OSADL Container Base Image: The basis for license compliant containers

Containers simplify deploying an application with all its dependencies while avoiding compatibility issues with other components of the target system. On the downside, fulfilling FOSS license obligations is more difficult for containers due to their layered structure and the lack of compliance material in public repositories.

Although every container is customized for its particular use and therefore comprises different software components, many are built on a so-called “base image” that provides essential system components. While license obligations for customized layers must be fulfilled individually by the distributor of the container, it seems obvious to apply the Open Source principle of sharing development of non-differentiating technologies and services to license obligations of container base images. Therefore, OSADL offers a container base image that is provided together with all required legal information and material needed to distribute it compliantly. In addition, instructions on how the image was created and how it can be updated are included. A company may build their individual container images on top of the OSADL base image and use the provided instructions to fulfill license obligations for the additional software to achieve license compliant container distribution.

This project was inspired by the discussion surrounding the presentation "Fulfilling license obligations of a Docker image may be less obvious than it appears" for the COOL edition of October 2020 by Armijn Hemel which can be found here and the ensuing legal opinion on "Do license obligations have to be complied with when distributing Dockerfiles?" by Dr. Till Jaeger that can be found here (member login required). In the meantime, another COOL edition in September 2021 presents, explains and exemplifies the use of the OSADL Base Image. Slides and video of this presentation can be found here.

For now, the OSADL Container Base Image is available as a Debian-based, a Ubuntu-based and an Alpine-based container image for various architectures. The Debian base image is additionally available as the minimal Debian slim image and as an extended variant that includes ca-certificates and openssl. The image can be imported into any Docker or compatible Podman installation. Instructions on how to do so are given in the documents below. In the future, further variants may be available. Please let us know which additional variants are most useful by writing to infoªosadl.org

In addition, the image is available in two versions:

1. For immediate source code delivery: All sources are included in the image. In addition, a note with legal information and rebuild instructions is included and displayed when starting the container interactively.


2. Binary-only image for delayed source code delivery with a written offer: Extracted compliance material and a note with legal information accompany the image and must be delivered along with it. In addition, the source packages including rebuild instructions for later delivery are provided.

In both cases, the legal information notice must be customized to reflect the distributor’s circumstances and must then accompany the base image when it is distributed.

The OSADL Container Base Image is provided as a tarball together with the required compliance material and some additional documentation with instructions of use, content of the image and a build manual on how the image was created.

Employees of OSADL member companies may login to the OSADL website and subsequently download the archive with the material described above from the following link.

Non-members may contact us at infoªosadl.org to obtain the image.

Please login using your member access data to display the download link for the OSADL Container Base Image.

As version 1 of the OSADL Container Base Image which includes the entire source material does not require additional documents, it is now also available via Docker Hub. You can find the overview of OSADL's Docker Repositories at https://hub.docker.com/r/osadl/.