Stock k6 + sidecar pattern: why we didn't fork

k6 is licensed under AGPL-3.0. That's the correct license for a testing tool — it keeps the core open and lets the ecosystem build on top. But it creates a practical problem for any company that wants to add proprietary features: if you link against k6 or distribute a modified binary, AGPL requires you to open-source those modifications.

Several commercial load testing platforms work around this by either ignoring the licensing question or by getting a commercial license from Grafana Labs. We took a third path.

The sidecar pattern

Testlyn runs the official grafana/k6 Docker image, completely unmodified. We don't patch it. We don't build xk6 extensions. We invoke k6 as a subprocess:

k6 run --out json=/tmp/metrics.jsonl /scripts/test.js

The --out json flag writes a newline-delimited JSON stream to a file. A separate Python sidecar process tails that file, parses the k6 output schema (documented in the k6 source), and streams 1-second aggregates to BigQuery.

The sidecar and k6 communicate only through the filesystem — they don't share memory, they don't link, they don't import each other's code. This is the same pattern that makes shell pipelines legally safe: ps aux | grep foo doesn't require ps to be AGPL just because grep is.

What this means for your legal team

When your legal team asks "what's the licensing exposure on your test infrastructure?", the answer is:

• k6 runs unmodified; its AGPL terms don't propagate.
• The sidecar is our proprietary code; it only reads k6's public JSON output format.
• Your k6 scripts are yours; we don't touch them beyond executing them.

We're not lawyers and this isn't legal advice. But we designed the system to be explainable to a lawyer in ten minutes, and we think that matters.

The trade-off

The sidecar pattern is slightly more complex than xk6 integration would be. We can't intercept metrics at the in-process level — there's always some buffering and filesystem latency. In practice, p95 latency values appear in your dashboard within about 5 seconds of being generated by k6.

For the overwhelming majority of load tests (runs measured in minutes, not milliseconds), that's not a meaningful trade-off. You get AGPL safety, open metrics in BigQuery, and a system your team can reason about.