docs: stop advertising Docker artifacts as MIT licensed#415
Open
DivyamTalwar wants to merge 1 commit into
Open
docs: stop advertising Docker artifacts as MIT licensed#415DivyamTalwar wants to merge 1 commit into
DivyamTalwar wants to merge 1 commit into
Conversation
The Docker deployment guide and official Dockerfile still advertised MIT licensing even though the image bundles components with multiple license sources. Remove the stale top-level MIT signals and point Docker readers to repository license files plus bundled package metadata rather than publishing an incomplete single-license OCI expression. Constraint: Use repository license files and package manifests as source references; the Docker image copies ee/, fde, and morphik_rust, which carry distinct licensing surfaces. Rejected: Replace the OCI label with BUSL-1.1 | the published image includes other bundled components, so BUSL-1.1 alone would be incomplete. Rejected: Change bundled Rust or fde package license metadata here | package metadata is copied into the image but may be component-specific and needs separate maintainer/legal review. Confidence: high Scope-risk: narrow Directive: Do not restore an OCI license annotation until maintainers/legal define the complete image license expression. Tested: rg -n -F -- "- License: The Docker image bundles components under multiple licenses. Review [LICENSE](./LICENSE), [ee/LICENSE](./ee/LICENSE), and bundled package metadata before production use." DOCKER.md; if rg -n "License:\s*MIT|org.opencontainers.image.licenses=\"MIT\"|org.opencontainers.image.licenses=\"BUSL-1.1\"" dockerfile DOCKER.md -S; then echo unexpected top-level Docker license reference found; exit 1; else echo no stale top-level Docker doc/OCI label reference found; fi; docker buildx build --check -f dockerfile .; git diff --check origin/main...HEAD Not-tested: legal review; full Docker image build; historical published image metadata; bundled package license metadata alignment
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DOCKER.mdlisted Morphik Core as MIT licensed, and the official Docker image label used the same stale MIT license metadata. The official Docker image bundles components with multiple license sources. This removes the top-level Docker guide and OCI-label MIT signals and points Docker readers to repository license files plus bundled package metadata instead of inventing an incomplete image license expression.Changes
License: MITline inDOCKER.md.org.opencontainers.image.licenses="MIT"label from the official Dockerfile instead of replacing it with an incomplete single-license expression.Why this matters
Operators and contributors often check deployment docs and image metadata before running software. Stale top-level MIT statements in those surfaces can create avoidable confusion around use, distribution, and compliance scanning.
Tests
Commands run:
rg -n -F -- "- License: The Docker image bundles components under multiple licenses. Review [LICENSE](./LICENSE), [ee/LICENSE](./ee/LICENSE), and bundled package metadata before production use." DOCKER.md- passed.if rg -n "License:\\s*MIT|org.opencontainers.image.licenses=\"MIT\"|org.opencontainers.image.licenses=\"BUSL-1.1\"" dockerfile DOCKER.md -S; then echo "unexpected top-level Docker license reference found"; exit 1; else echo "no stale top-level Docker doc/OCI label reference found"; fi- passed.docker buildx build --check -f dockerfile .- passed; Dockerfile static check completed with no warnings.git diff --check origin/main...HEAD- passed.Not run:
Risk
Risk level: low
This is a documentation and Docker image metadata correction with no runtime behavior change. Removing the OCI license annotation means registry or compliance views may show no machine-readable image license until maintainers define a complete image-level licensing strategy, which is safer than publishing a known-incomplete single-license expression. Rollback is a direct revert of the
DOCKER.mdanddockerfileedits.Issue
No existing issue. This was discovered during repository analysis.
Notes for maintainers
I intentionally avoided adding legal interpretation beyond the repository's existing license files.
This intentionally leaves bundled package metadata, such as the
morphik_rustcrate'slicense = "MIT"declaration andfde's package license metadata, out of scope even though those packages are copied into the image. Those package surfaces may be intentionally component-specific and should be reviewed separately by maintainers or legal counsel.This updates repository source files for future image builds. It does not change metadata on historical image tags that were already published.
Follow-up opportunities intentionally left out of scope: define a complete image-level machine-readable licensing strategy, consider SBOM/provenance publication for container images, and review other OCI labels such as the static image version.