Is using LGPL 1.2 or EPL 1.0 licensed jar allowed in proprietary software in Docker?

Question

I am creating a proprietary java application which uses some open source jars licensed with LGPL 2.1 or EPL 1.0. I am deploying the application in docker container with all jars inside it.

Is there any issue with licensing? Does this violate any of the terms of those licences?

Answer 1

My understanding is that a container image is equivalent to a Zip archive: just a collection of other files. The terms under which this collection may be used and distributed depends on the contents of this collection.

TL;DR: your obligations depend on how you're going to use the image:

• If you only use the container image internally (e.g. by using Docker just as a deployment tool) then you have no further obligations.
• But if you want to give other people a copy of the image, then you may need to publish the source code of some components in this image. License compliance in such a scenario is possible, but quite tedious.

A Docker image will typically contain a complete Linux userland which can be quite a lot of software. You do not only have to comply with the licenses of the software you added to that image, but also with the licenses of the software from lower image layers.

As long as all the software in the image is either copyrighted by you or under an OSI-approved open source license, you may use the software for any purpose, such as running it for commercial purposes on a server. However, these licenses may require you to provide attributions or source code when you give someone else a copy of the software, for example if you publish or license your image. In particular, the LGPL and EPL licenses require that you make the source code of these components available (but not the source code of your own code).

Again, this also extends to software in base image layers so before publishing an image you should carefully check what software is included in them. This is tedious, so it might be easier to build your own images completely from scratch without using any third party image as base.

Corollary: many images you can pull are likely in violation of their license, as nearly all images contain GPL covered components like Busybox but I've never seen the Corresponding Source being offered on Docker Hub. If you see a Docker image being advertised under some license (e.g. the MIT license), you should understand this license as only applying to the Dockerfile itself, but not to all the software in the image, and therefore also not to the image file itself!