Runa Capital

With their keen eye for innovation and their knack for spotting the next big thing, Runa Capital is at the forefront of the tech revolution. In this episode, Ben Rometsch delves into the world of open-source software with Konstantin Vinogradov, General Partner at Runa Capital. Konstantin reflects on the founding principles of Runa Capital and its commitment to investing in open source and AI technologies. He also discusses the potential for open-source endowments to provide long-term support for open-source projects, drawing parallels to the funding mechanisms of universities. Join them as they delve into the intersection of technology, investment, and the future of open source in the digital age.

---

Runa Capital

Welcome back. I’m super interested to talk to Konstantin. It's a little bit of a diversion from the normal people that we speak to. Konstantin works for Runa Capital, a VC firm with a specific thesis around open source. We thought it would be interesting to have a little bit of a detour from maybe more technical discussions. Welcome to the show, Konstantin.

Thanks for having me here. It will be a pleasure to discuss open source, investments and all things around open source.

Do you just want to give us a little bit of a backstory on how you got to be doing the job you're doing and where you came from to be where you are?

Yeah, sure. My first exposure to the open source world happened quite a long time ago. It was when I was thirteen that I started programming and played with different languages. I think the first projects I interacted with were PHPPB and MySQL because I wanted to do web programming, like when I was 13 and 14. Basically, it defined my interests and later went to university, studied physics, math, computer science and machine learning.

After that, say during my university times, I also got exposure to startups, worked with a few and planned to launch my own startup, but then accidentally also stopped by a job interview at Runa Capital. Frankly, I never planned to work at a VC firm. I thought it was quite boring and because I wanted to build my own business, but it appeared to be quite an interesting team and place.

Many years passed and I am one of the General Partners of Runa Capital, focusing on open source and AI. Runa was the place where I got first exposure to open source business because in 2011, before I joined company, the firm invested in the NGINX web server when it was one of the first of its investors. When I joined, I learned, wow, it seems like people can make money on open source, not only just develop nice stuff, but also build a valuable business around that. Eventually, NGINX was acquired for roughly $700 million in 2019. It solidified the thesis that open source would be an interesting area to focus on and could produce valuable companies.

Can you talk a little bit also about the genesis of Runa and if they have a specific thesis, what that is? I'd love to dive into NGINX a little bit more and discover about that. In terms of the overall thesis of Runa and maybe how it's changed over the life of the fund.

The firm was started in 2010. It has the DNA of tech entrepreneurship because my partners and co-founders of Runa, before starting a venture firm, built a few large software companies. One of them is Parallels. It's a hosting automation and virtualization company that was acquired partially by Ingram Micro and Coral Group. Another company that is still active is called Acronis. It's a Swiss-Singaporean cybersecurity company selling to mid-market worldwide. That's where I originally loved enterprise software expertise and capital came from.

I think we defined the DNA of Runa at the very beginning and then focused on enterprise software. We also had a deep tech at some moments because it was also about complex technologies and the ability to dig into technical details. We are continuing to focus on these two large areas, but within these areas, we have some sub-segments. One of them is next-gen computing. We invested a lot in continued investment in quantum computing or any technologies that could extend the Moore's Law. On the other hand, we continue to invest in fintech infrastructure and open source. That's my favorite theme at Runa.

Last, but not the least, we're also investing in AI. I think it's quite hard to find VC nowadays who doesn't do this. I can just only say that we started investing in AI around 2015 or 2014.

Just for those people who are reading who maybe don't understand the overall structure, can you just explain very briefly the nuts and bolts of the model that a firm like Runa has? Where does the money come from? How do they figure out what to do with it? What are the required outputs of those investments? For those people who maybe aren't so familiar, can you do that?

Sure. We're a standard international venture firm, which has a so-called LPGP structure. There are investors who invest money in a venture firm, but they don't manage this money. They expect returns, let's say, around 4X or the lifetime of the fund. There are general partners who also invest their own money and they manage this money and they invest in startups. Some of these startups become very large companies. Some of these startups go bankrupt. That's quite a risky business.

Overall, limited partners expect general partners to generate good returns. It's quite a long-term business. Every fund usually has a life cycle of around ten years, where it invests in startups during the first 3 or 4 years and then during the remaining period, it sells stakes in big hard portfolio companies or maybe additionally invest in them.

Changes Over Time

In terms of the eleven years that you've been working in this space, how have things changed? What are the big macro changes that you've had to deal with in that period?

There are different tech trends and market trends. I think one of the most beautiful things about the job of a venture investor is that you always have to invest in something new, and this definition of new changes a lot during your career. I remember when I joined Runa, the new was about cloud infrastructure and SaaS. It's everywhere and it's not interesting to talk about cloud anymore. AI is the most interesting topic for discussion. There are a lot of changes, but I think fundamentally, it's all about riding new waves of technology and building valuable companies out of this. There are some good years and bad years in terms of market conditions.

One of the most beautiful things about an investor’s job is that they always have to invest in something new, and the definition of "new" changes frequently.

However, because we're a long-term business, I can't say that they affect startups a lot. I think the situation with technologies, let's say, generative AI, with open source perception and with more, let's say, technological and enterprise-focused things, they affect startups way more and our business as venture investors than short-term market volatility.

In terms of the changes that happened in the market like three or so years ago, I've only felt this as a second-degree or third-degree effect from other friends of mine who worked in venture-backed companies or things like that. It was quite a rapid period of change around the cost of money and things like that. Can you just explain how that experience happened for a VC? I think a lot of people have heard about it being talked about from founders or people looking to raise money. How did that look on the other side of the fence?

It obviously became harder to raise money after the market downturn in 2022. For several years, it was pretty hard. I think the market is pretty restored, and it has become easier, but not as easy as, let's say, late 2021. Frankly, I consider these seasons of the year, there are winters and there are summers. Sometimes, people who spend a lot of time during the summer period, think that warm temperatures will be here forever. Sometimes, they are not very well prepared for winters. Sometimes, people who experience many seasons know that after summer comes winter and after winter will be summer. There will be ups and downs any time.

‍

We've been doing this business for quite a while and raised many funds. Some funds were easy to raise, sometimes, some funds were harder to raise. It depends a lot on timing, but in a nutshell, I think there is more interest in venture capital as an asset class. There is more interest in technology companies. Fundamentals are good, but timing sometimes can be quite bad for VCs and for startups who raise money from VCs as well.

Signals For Investment

In terms of the open source companies that you're investing in, what are the main light signals, numbers, or drivers that get you excited about a potential investment?

There are plenty of metrics. Some of them are, I would say, vanity metrics, like GitHub stars. They could highlight interesting companies, but they're not telling anything about the business value of the product or is it really useful or not. They tell that it's something interesting or some worth taking a look at. There are other metrics that are more related to money and budgets. For example, the number of active contributors is one of the metrics I'm really looking at it because, essentially, it's equivalent to revenue, but just indirect. If people, software engineers, spend time contributing to a specific project, that time is valuable.

They do not have very small salaries. Usually, they do it during their work time or even if it's their spare time. Anyway, it's valuable and it means they are allocating some budgets to a specific project and there is a reason why this project is better than other projects they could spend their time on. That's useful for the determination of interesting companies.

Let's say this metric, I use it within some specific categories because otherwise, it makes no sense to compare, let's say, C++-based databases with JavaScript frameworks in terms of active contributors. They have very different entry barriers for contribution. Overall, there are some metrics from GitHub that could highlight companies that are correlated with the quality of products. However, by the end of the day, it's all about building a thesis around a specific company, not about any particular metric.

In terms of the way that those things have shifted, just jumping back to NGINX, NGINX is an interesting project and application. For someone who's been in the industry quite a while, back when you used to pay for web servers with Netscape and some of the Java application servers and things of that nature, that concept of a web server, especially when Apache became this commoditized piece of open source software that was free and that was very heavily used throughout the internet, but that was free. Obviously, it was an absolute juggernaut in terms of the software component that pretty much replaced Apache. I guess it's probably running in hundreds of thousands of Kubernetes clusters without people even knowing it's there. It's just doing something that has been abstracted away.

If you were to shift time back, how would you have looked at that project, looked at that potential? It's interesting to me how you get to a figure of $700 million. You would have said to me years ago, you could build a web server and sell it for $700 million. I'd have been like, “No, those days are gone,” but that was clearly an incorrect view.

