Skip to content

Proper usage of org.opencontainers.image.licenses #1257

Open
@anthops

Description

@anthops

The spec defines the following:

org.opencontainers.image.licenses License(s) under which contained software is distributed as an SPDX License Expression.

This clearly states that it needs to list the licenses of all contained software. So for example, if the container just so happens to contain a GPL license it needs to be specified. However, it appears that nobody actually uses this field properly.

Take Microsoft for example, where their developer-platform-website Dockerfile sets the label to just MIT.

Another example is Hashicorp Vault setting vault-k8s' license label to MPL-2.0.

From my understanding, org.opencontainers.image.licenses should have a plethora of different licenses for all the random things inside of them. Containers are aggregations and don't have a license themselves. Why are so many people and even large organisations misinterpreting this and using the field incorrectly?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions