Licensing

Not open source everywhere. Here's exactly where, and why.

The thing that runs as root on your hosts is Apache-2.0 today, full stop. The control plane is source-available and converts to Apache-2.0 on a fixed two-year timer, release by release. Nothing here has a remote kill switch.

What's licensed how

Comebye is a monorepo with a deliberate two-license split. The license depends on the directory, not the whole repo.

Apache License 2.0

The open modules, public and forkable today

  • proto/ — the shared agent↔server protocol
  • agent/ — Kelpie, the host agent that runs as root on your machines
  • cli/ — the comebye command-line client
  • scripts/ — repo tooling

The agent holds privileged access on your hosts, so it has to be freely auditable, forkable, and embeddable. Don't take our word for it: read the code.

The questions people actually ask

Why isn't the whole thing open source?
The FSL gives you nearly everything open source does: read it, self-host it, modify it, run it for any purpose. What it blocks is a well-funded third party reselling Comebye-as-a-service against us before we have a moat. Straight MIT/Apache-2.0 on day one has a well-documented failure mode for small teams: a cloud vendor with more infrastructure than you forks the project and out-competes the people who wrote it. It's a deliberate, time-boxed trade. See fsl.software for the license's own reasoning.
Can you audit, revoke, or sue over internal use?
No. FSL's only restriction is offering the software as a competing commercial product. Running it internally, self-hosting it for your own fleet, modifying it, reading every line: all explicitly permitted, no exceptions, no "contact sales" gate.
What happens if the company disappears?
The FSL clock keeps ticking whether or not we're around to enforce it. Every released version converts to Apache-2.0 two years after release, automatically, release by release. It doesn't depend on our goodwill or the business surviving.
Can a license expiring remotely stop my containers?
No, by construction. License keys are Ed25519-signed files verified offline by the binaries, with no online revalidation call and no kill switch. A lapsed license blocks new actions, like enrolling more hosts, after a grace period, but it never touches a workload that's already running. We're technically incapable of remote revocation, and so is any future owner of the company, because the mechanism to do it doesn't exist. See the pricing page for the billing side of this same commitment.
What does the Solo "Lifetime" license actually cover?
Perpetual use of the Solo tier, all future updates including major versions, all future Solo-tier features, and security patches, unconditionally. A lifetime that stopped covering v2 would be a trap, so it doesn't. It does not cover an SLA (community support only), Team/Enterprise features, or any future hosted service, since a lifetime price only makes sense for near-zero-marginal-cost self-hosted software. It's offline-verified the same way every license is: no kill switch, no carve-out that makes "lifetime" more revocable than any other tier.
Why is the agent a different license than the server?
The agent runs with root-equivalent access on machines we don't own. You shouldn't have to take our word for what it does. Apache-2.0 means you can read every line, compile it yourself, and verify it before you ever run it as root. The control plane doesn't run on your infrastructure the same way, which is why it's the one piece with a commercial restriction attached.

Read it yourself

The full license split lives in LICENSE.md at the repository root, with each module carrying its own LICENSE file. We'll link the public repository here the moment it's live.

Join the waitlist