That was a challenge, frankly. Nobody sold web servers for $700 million before NGINX did it and afterwards. I haven't seen anything like this as well. It was quite a unique story. If I look back and imagine if I were at Runa when Runa invested in NGINX in 2011, I would try to apply my current thesis and framework to NGINX and I would look at it like, “NGINX is an extremely popular web server,” which I think at that moment had around 7% of all websites using NGINX.

Now, NGINX is number one by market share, as far as I remember, the last time I checked. NGINX was growing, Apache was declining in terms of market share and there was an explanation of why NGINX was getting market traction. It was built for high-performance, high-load environments. When NGINX was originally developed, it was open source, I think, in 2004, as far as I remember.

There were just a few websites in the world with high loads, but then when the iPhone was released, when people started using mobile internet more and more, the pattern of internet consumption changed a lot. There is this high-load problem with multiple concurrent threads, users and requests of web servers and many companies encountered this problem. NGINX was a good solution to this problem.

It was getting traction and I thought, “If companies with very high loads, probably with large budgets, are using NGINX, then they could buy something on top of NGINX, like advanced load balancers, reverse proxy, a lot of cloud infrastructure, which is connected with NGINX.” That would be the thesis, and this is exactly how it worked. NGINX developed NGINX Plus as a paid enterprise product and it was used by quite well-known enterprises with billions of monthly active users sometimes and it was the only solution that could handle these kinds of high loads for them.

Can you describe a couple of things that I don't know, such as features or aspects of the Plus product that generated that value?

Last time I checked, NGINX Plus had an advanced load balancer. Frankly, I don't know what it has right now as a product. It's part of the F5 network portfolio. It has additional features like API gateway, for example. There are a lot of tools that are required for proper cloud infrastructure if you would like to ship your content to your users. If you have millions or tens of millions monthly active users and then you have a lot of infrastructure behind these front-facing things and you need API gateways, you need cache, you need reverse proxy, there are plenty of things.

As I can see in the current F5 website, they have reverse proxy, instance manager, interest control, and plenty of things which are not unique for NGINX, but NGINX was a good way to go to market. At that point, when NGINX was everywhere, there were not a lot of companies just doing these tools for cloud infrastructure.

Were there similar stories? I can't think of any other ones off the top of my head where, especially something operating at that level in the stack, database is maybe a separate different class. Obviously, there are lots and lots of examples of opensource database products being generating very large amounts of value. Were there analogous stories to products like NGINX at the time, or did you have to peer into a murky future to see what might happen in that in terms of that deal for Runa?

It was and I think it's still quite a unique story in terms of even category because when we looked at many open source, we basically tried to find all open source unicorns found over the years. It appeared to be that cloud infrastructure category is very small. There are many open source unicorns, which are building databases or just data in the infrastructure, and there are developer tools. There are just a few focused on cloud infrastructure like NGINX. In hindsight, it was a very lucky investment. I think it will be way harder for me to think about investing in pure cloud infrastructure open source product.

Open-Source Startup Index

Runa has an open source startup index as well. Is that right? Can you talk a little bit about that?

Yeah, sure. The story behind these indexes is the following. It was 2020, the year of lockdowns and some free time, which can be spent at home. I played with Python and GitHub API, trying to find interesting startups and trying to understand what good growth for an open source startup is, like the growth of GitHub stars or contributors. I played with this API, collected a lot of data about repositories with more than 1,000 stars, and tried to calculate some benchmarks. Let's say, what is the top quartile or bottom quartile for growth? When calculating these benchmarks, I naturally looked at the top companies by growth rate and noticed several interesting startups. I thought, “How about trying to find the top 20 startups by this metric?”

I decided to publish benchmarks and these top 20 startups, and the post got unexpected feedback from the community. I received a lot of emails from different people, and it became evident that it was something that could be interesting to others. I decided to make another post about benchmarks and also publish the top 20 startups for the next quarter. This is how index started and then we've been doing this since the second quarter of 2020.

This index does not tell about the quality of a startup. It tells us that they are building something that gets traction among developers and that they are interested in open source projects. It's very hard to compare them even between each other, because sometimes startups in this index are very different, like databases and JavaScript frameworks.

