you know, determine it from that? Like, you know, like you're getting stars or engagement or people are talking to you on Slack. Like, how do you identify from that? That, you know, like this is a big enough problem. Like other companies don't have this open source aspect. Like they are like in a complete black box and they need to do market research and all of that. So in that kind of like, if I take that spin on it, on the question, I would say, first of all, and you know, indeed it said it very well is, you know, your customers, your users and what they're asking you to do, right? And if you get asked for more features and more things, then you can start, it's a little bit of intuition but you start to draw a line between what will be free open source and what will not be free open source and you start thinking of models. Then another thing is to think about, okay, what commercial solutions is my open source currently replacing? You know, what is the market, you know, I'm playing in and you know, did they raise money? What type of valuation do they have? For us, it was relatively easy because the security market as a market, you know, it is very, it's, you know, popular is not the right term but it's widespread. You can check market sizes. You can, you know, you can get reports from Gartner, et cetera on this market. So we knew where we are playing and we knew it was big. VCs knew it was big, you know, we didn't, like I didn't have a market size slide in my deck because yeah, quality security, we understand, right? And that's an indication that it's a big market. Masi, did you have a market slide? Yeah, I actually have strong thoughts on this one. So we are all playing in the infrastructure ecosystem. So as long as the idea or the project falls and compute memory, networking, GPU, these broad buckets, security, observability, I think there is a company there. If you're building something that's super niche, for example, Kubernetes for Mac. So can you really build a big company out of Kubernetes for Mac? Elotl has a project for Kubernetes for Mac which we open source. So that's not really like, you know, a company building project. So if you're playing in this large domain infrastructure buckets, I think there's a company to be made. So here's my thought about it. It's all mat, right? It's a trade-off, right? What is the, when you're taking money, what does it mean? First of all, you need someone who want to keep the money. That's actually the tricky part if you never founded a company before. But let's assume the people give you money. How much from your company are you going to give? 30%, 20%? Dude, this is the opportunity, if you're getting that money, to make tons of marketing, right? And basically make the company 10 times bigger, right? So in the long term, you're making tons of money. So give 20%, right? What's the problem, right? Eventually it will be successful. And I personally think we will maybe quote Steve Jobs, everybody should open a company. Like, we have, you know, it's like, why not? Right? That's the right thing to do. To build like, really just one more thing about that with regards to venture capital money, it depends on how big your dream is, right? If you have a big dream, so you need to market around it, you know, we have big, and if you want to build a big successful company, then take money, and I'll kind of rephrase what you said a little bit. It's like, you give 20% of your company. If it's a huge success, it doesn't matter. 24% for nothing is nothing, right? Exactly. If it's a huge success, it doesn't matter those 20%. If it's a huge failure, huge failure, it also doesn't matter the 20%, right? Just take the money, that's what I will say. Someone who told me once, you know, if someone hands you the cookie jar, take a cookie. And also just from a very capitalistic point of view, it also lowers a lot of risk because you get money, you can pay your team a salary, and then if it doesn't work out, well, it didn't work out. As long as you give it a good shot, like nobody's gonna be mad at you, but you don't have to like put your savings on the line. You don't have to like, you know, like re-mortgage your house. It's a shared risk, and I like that model. And there's some trade-offs, as you said, but the risk I think is something that other people talk about and we were having this conversation the other day, and I was like, yeah, it's a nice way to not have to worry about at least one less thing of the million things you have to worry, is like, hey, if the business doesn't succeed, well, at least people got paid a salary. Yeah, I think let's just jump to the next section because we wanna finish it and we have 10 minutes left. But now I wanna talk about like the sustainability and the existing user base you have. So when you start a company, you all mentioned, I think there was a common theme that if you are getting asked for features by your community and if you are seeing that engineering leaders or other people are interested in this, that's a signal for you. So when you have actually started that company, how much are you depending upon your existing open-source user base to buy your solution? Do you initially market to them or do you let that be and let them be happy with that? And like, do you change your project based on the fact that now you have a company and there's potential to make money? So I'm thinking about how I'm gonna answer this. First of all, it depends. Yeah. But if I try to kind of like put something into it, many times you don't know who are all of your open-source users and you wanna create a way for them to know that you are the company behind the open-source and reach out to you. They should also understand very well what is the difference between the open-source and the closed-source and what is the service that you provide. And for us, for example, managing that line of what is open-source and what is paid is something that we wake up to and we go to sleep with every day. Kind of like, how do we keep the value for enterprises and companies that need that level of features and capabilities but still live enough in the open-source that it is valuable for the hundreds of thousands who are using it and you want them to be satisfied. But wouldn't you say there's a slight bias and incentive towards get those people who are using the open-source project to limit them so that somehow they move to the paid solution? Yeah, it's, you know. How do you balance that? Yeah, the VP sales and the VP open-source are constantly fighting each other. No, really honestly, product comes up with a new functionality, Matias, David, they will come