3

My question is explicitly not about the software in Docker images (that should be quite obvious) but about bundling open source software as docker images (-> Dockerfile + build / packing scripts + doku + entrypoint-skript + ...).

The official docker images repo (https://github.com/docker-library/official-images) is licensed under Apache 2.0. Great.

Unfortunately for most images on docker hub no one took the time to add any kind of license information. Let's say, the docker image (downloaded from docker hub) contains only open source software.

Am I (formally) allowed to:

  • use the image
  • modify the image (use as base image)
  • distribute my (modified) image (outside docker hub)
  • build the docker image

?

  • 1
    I'm really sorry, but you say your question is not about the software inside docker images, and then ask about software bundled inside docker images. Are you, or aren't you, asking about the licenses of all the included software? – MadHatter Jun 25 '18 at 9:59
  • 1
    I don't care about the software inside the docker image - so let's say everything is under some kind of open source license where we don't have to worry. A Dockerfile is some kind of "code". Creating a docker image from open source software is some kind of creation. So there is copyright. My question is about the license of e.g. the Dockerfile and how this affects the docker image. – AnnoSiedler Jun 25 '18 at 10:20
  • As far as I can see, bundling software as a docker image is not really different from creating a linux distribution. If you use a Linux distribution, there are Terms. For example you may not redistribute Ubuntu with modifications without having to recompile everything. (ubuntu.com/legal/terms-and-policies/…). How can I use a docker image without any term, which allow me to? – AnnoSiedler Jun 25 '18 at 10:23
  • 1
    But that example specifically refers to the licensing details of the included software, which by the terms of your question you don't wish to have considered. Might it be better to broaden the question to ask about the characteristic status of the four freedoms in the context of modern docker images, possibly considering a specific image? – MadHatter Jun 25 '18 at 10:28
  • No, the included software is licensed under gpl, bsd, apache and so on. Ubuntu has additional terms for their work (bundling software to a linux distribution). But never mind - found something in the docker terms of service. – AnnoSiedler Jun 25 '18 at 10:48
6

A container image (a file system that may include various copyrighted works) and the scripts to build these images (like a Dockerfile) are separate works. In general, the license of the included software is completely unrelated to the license of the build scripts.

diagram illustrating licensing relationships: images can inherit some licensing terms from their build scripts, from their base images, and from the included software

If you build upon a build script, you are bound by the license of that build script (but this is not how Dockerfiles are typically used). If there is no explicit license, you have no right to distribute or modify the build script. So you cannot modify or distribute arbitrary Dockerfiles from GitHub unless you have a license.

If you build upon an already built base image, you have to comply with the license of that base image AND with the licenses of all included software. If the image is not offered under an express or implied license then you have no rights to copy and use it. In practice many images will directly or indirectly contain GPL'ed software such as the Linux kernel. This could indicate that the image is an aggregate work. (I do not think technical details such as image layering are legally relevant here.) Under the terms of the GPL the image author must not prevent you from exercising your rights under the GPL with regards to the GPL'ed software in the aggregate.

It is however not necessary to notify you of the exact licensing status of all included software on a download page or similar, so the lack of license indication on the Docker Hub or similar places is mostly fine. You can be expected to look into the documentation for licensing information. Some platforms like the Docker Hub or GitHub may provide a default license grant. Note that some users might offer images under the default license without having the necessary rights (e.g. the Docker Hub default license looks excessively permissive for most software).

Note also that some images may include more restrictive licenses. It is your responsibility to check this prior to use. For example, there may be additional trademark requirements.

It can also be the case that the license on the Docker Hub page is misleading. E.g. I found an unofficial image with the Oracle JDK software that is only offered under an Oracle EULA, yet the Docker Hub page mentions the MIT license. It is correct that the build scripts are offered under the MIT, but this license cannot apply to the software in the image.

So to summarize your questions:

  • Can you use the image? Typically yes.

    Strictly speaking, only if you comply with the license of the image and the licenses of all included software. In absence of a license, all rights are reserved. It is your responsibility to check the license status.