AI And Open-Source Intersection

In terms of the interest investments that you guys are making in AI, I'm interested in whether there's a lack of an intersection with AI and open source because, as far as I understand, competitive difference and competitive advantage in AI is very much more around the data that you have or the model that you have, things that are naturally harder to open source. Is that a fair analysis? Is there a natural fit between open source and AI as far as an investor is concerned, or is it a little bit more? Do you have to work that angle a little bit more?

I think they are very well connected. Open source and AI are very interesting pairs. AI drives a lot of open source discussions because historically, open source was a bit separate from the global software industry, especially, let's say, because it was not that popular in Silicon Valley. It was pretty decentralized in terms of where people built open source projects. AI was the theme that sparked interest to open source discussions in Silicon Valley and it's spread in other areas as well.

Everybody talks about open source AI, about that OpenAI is not that open and Mistral is way more open and these discussions. It ignited interest in open source in general, on the one hand. On the other hand, I think open source AI also made open source more valuable in the long-term, which was not that obvious.

The way I'm thinking about this is we, as venture investors, would like to invest in companies which build long-term competitive advantage against competition. Even before the modern wave of AI, of LLMs, we, as an industry, were able to produce software easier and easier because of different tools and different automations. With AI, with GitHub Copilot, becoming even more easier.

The cost of producing software is declining, which is a good thing for the world, but for investors in software, it's not that good because it won't be a long-term competitive advantage anymore. It's very easy to copy software or just recreate some kind of software product. Where we are not really good at as an industry is in creation of social systems. Not code-based or AI agent-based systems, but people-based systems. It could be a long-term advantage because, for now, we don't have AI, which will help build open source communities, communities, governments, companies, or any kind of complex social system.

Open source has this unique feature when it combines software and social systems. In a world where software is very easy to copy, people-based systems are the only long-term competitive advantage which cannot be copied and pasted. Open source has it and that's why I think with current AI progress, open source becomes more and more valuable for investors as well.

‍

You talked about summers and winters, as an investor, that segment must be incredibly competitive in terms of you trying to find companies that want to get investment. Is that fair to say?

AI?

Yeah.

Yes. I think nowadays everybody's investing in AI, but there are always niches where some investors spend more time on. We are not trying to invest in just AI. We look for specific areas. For example, I prefer AI infrastructure and also AI applications for enterprises for some areas, which usually require a PhD degree to work there. There are always some popular and less popular themes.

There is also an interesting intersection of open source and AI, not only for foundational models, but not even only about infrastructure for AI, but just for a combination of, let's say, open source products and AI model built on top of this product or trained on top of this model. Historically, for example, open source was, it had business model of open core. After support and services, it developed open core business model, then cloud became such a model.

Maybe AI would also be one of these new models for open source commercialization, because, when you have built a free core that collects data and then you sell fine-tuned AI on top of this structured and unified data, it could also be quite valuable for enterprise customers. From a non-open source investor perspective, it will be just an AI company. From my perspective, it will be an open source company with an AI component in it.

Funding For Open-Source Projects

In terms of the funding, we talked a little bit about you guys seeing things for open source projects that can realize value for their founders and investors. For projects that really just don't have a natural mechanism like that, there's still a funding crisis around some of those projects. Do you think the industry as a whole needs to do more to try and address those problems?

I think we all rely on open source. It's used by 96% of all commercial software in the world and every average piece of software has more than 500 open source dependencies, so we can't live without open source in a tech-enabled world. There is a broad spectrum of funding opportunities and different projects in the open source world.

On the one part of the spectrum, there are venture investors like us or like our colleagues who also invest in open source and we like investing in startups. Not every business can be a startup and not every business should be a VC-funded startup. There is huge space for just good open source or closed source software businesses, which don't need to be billion-dollar companies in the future. It would be just a great dividend-generating business for their founders. There is such a space in the open source world, and these founders can make money on premium support, services, customization, etc.

There are things which are unlikely to be commercialized in the future because they are too small and they just do not have to build business around this. Small libraries could be like a time zone library, which is used everywhere, or like small pieces of stack which are not on the first or even on the second layer of infrastructure but just buried very deeply into the card stack. It will depend on these small pieces and while large foundations support large projects, let's say Linux Foundation or Apache Foundation, like Postgres or Linux, they will be fine, but there are a lot of small projects, like from the long tail, like from that meme about a guy in Nebraska supporting the whole infrastructure. I think it's very important to support this long tail as well in a sustainable way.

