Apache License 2.0 is a permissive license, meaning it places few restrictions on what you can do with the code compared to copyleft licenses like GPL. You can use, modify, distribute, and sell Apache-2.0 software, including as part of closed-source commercial products, without being required to release your own source code. The main condition is attribution: you must keep the original copyright notice, include a copy of the license, and note any significant changes you made to the files. If the project included a NOTICE file, you need to carry that forward too. Apache-2.0 also includes an explicit patent grant: contributors license any patents they hold that cover their contributions, and that grant terminates automatically if you sue the project over patent infringement. This patent clause is the main thing that separates Apache-2.0 from simpler permissive licenses like MIT, and it's part of why larger companies with patent portfolios tend to prefer it for both using and releasing code.
Because there's no requirement to share modifications or open-source derivative works, Apache-2.0 works well for infrastructure software, libraries, and platforms that want broad adoption, including inside proprietary products. It's a common choice for projects backed by companies that want contributors and users to feel safe from patent litigation risk. You'll find it across cloud-native tooling, data platforms, and machine learning frameworks, where enterprise adoption depends partly on legal predictability. Repos on this page licensed under Apache-2.0 include Kubernetes, Supabase, and Prometheus, all projects with heavy corporate backing and contribution from multiple companies that rely on the patent grant for protection.