5 ms·

Your Ubuntu-based container image is probably a copyright violation

44 points by justincormack 11y ago

morninj 11y ago
> is probably a copyright violation No, it's not. The relevant language (which this post cites) from the Canonical IP policy deals with trademarks, not copyrights: Any redistribution of modified versions of Ubuntu must be approved, certified or provided by Canonical if you are going to associate it with the Trademarks. Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries. Canonical is trying to prevent third parties from passing off forks as genuine versions of Ubuntu. (Not that I agree with its approach, but that's what this language does.) Distributing a Docker image to your own web server doesn't "associate it with the Trademarks." (edit: formatting)
- shadeslayer 11y ago
  All Ubuntu packages contain the string "Ubuntu" in their version string, could entirely be considered copyright violation since you're shipping a trademark.
- mjg59 11y ago
  If you're only distributing internally then you're fine, but that's because it's explicitly called out as permitted - the image is still associated with the trademarks.
  - morninj 11y ago
    You're confusing "distributing a copy of Ubuntu to run on a server you own" with "distributing a copy of Ubuntu for the public to download." The former is not a trademark violation. Nor does it violate the terms of the Canonical IP policy quoted above.
    - mjg59 11y ago
      No, I said that the former was explicitly permitted. Whether it violates the section of the policy you quoted is therefore irrelevant. But you appear to be asserting that the phrase "associate it with the Trademarks" has something to do with trademark law, which doesn't seem clear.
stephenr 11y ago
I've asked on the blog but presumably this also affects Vagrant images too? I've never understood the appeal of Ubuntu on the server, and stuff like this just reinforces that opinion.
- justincormack 11y ago
  I guess so it is the same situation as far as I can see.
- justuk 11y ago
  It's appealing because Ubuntu is the distribution that people are most familiar with. These sorts of issues aren't seen as important outside of the legal niche. It's like when you install a copy of Debian and look for Firefox, but instead see something called Iceweasel - I assume that still happens? The name is so passive aggressive.
- jerrac 11y ago
  As a sysadmin I've used SLES, CentOS, and Ubuntu on my servers. As far as getting what I need to do done, Ubuntu wins every time. I have played with Debian on virtualbox vm's a bit, but it's never "just worked" for me. Also, since I don't distribute any images, the IP issue does not effect me at all. So why exactly would this issue matter in regards to using Ubuntu on the server?
  - noir_lord 11y ago
    Agreed, used Ubuntu on servers since 10.04LTS and they've been absolutely spot on, zero complaints. It's also the (ime) best supported server distro in terms of third party packages. In addition the LTS versions work well with vagrant and spinning up a dev box from a bash script is trivial (it's a couple of hundred lines of bash script most of which is reusable across projects). If we where a massive shop I'd probably look at CentOS but so far I've not had the need.
    - jerrac 11y ago
      If I were hosting an app that wouldn't require upgrading to up to date versions of whatever language it runs on, and I didn't want to upgrade the OS for 10 years or so, I'd look at CentOS. But with how rapidly PHP/Ruby/Python/Java/etc advance, I prefer an OS that mostly keeps up with their latest versions. And Ubuntu's PPA system makes that a lot easier if you can find a PPA you trust. When I first started, my predecessor had been fighting with upgrading PHP so that we could run Drupal on CentOS... 'Course he was still on hardware blades, not VM's. So he couldn't easily switch OS's. I got to move everything to VM's, and that's when I switch everything over to Ubuntu. After figuring out that CentOS wasn't the direction I wanted to go.
lightlyused 11y ago
Why I stick with either Debian or Gentoo. Ubuntu on the desktop, sure, but for the server hell no. I now have another reason to stay far away from redhat based distributions for anything, yes even centos.
x5n1 11y ago
i don't see them upholding this violation in court so i will carry on.
- JupiterMoon 11y ago
  Trademarks are "enforce it or lose it". They may have to if they want to keep their trademark (stupid system I know). EDITED s/use/enforce/ Thank you lightlyused
  - x5n1 11y ago
    yeah let's see a test case and then i'll worry about it.
    - JupiterMoon 11y ago
      The only issue is if they make you the test case.
  - lightlyused 11y ago
    They are using it, perhaps you mean "enforce it or lose it"?
    - JupiterMoon 11y ago
      Thanks for correction. I edited it.
  - geofft 11y ago
    One of the things you get with trademarks is a right to license them. There's no law that stops Canonical from granting a trademark license to anyone who uses or depends on unmodified Ubuntu binaries.
    - JupiterMoon 11y ago
      Have they licensed it? If so no worries otherwise...
facorreia 11y ago
A comment[1] in the original article points out that even deriving from Debian is risky from the perspective of both copyright and trademark litigation. > (...) Whether either case stands any chance in court is not clear at all, though, but that's the point: There's a non-zero chance of success for Canonical. Thus, unless you have a large legal department and a budget to match, it's now just no longer a sane business decision to have this doubt looming over your product. You'll want to stay clear of this risk. (...) I believe Debian should take action. [1] http://mjg59.dreamwidth.org/36312.html?thread=1419480#cmt1419480 http://mjg59.dreamwidth.org/36312.html?thread=1419480#cmt141...
jessaustin 11y ago
If you generate a container image that is not a 100% unmodified version of Ubuntu (ie, you have not removed or added anything), Canonical insist that you must ask them for permission to distribute it. The only alternative is to rebuild every binary package you wish to ship... other than ones whose license explicitly grants permission to redistribute binaries and which do not permit any additional restrictions to be imposed upon the license grants - so any GPLed material is fine. So, as usual, GPL software, with its strong user protections, is more practical for "business" use.
- akerl_ 11y ago
  That's a bit of leap. For this particular issue, which seems to be of questionable tenacity (is there any example of legal precedent for a company successfully enforcing such a clause in this kind of situation), GPL would "solve" the problem, in the same way that MIT or BSD or whatever would solve it: by having a different license that didn't include the cited condition. GPL also introduces the other fun elements, chief among them being the "viral" nature, and I'm sure we opinionated HN folks could debate for weeks on whether the GPL as a whole is "more practical for business use".
  - jessaustin 11y ago
    I'm not sure whether you understood what I was trying to say. For any particular package that had originally had an MIT or BSD license, Canonical's requirement to remove trademarks and rebuild would apply. However, since GPL forbids that sort of requirement for derived works, and it was Canonical that happily sprinkled their trademarks everywhere in the first place, Canonical cannot make that requirement with respect to GPL packages.
grhmc 11y ago
Given the layer which provides ubuntu is unmodified, how is it possibly a copyright violation? I have layers on top, yes, but you can still get to the original distribution.