Otherwise, the number of vulnerabilities and critical risks will only grow and there are no good sustainable tools to do this. Current support is either about building business around, which is totally fine and if open source project can be turned into business, probably should be. However, for those which are purely non-profit things, they rely on annual donations from companies, from GitHub users or from foundations, which again depends on annual donations from large companies, which are defined by corporate budgets.

As we already touched on, nowadays, these budgets depend on seasons of the year. Let's say in 2021, large companies can spend a lot of money on supporting open source supply chain but in 2024, probably less than 2021, despite open source has only grown since then. Our dependencies have only increased since that moment. Frankly, I think about new ways of sustainable funding of open source. One of the ideas that I have developed for quite a while, it's about open source endowment concept because there is a very clear analogy between open source and universities. They are very similar in terms of culture.

It's all about clusters of people around some knowledge area, which are where they together develop some intellectual property and the university just called research and on GitHub, it's called contributing to open source. They care more about peer-to-peer review and care less about how much the market is ready to pay for their work. It's quite a specific culture and open source actually emerged as a culture from US universities in the ‘80s.

They are very similar in terms of functions, so they generate IP, they educate people like senior members of community, junior members of community, both in open source projects and at universities. Also, they have large libraries and GitHub is probably the largest library in the world, at least for code, and the largest university from this perspective.

Finally, some part of generated IP can be transferred to the business and commercialized like university spin-offs or like open source startups. I think there are types of intellectual property that are very useful, but they can be turned into business anytime soon, or maybe never, like astrophysics at universities or small libraries set in open source.

Humanity developed two ways of sustainable funding of universities, they are either governments, which is a public resource, or endowments, which are about private resources. Open source is very decentralized and spread across plenty of countries, so for good and for bad, governments can't affect it a lot. In my opinion, the only way to make open source sustainable is to build open source endowments, which will focus on spending only the investment income from donations, not just transferring them every year to specific projects, but reinvesting them and having predictable, sustainable cashflow. We will know that it will be spent on open source maintenance and support.

‍

It's funny you say that because, like UK universities where I am, they're going through a bit of an existential crisis at the moment, especially post-Brexit. A lot of those universities are different from when I was at university, when I was studying. They used to be almost entirely government-funded. In the last few years, it's been interesting, actually.

There's a very interesting analogy that you make. I subscribe to a large proportion of it. A lot of the UK universities have been financing themselves by foreign students, mainly from China and Asia, who, I guess, arguably whether that's an endowment or not, but they'll charge foreign students more than they're allowed to charge UK students because of the post-Brexit nonsense.

I actually read in the newspaper that I think they've on average seen a drop of 50% in applications from foreign students because it's much harder for their family members to come and live here, all part of the nonsense going on in the UK politically. It's a very interesting analogy because both of those things are those solutions are a little bit, you mentioned it, at the mercy of the market to a large degree, or they can be at the mercy of the market and it doesn't feel like there's really much that anyone can do about that.

There are good and bad seasons, but I think there are some things we would like to see, like 100 years from now, probably, which we find valuable for society, like top universities. It's important to have this additional leverage just to make it more sustainable. It doesn't mean it should fully replace private funding, such as tuition, donations to open source, or something that correlates with the market. I think it's important to have this kind of market feedback every time.

There are things that have very long-term horizons of planning and you can't do long-term things if you don't know if you'll have money tomorrow. Frankly, I'm more confident that, let's say, in 100 years from now, we will still rely on open source software than that any particular top-tier university like Harvard or Oxford will exist.

We don't know how universities will change, especially after the recent progress in AI, and maybe they will survive, or maybe not. Some will definitely survive, but I'm sure that open source will survive because it's just like entropy; we can't take it back. It's already everywhere, in our software and our tech, and we can't live without it. It's not supported properly. That's the paradox.

Open source is just like entropy. We can't take it back. It's already everywhere.

It was fascinating actually reading the analyses of the hack attempt that was, I guess, supported by a Microsoft engineer, with these commits that went into some dependencies of OpenSSH. Obviously, like the person in Nebraska, they're arguably being taken advantage of or their time is not being valued fairly. That's a completely different class of thing compared to suddenly 1% of the internet being compromised or whatever.

