Using SFTPGo as a FTPES and SFTP server in docker for a closed source project.

[masumulhassan]

Sorry as this might be recurring question that has been asked multiple times.

First of all, thanks for this awesome piece of software.

I have already looked at the compliance page to understand the license for my use-case. I wasn't able to determine if my usage of SFTPGo will fall under tightly coupled usage (without modification #2 clause) or normal usage.

Use-Case
I was looking at SFTPGo to replace a FTP server for a closed sourced application.
In this application,

• FTP server to allow other application to export files to this application.
• On rare occasion, customer access the FTP server using FTP client (e.g. FileZilla, CyberDuck etc) to preview or download pdf documents.
• If SFTPGo is integrated as docker container (as-is, without any modification) along with the application, it will not provide any Web UI for client. But for attribution I can list the SFTPGo in the FTP server welcome message and also list it in the license file.
• Use SFTPGo REST-API, to create user from a bash script.

Based on these scenario, will I be violating AGPLv3 with additional clause that SFTPGo provides if I integrate SFTPGo docker container?

Thanks in advanced.

[drakkan]

Thank you for checking license compliance before using SFTPGo in your product, appreciated.

Legal questions are never easy to answer and you should also consult your lawyer.

What is certain is that every user who uses your product must know that they are using SFTPGo and not your file server.
Please refer to the additional terms to understand how to provide proper, clear and not confusing attribution, including a link to the source code.

Understanding whether your product is tightly coupled with SFTPGo is more complex:

• If your product is a file transfer solution and you are therefore essentially reselling SFTPGo (which is also a registered trademark so you can't) with a different user interface, then this is clearly a tightly coupled usage.
• In the other cases you are in a gray zone. My personal opinion is that it is fine, but you should also consult your lawyer to be sure, we are talking about AGPLv3 clauses and I am not a lawyer although the text written in our compliance page has been agreed with a lawyer.

If you are using SFTPGo commercially, there is a social (but no legal) expectation that you help fund its maintenance and development.

[masumulhassan]

Thanks for your reply.

As you mentioned in your reply that,

In the other cases you are in a gray zone.

our lawyer does not want to deal with AGPL because of this even though our product is not anything related to a file transfer solutions.

So, for our product, we are looking at ProFTPd as an alternative.

Final Note: I saw some old discussion regarding license and support. I will just share some information on what we were thinking.
If SFTPGo required commercial license for commercial usage for a fee, my company was (almost) willing to pay that and use the product. But because of AGPL license, we decided to not go with it.

[drakkan]

Final Note: I saw some old discussion regarding license and support. I will just share some information on what we were thinking. If SFTPGo required commercial license for commercial usage for a fee, my company was (almost) willing to pay that and use the product. But because of AGPL license, we decided to not go with it.

This is also an option. We are slowly moving to an open core model and can already provide SFTPGo under a different license for a fee. If you are interested you can contact us at the email address reserved for commercial users (support at sftpgo dot com).

Of course ProFTPd is also fine if you want a free solution and the GPLv2 license is compatible with your usage.
Good luck with your project