1

I have read some topics about GPL, Docker images and distribution.

As far as I understand you have to provide the source code of all GPL licensed programs within a Docker image but not your own proprietary code within that image. If only the Dockerfile is shipped I do not have to provide the source code at all.

I was wondering now since the GPL does not consider a cloud service like GitHub as a distribution of Git, if the same is true for a cloud serivce based on a Docker image.

For example if I sell a service as a Docker image through AWS, would this be considered distribution from the GPL viewpoint?

1

As far as I understand you have to provide the source code of all GPL licensed programs within a docker image but not your own proprietary code within that image.

This is true insofar as your code is not part of the GPL software. If you write code that is part of the same work (under copyright law) as someone else's GPL-licensed code, then the GPL requires you to share the source code of everything that is part of that GPL-licensed work.

...if I sell a service as a docker image through AWS, would this be considered distribution from the GPLs viewpoint?

The important question to consider is: can GPL-licensed material from your container end up in a user's local computer memory?

In the case of GitHub and other web services, the answer is often "no": the GPL code receives input via a web service and then hands its output back to the web service for delivery to the user. At no point can a user view or download GPL-licensed material.

However, it is a different matter if your users have the ability to view binary GPL-licensed files (even clumsily, e.g., by viewing binary files encoded as text). This might happen if your offer a service (like remote access to a command shell) that as part of its operation allows the user to view the software that makes up the service. If there is ever a point at which a GPL-licensed binary file loads into the user's local computer memory, then distribution has taken place, and you have an obligation to provide corresponding source code for the binary components that the user is able to view.

  • "The important question to consider is: can GPL-licensed material from your container end up in a user's local computer memory?" is a very good explanation – MADforFUNandHappy Mar 26 '18 at 19:32
  • 1
    @MADforFUNandHappy This is sometimes a difficult question, but your container clearly looks like an aggregate of separate works (see this GPL FAQ item). I think it's quite clear that your PHP code is a separate work from the PHP interpreter, and the PHP interpreter is a separate work from every other piece of software on the system. If your system causes distribution of those separate pieces of software (even those that are GPL-licensed), it creates no obligation to share the source of your PHP scripts. – apsillers Mar 26 '18 at 19:32
  • I missed a part from your sentence "as someone else's GPL-licensed code", I agree they are separated – MADforFUNandHappy Mar 26 '18 at 19:35
5

For example if I sell a service as a docker image through AWS (Amazon Web Services), would this be considered distribution from the GPLs viewpoint ?

I would assume in this case that you have assembled custom images available for distribution. My test to determine when redistribution happens is when you pass the control baton. I guess that when someone buys your service, they get access to your image that they can then deploy to their own Amazon WS account.

At this stage, you have passed the control baton and effectively redistributed the image (whether it runs on AWS or not is not super relevant IMHO. Instead what matters is that you have transferred the control of the file(s) to your customer and therefore redistributed)

Once this happens, you are therefore the distributor (even though it may go through AWS pipes and hardware). And you are responsible to comply with whatever license requirements may exist with the code in this image. If there is GPL-licensed code (say a bash package) you would have to make sure that you have proper attribution and can provide the corresponding source code. There may be several other licenses that have attribution or source code redistribution requirements, etc. And FWIW the same would apply to a VM image instead of a Docker image.

  • you are right they will have access to the docker images so its distribution, I have debian 8 and mariaDB 10.2.13 running within my docker image, if I provide the source code for these versions publicly (e.g. downloadable from my website) I should be in compliance with the GPL ? – MADforFUNandHappy Mar 26 '18 at 21:02
  • @MADforFUNandHappy the devil is in the details: "downloadable from your web site" is a pretty vague term. And redistribution is only one part of license compliance. Attribution is another part. And there are possible differences between GPL 2 and 3 as well as other licenses (LGPL, etc) and all the license that require some form of attribution... Did you read the redistribution sections of the LGPL and GPL at least? – Philippe Ombredanne Mar 27 '18 at 21:41
  • I did, but I find it hard to understand how far it goes so I try to get clarification. You are of course correct, I will have to comply to all the different licenses and not just redistribution. For now I will only provide the Dockerfile (so that the software is downloaded and installed during setup of my own software) until I can fully comply to all the licenses in a prebuild docker image – MADforFUNandHappy Mar 28 '18 at 5:43
  • > For now I will only provide the Dockerfile That can may be work but you will still need to to consider the software that you actually redistribute too (e.g. the Docker image layers that you are effectively providing). As a side note, the actual license compliance of public docker images is a jolly mess... that's not an excuse for you not to comply, but you are not alone being faced with this issue. – Philippe Ombredanne Mar 30 '18 at 5:05

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.