They were incredibly sophisticated in terms of the concept and the build-up to those things. It was like 3 or 4 pull requests that I think could have got into, or did get into, some upstream packages. As any engineer knows, the chances of three pull requests getting through with issues is maybe not relatively high, but the potential blast radius of something like that happening, especially in this situation, is just insanely large.

I know the log4j issue that was in the newspapers. There were like aunts and uncles of mine or whatever, who have nothing to do with software, or can you try and explain this to me and things like that. When you explain the Nebraska situation to them, they can't believe it at all. They all think that everyone's Facebook and all these people are bazillionaires. I wonder whether there's a combination of it needed to become more of a public problem.

I think if 1% of the internet were compromised and that would be like a negative reason for things to change, but at least maybe then it would cause some things to change. I do wonder whether it is going to take something like that. We've seen this in the UK, like banking, for example. The UK has a huge problem with people trying to get phished and spear-phished and things like that. Especially older people, with people trying to compromise their phones or their laptops or things like that, or just getting them to send.

The UK banking industry moves quite slowly, but they've been very progressive and proactive around if you put in someone's bank number into your phone, it checks that the person that you're sending the money to is the same as the one that you've typed in and things like that. I think things can change when it's always about money, which is fair enough.

However, when that's the case, I wonder whether if there's a positive path to this solution that doesn't result in 1% of the internet getting compromised, as opposed to there's just going to be an inevitable, like, really bad thing happening. People will go, like, like the European Union or whatever, because it is like, if that OpenSSH bug hadn't been discovered by chance, that could have been like a serious global security situation.

I think, unfortunately, we'll have more and more situations like Heartbleed, like log4j and such cases. Some governments are trying to do something to secure the supply chain. I think the US government did this, the EU is trying to do this, and Germany even created their own small sovereign tech fund to support open source.

I think the impact of governments is very limited. They can't really help open source, but they can't harm it as well. The only way is to do it via private resources. I think it's quite an invisible problem for most people who are not exposed to open source, but it exists. It's a very sensitive thing when a few pull requests could destroy a lot of wealth and even health, etc.

I'm more concerned, not even about large tech companies, which are advanced in terms of understanding of the problem. They also have the resources to fix the problems, and they invest this money into their supply chain. There are plenty of non-tech businesses around us, like hospitals or airlines and they have no clue about open source problems, but they all depend on open source.

That's a bit scary because they won't be able to fix it or do something with it. I think the solution to this problem could be building a bottom-up endowment and focusing on the tech industry, because returning to the story about universities. Universities have large alumni communities, which are the main source of donations. Basically, there are people who care about university and they try to help in different ways.

I think it could work the same for open source. GitHub has more than 100 million users nowadays. These people generally have higher salaries than other people in the countries they are living in. I think that’s the road to the solution. Of course, I think we, as a tech industry, should solve this problem because nobody will solve it for us, unfortunately.

We as the tech industry should solve these open-source challenges because no one else will do it for us.

I think you're right. I think this is a really interesting point you make, actually, that someone or an institution or institutions could have the best will in the world to try to solve this problem. I'd love it if the EU came up with some long-term solution, but I just can't imagine that's really going to.

It can be attached to any particular country. Countries can support their local projects, that's fine, but it's very decentralized and because and if there will be some solution, which is related to countries, there will always be a free rider problem that some countries support. At least the EU and US support it. Other countries don't support it, but we're all using open source. It's not a right situation. It's not balanced. It should be decentralized, I think, by default because we're solving the problem, which is also decentralized.

Konstantin, thanks so much for your time. It's been fascinating talking to you and hearing from life on the other side of the table quite often. In terms of things that you're working on or interested in or projects or links that you want to mention before we close out, have you got any things that you'd be interested in people want to find out more or go further?

We have a few open-source-focused resources. One is ROSS index, where we publish open source startups every quarter. It might be an interesting source of inspiration for people who are building something open source. Another thing is our open source repo on GitHub, where we have more than 15,000 stars and many contributors. It's about open source alternatives to well-known SaaS products. We're inviting everybody to contribute and to just use this at least for their tech decisions.

Awesome. Thanks again for your time.

Thanks.

‍

Important Links

• Konstantin Vinogradov
• ROSS index
• GitHub – Runa Capital