Open source governance models

BDFL — Benevolent Dictator For Life

One person, final say. Works for small projects. Becomes a bottleneck as the project grows. The most famous BDFL was Guido van Rossum, who held the role for Python until 2018. The model is increasingly rare for new projects. For the handoff: when the BDFL steps down, the project either transitions to a new model (Python did) or fragments (Perl 6). If you're a BDFL stepping down, the right move is to transition the project to a community model with a clear governance document, not to hand the BDFL role to a successor.

Foundation governance

A non-profit foundation (Linux Foundation, Apache Software Foundation, Cloud Native Computing Foundation) owns the project's trademark, copyright, and governance. The foundation provides legal infrastructure, governance documents, and a stable home for the project. The major foundations have different approaches:

• Linux Foundation: hosts projects across many areas. Projects must have an active community, a governance document, and at least 3 maintainers from at least 2 organizations.
• Apache: focuses on the Apache License. Projects follow the Apache way: merit-based promotion, consensus decision-making, no veto power.
• CNCF: focuses on cloud-native. Projects go through Sandbox → Incubating → Graduated stages.

For the handoff: foundation projects can outlive any single company or individual. The Kubernetes Ingress NGINX retirement in November 2025 was a foundation-managed graceful handoff — the maintainer team stepped back, the CNCF announced the retirement, replacement guidance was published at the same time. The project continues as a record of what good handoff looks like.

Vendor-led

A company owns the project. Kubernetes is owned by Google (now donated to CNCF). React is owned by Meta. TensorFlow is owned by Google. The advantage: corporate resources — full-time engineers, security audits, infrastructure. The disadvantage: the project can be abandoned if the company decides it's no longer strategic (Google's Gears, Mozilla's XUL, Google's Knative variants). For the handoff: vendor-led projects typically get donated to a foundation (Kubernetes → CNCF) or forked by the community when the company moves on. Both are real handoff patterns, but they require community coordination that may or may not happen.

Community-led

No single owner. The project is governed by a group of co-maintainers, often from different organizations. PostgreSQL is the canonical example — the global development group includes individuals from many companies, and the project has survived 25+ years without any single company "owning" it. SQLite is similar (D. Richard Hipp is the lead, but the project has multiple core contributors). The advantage: the project can't be killed by one company deciding to stop investing. The disadvantage: governance is harder — decisions take longer because they require consensus.

Frequently asked questions

Related reading

Related reading on BreakPoint

The concepts, guides, and reports behind this post.