Is this project completely open source or is the code for some of its key components being held back?
The whole thing is opensource: https://github.com/penpot/penpot
Both backend and frontend are in there. While they provide a docker image for testing I have actually installed it on Triton / SmartOS (ie. Illumos) in a zone. So I can confirm all the sources are there.