Docker and Legal Compliance: Navigating the Containerized World
summary
Explains why distributing Docker images makes the distributor legally responsible and gives concrete controls: generate a software bill of materials listing dependency versions, licenses and source; prefer minimal single-service images or publish a Dockerfile-based build so users build locally; host artifacts in a private registry to ensure reproducible builds and simpler patching; add SPDX metadata and enforce checks in CI (example: GitHub Actions rejecting PRs with forbidden licenses); use image-layer scanners to produce SBOMs and catch incompatible licenses early.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:50Agenda
- 1:36Risk Management
- 3:17Legal Compliance
- 4:54Where is the responsibility
- 6:52Best practices
- 9:49Image fail
- 12:16Tools
related talks
52mRisk management: best practices for people with legal compliance to ship open source
45mOpen Source distributions in a cloud-native world: from a technical to a legal point of view
32mOpen Source Contributions in Today’s World
28mLicense is a Nuisance!
47mBuilding Trust in Open Source: A Practical Guide to Securing Your ...
25mOpen Source Compliance
31mLicense Compliance 101
46mSCA for Containers: The Good, the Bad, and the Truth