From their GitHub:
cpak installs applications from OCI images while keeping package metadata in a Git repository. It provides native desktop integration, shared content-addressed layers, atomic updates and a rootless Linux sandbox from one Go binary.
It seems interesting. I’ve never heard of it before, but apparently Bottles packages with cpak along with flatpak. The main reason I use flatpaks are its sandboxing capabilities, so it would be cool if cpak brings new stuff to the table while matching or overpassing the sandboxing capabilities.
I don’t think so, this still would let them host it so long as don’t have a “competing fork”. I’ve heard of licenses like Server Side Public License (SSPL) that do you what you say. Basically, that license requires all the infrastructure around the software to be open source to. So something like AWS couldn’t host the software without first open sourcing all their infrastructure.