  • Can you modify the image (use as base image)? Typically yes.

    Strictly speaking, only if this is allowed by the license of the base image and the licenses of all affected software.

  • Can you distribute the (modified) image (outside docker hub)? Typically yes but there may be additional requirements.

    Strictly speaking, only if this is allowed by the license of the base image and the licenses of all included software.

  • Can you build the docker image (from the Dockerfile)? Typically yes.

    Strictly speaking, only if this is allowed by the license of the build scripts, the licenses of the base image, and the licenses of all included software.

From what I see, image licensing is a bit of a mess. You will have to exercise due diligence when choosing base images for anything other than purely personal use. Building your own images aside from some official base images may be a wise choice.

  • I like the "take-away" style of questions and answers, the last part of this answer. Can we make parts of the text bold, and maybe add some more details? I.e., "Can you use a docker image downloaded from docker hub?" as this is what the (first) answer refers to, if I understand correctly. – Nikos Alexandris Nov 13 '18 at 14:08
  • @Nikos If you want to you can make an edit to highlight important parts. I don't have the time to flesh out the answer with more details. If you are uncertain about some aspect, please ask a new question. – amon Nov 15 '18 at 9:46
2

Okay, found it!

https://www.docker.com/docker-terms-service

6.4 The Service allows you to specify or upload the terms under which other users of the Service will be licensed to use your User Content. If you do not specify or upload such license terms with respect to any User Content, you hereby grant to any other users of the Service, a non-exclusive license to access, download, use, modify or otherwise exploit such part of your User Content for any personal or business purposes.

Totally overlooked this one.

But the way I see it, going to GitHub, downloading any Dockerimage (without license) and building the image is a copyright-violation. I don't know similar section in GitHubs terms of service.

Edit: Additionally I'm not really sure about publishing a modified image.

1

There are separate issues here.

  • The license(s) of the individual software product(s) that are part of the image
  • The license(s) of the various scripts used to assemble the above pieces into an image
  • The collection as such (i.e., the selection of the particular pieces used, and their arrangement)

Each has a license attached to it, and any use must comply with all of them. Most often the assembly is done by off-the-shelf scripts, which (by minimal sanity of the people distributing the build-your-image stuff will probably be permissive, or at very least place almost no restrictions on the images), while the selection and arrangement is your work, and you call the shots (and should make the license on your work explicit).

0

Most answer cover the topic but I see they missed an important note

Most official docker hub images and many community images are based on ubuntu which has a strict IP policy

https://www.ubuntu.com/legal/intellectual-property-policy

And it clearly state that you are not allowed to redistribute or run cloud images. What is allowed is to redistribute original cd/vm images with same package selection and same manual installer

You can redistribute Ubuntu, but only where there has been no modification to it. ... You can modify Ubuntu for personal or internal use ... You can redistribute Ubuntu in its unmodified form, complete with the installer images and packages provided by Canonical (this includes the publication or launch of virtual machine images).

Since docker is similar to vm and since it has different installer and different selection then you need to buy license from canonical.

And since they inject the word ubuntu trade mark in every package you need to recompile every package

Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries.

Docker might have bought exceptions or partnership with canonical, but you did not.

Those terms are controversial and maybe invalid because if ubuntu imposed restrictions on a free software then its license to obtain it is revoked in the first place. Not to mention patents. For more information refer to articles by figures like

  • 1
    The IP policy you are quoting does not apply to the components. Read the next sentence of what you are quoting: "This does not affect your rights under any open source licence applicable to any of the components of Ubuntu." For example, if you installed Firefox with Ubuntu, you are allowed to redistribute Firefox (e.g. as part of a Docker image) according to that software's license. – Brandin Apr 29 at 9:43
  • no this is not correct. you can read Jonathan Riddell (kubuntu founder) and many figures like him on this. basically free software covers copyright and ubuntu uses workaround via patents and trademarks. – Muayyad Alsadi Apr 29 at 14:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.