Licensing

Before diving into this page, it is worth reviewing existing guidance and information from industry or standards organizations on container licensing. A good place to start is with the Linux Foundation blog post.

This software uses the following components with their associated licensing also captured:

All licences (with the exception of notices.txt for our bespoke code, as it is automatically generated) are in the CMOS source repository and the container in the /licenses directory.

A statement is printed out to standard output/console at start up to indicate acceptance of licensing and where you can find them all.

A simple helper script is provided as well to build without any proprietary components.

Some of the components can also provide licensing information via a specific endpoint or API call, an example would be Grafana.

The various external components are reused directly from the container layers already published by the entities responsible (e.g. Grafana publish the Loki image layers): this container is not redistributing or repackaging them but using as-is.

The container layers used in the deliverable image are:

The base image for this container is the Nginx one.

These can all be seen in this example excerpt from the Dockerfile:

In each case we use or copy the contents direct from the container layer provided remotely, i.e. published by the provider.

In addition to the container layers there is reuse of some aspects of configuration in the Dockerfile from each component, i.e. source and binary usage. The licensing links for all the source code are as follows:

This is direct reuse but combined into a single file with minimal modification (e.g. addition of comments or removal of unnecessary lines).

A good example is Loki configuration taken directly from the offical Loki Dockerfile:

The Loki binary requires some extra configuration but this is taken directly from the official Dockerfile "recipe" for each component. We do comment out unnecessary aspects just to keep aligned with the original and for simpler updates.

CMOS also contains some components written in Golang and other languages which use various open source libraries. Their licenses are included in notices.txt in the container images, as well as on GitHub. If the Couchbase Cluster Monitor is included, its notices.txt file can be found in the same locations and online.

Licensing documentation of the various container images is not always present on the DockerHub pages or it is linked to documentation site so requires a bit of analysis to extract. If the container image does not provide a license then the initial assumption is it is the same as the source license.

However, the whole image needs to be considered including all software it covers as this is our responsibility - rather then just relying on what the image says. To this end a Tern helper script is also available in the repository.

The full Tern report can be found here. Note that the Tern report is a full scan of everything in the container and not necessarily how it is used or linked.