I am building some docker image which is using alpine:3.10 as base image. When I scan my built image for any license violation using whitesource scanner, I am getting lot of libraries which are licensed under GPL 2.0, They are all part of the base alpine image I have used.

Libraries having GPL 2.0 license

I just want to know whether it would be safe for me to use this image for commercial purposes ?


I just want to know whether it would be safe for me to use this image for commercial purposes ?

Yes, it is safe to use this image for commercial purposes, assuming the commercial application is a normal userland application and there are no dependencies on other GPL libraries.

The packages noted in the screenshot are all either system libraries of a typical Linux system (and those have the possibility of using the LGPL or similar licenses, which are friendly to commercial applications), or they are infrastructure packages that provide common unix/linux tools and your application shouldn't be dependent on exactly that package being used.

The simple fact that a container contains GPL packages does not affect in any way the possibility to also have commercial software in the same container.

  • Thanks for the answer, You are right, our application functionality is completely independent on these libraries which are being pulled because of the alpine base image, however I was reading a lot about this issue and the general sense I got from is that if you are using a GPL 2.0 licensed software then you have to make your source code available as open source, is this valid ?
    – Aak
    Jul 16 '19 at 7:48
  • 1
    @AlokKumar: Yes, that is generally valid. But there is a difference between "using" and "coexisting in the same container" and there are multiple 'flavors' of the GPL2.0 license and not all of them require making your code available as open source in all circumstances. Jul 16 '19 at 8:05
  • Where do I get details of these 'flavors' of GPL 2.0 license ?
    – Aak
    Jul 16 '19 at 8:13
  • @AlokKumar: That is a bit too involved for a comment. I would recommend you ask that as a new question. Jul 16 '19 at 8:19

The GPL allows commercial use, and allows you to distribute GPL software side by side with proprietary software. Issues only arise if your proprietary software includes GPL components or is derived from GPL components – then, your software would have to be available under the GPL as well.

Linux systems commonly include lots of GPL software. Merely running your proprietary software in a Linux environment does not make your software derived from these GPL programs.

A container image isn't a single program that links all its contents. Instead, it is more like a file system image, and can be treated similarly to a ZIP archive or an USB thumb drive that includes software. We can therefore look at all the programs in the image separately.

  • You may distribute software with different licenses side by side.
  • You must comply with the license for every software in the image.
    • For the GPL-covered software, this means providing the recipient a copy of the license and the source code for that software.
    • No open source license extends its effects to unrelated software in the same image.

Note that some Linux distros like Debian have built-in mechanisms for managing licenses and source code for installed packages, which simplifies compliance.

  • so in my scenraio, I would need to create a license file and inside it I should mention the we have used these GPL 2.0 libraries and put it inside our container ?
    – Aak
    Jul 16 '19 at 9:12
  • @AlokKumar If you want to give your container image to someone else, then yes, it would make sense to create a list of all included software and their licenses. You can look at web browsers like Firefox or Chrome for good examples on how to do that. If you include GPL software, you must also provide the source code for that software. A better alternative might be to only use that image internally and not give anyone else a copy of the image.
    – amon
    Jul 16 '19 at 12:29
  • Yes we have lot of such images which are part of our commercial application based on cloud.
    – Aak
    Jul 17 '19 at 4:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.