Emerging Automated License Compliance for Containers
summary
Project maintains over a hundred Docker images with up to five releases a year and discovers that full Ubuntu bases make compliance intractable so it creates GPLv3-free base images for Java 11 and Python 3 and shrinks images. Early tooling Tern fails due to docker socket and overlayfs requirements so migration to ScanCode.io adds REST APIs pipelines and better Alpine handling by parsing apk buildrecipes to recover copyrights. Plans include Gerrit/Jenkins gating, SBOMs and public compliance reports plus a dogfish‑style layer dependency view without docker.sock.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 0:54Problem Statement
- 2:04OnApp
- 3:02How it all started
- 5:05How to start
- 7:08What was missing
- 8:52Turn
- 15:06Where are we going
- 17:07Garage Integration
- 17:42Final Compliance Report
- 18:24Summary
related talks
18mPractical End-to-End Container Security at Scale
28mLicense is a Nuisance!
27mRethinking Compliance in a Containerised World
21mSecuring Dockerized apps in the Microsoft ecosystem
44mDocker for DevSecOps
35mSecuring Containers by Breaking In
32mA Security State Of Mind: Compliance and ...
40m"Willy Wonka and the Secure Container Factory"