and say, yeah, of course it should be in the open-source and the VP says, no, put it on again and it's a battle that you kind of need to play with and actually give a recommendation that Craig, who used to work for us and today is with Edith, he said to me once and I think it's a good way to think about it. You can start, when you build something new, many times as you build it, it's very innovative and it differentiates it for you. So don't open-source it. But then as times goes by and competitors catch up with it and you develop new things, now you can open that and add it to the open-source. So that's like a, I think a practical way to kind of like make money out of things and then move them to the open-source and continuously build both innovation and the user base. I agree with this. And I think that when you're starting an open-source project, you want the user to use them. I don't want money from them. Those are the people who, you know, they have a startup, they will never pay me anyway. All I want them is to try the project in a lot of environment, get feedback that I will be able to make the product better. But then there is the enterprise and they will pay me and they will pay me a lot of money and they will want something different. They will have way more scale. They are interesting in security that maybe they are, I don't know, like. Who cares about security? Yeah, who cares about security? No, but my point is that they will care about different things. So we need to differentiate between them. Those, my ICP, right? That's my ideal customer profile. Not the people that is coming and their job is to help me marketing it, talk about it in conferences, get them excited. I think though, when you open a source or project, I would say that at least in the beginning, when I needed to make a name for the company, I open-source everything, right? Just wanted the company to be successful and people to know and the brand will be good. But I can tell you right now that I definitely not open-source everything. And more than this, I'm going to, from the get-go, when I'm putting an open-source project, I'm already thinking about the core model that I'm going to make money for. Because you know what I have to. You know why? Because you want those software for free and I need somehow to pay my employee. So this is a cycle, this is a vicious cycle that I need to solve. I need them to pay me money because that way I can continue innovative which all of us is going to basically leverage. Cool, that makes sense. So we have like five minutes left. And I just want to ask one last question and I want unfiltered hot takes on this one. But how do you manage ownership with the project now that you have a company? Is donating it to a foundation the best way? Is it changing to a business-source license? Or just keeping it open-source, how do you then make the community feel valued enough to if you have external contributors that they keep continue doing that? So who has a CNCF project here? So would you like give it to a foundation? Like what's the drawbacks or like? It depends on what day you ask me. It depends, yes. It depends. We contributed our project to escape to the CNCF and if I need to say was it worth it or not, for now the answer is yes. But it's yet to be seen and I do think that no one should do anything like that lightly. You need to think about the pros and cons of every licensing and contributing thing that you do. Our project is very much maintained by our team. Many of the smaller projects are like that. It's not like East here, for example, or things that came up from bigger companies. So even though we contributed to the CNCF, it basically exists because of us and we feel like the ownership of it. But that's limitation. So I think one of your question was, how do you get open source users to become commercial customers? So in the beginning, before we contributed, CubeScape to the CNCF, we had a promotion, an actual promotion like you use the open source. You know, this open source is maintained and contributed by Armo. If you want to sign up to the commercial version, here's a link and you cannot do that if you're a CNCF project because it needs to be completely unbiased. So we knew we're gonna give up on that capability. On the other end, and I think we talked about it before, what we do get from the CNCF and I think what the major thing we get from the CNCF is credibility. It's like, you know... And marketing. Yeah, marketing. Well, you don't get dollar marketing, but you get like, yeah, exactly. You can get that. And I see some companies, especially DevOps people, look at the CNCF landscape. It's a very wild comparison, like the Gartner, you know, market guide of the executives, right? These are the things that we need to look at. So in terms of credibility and popularity, that really helps. In addition to the CNCF route, another route I've seen work really well was for Flocker project, we had built the core of Flocker for running stateflaps and containers. That was done by ClusterHQ, that sponsored a Flocker project. And the hub and spoke model is also a really good way for incentivizing community participation. So each of the storage vendor had to build their own Flocker drivers. So we had EMC owning a Flocker driver for EMC, Kaminario owning a Flocker driver for Kaminario, pure storage. So all the storage vendors were involved in the community and they owned each driver. So the hub and spoke model is another way to incentivize ownership and grow the community. My hot take is don't open source it until you're really sure. When I was talking to Octero, Solomon Hikes from Docker kind of gave me that advice and he was right, it's like, because you can't, once you open source, you can't take it back. You can do it the way around, right? You can hold it closed for a while and then open it when you're sure. Like everything else we're discussing, it's a trade-off and you need to make sure that if you're gonna open source, there's a good reason or if you're gonna go with the source available license that you have a good reason. So get a good sense of who's gonna be paying for your product so you can make a clear line between open source and paid and weight as long as you can to open source. It's a valuable thing. I've included open source my entire career but not every company is successful that way and pick your own adventure. Cool, that was a nice diverse set of takes on this and with this we come to an end. So thank you so much for doing this panel with me and sharing what all you have learned and thank you everyone for attending. I hope you found this useful. Thank you.