44 points by justincormack 11y ago

> is probably a copyright violation No, it's not. The relevant language (which this post cites) from the Canonical IP policy deals with trademarks, not copyrights: Any redistribution of modified versions of Ubuntu must be approved, certified or provided by Canonical if you are going to associate it with the Trademarks. Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries. Canonical is trying to prevent third parties from passing off forks as genuine versions of Ubuntu. (Not that I agree with its approach, but that's what this language does.) Distributing a Docker image to your own web server doesn't "associate it with the Trademarks." (edit: formatting)

shadeslayer 11y ago
All Ubuntu packages contain the string "Ubuntu" in their version string, could entirely be considered copyright violation since you're shipping a trademark.
mjg59 11y ago
If you're only distributing internally then you're fine, but that's because it's explicitly called out as permitted - the image is still associated with the trademarks.
- morninj 11y ago
  You're confusing "distributing a copy of Ubuntu to run on a server you own" with "distributing a copy of Ubuntu for the public to download." The former is not a trademark violation. Nor does it violate the terms of the Canonical IP policy quoted above.
  - mjg59 11y ago
    No, I said that the former was explicitly permitted. Whether it violates the section of the policy you quoted is therefore irrelevant. But you appear to be asserting that the phrase "associate it with the Trademarks" has something to do with trademark law, which doesn't seem clear.

stephenr 11y ago

I've asked on the blog but presumably this also affects Vagrant images too? I've never understood the appeal of Ubuntu on the server, and stuff like this just reinforces that opinion.

justincormack 11y ago
I guess so it is the same situation as far as I can see.
justuk 11y ago
It's appealing because Ubuntu is the distribution that people are most familiar with. These sorts of issues aren't seen as important outside of the legal niche. It's like when you install a copy of Debian and look for Firefox, but instead see something called Iceweasel - I assume that still happens? The name is so passive aggressive.
jerrac 11y ago
As a sysadmin I've used SLES, CentOS, and Ubuntu on my servers. As far as getting what I need to do done, Ubuntu wins every time. I have played with Debian on virtualbox vm's a bit, but it's never "just worked" for me. Also, since I don't distribute any images, the IP issue does not effect me at all. So why exactly would this issue matter in regards to using Ubuntu on the server?
- noir_lord 11y ago
  Agreed, used Ubuntu on servers since 10.04LTS and they've been absolutely spot on, zero complaints. It's also the (ime) best supported server distro in terms of third party packages. In addition the LTS versions work well with vagrant and spinning up a dev box from a bash script is trivial (it's a couple of hundred lines of bash script most of which is reusable across projects). If we where a massive shop I'd probably look at CentOS but so far I've not had the need.
  - jerrac 11y ago
    If I were hosting an app that wouldn't require upgrading to up to date versions of whatever language it runs on, and I didn't want to upgrade the OS for 10 years or so, I'd look at CentOS. But with how rapidly PHP/Ruby/Python/Java/etc advance, I prefer an OS that mostly keeps up with their latest versions. And Ubuntu's PPA system makes that a lot easier if you can find a PPA you trust. When I first started, my predecessor had been fighting with upgrading PHP so that we could run Drupal on CentOS... 'Course he was still on hardware blades, not VM's. So he couldn't easily switch OS's. I got to move everything to VM's, and that's when I switch everything over to Ubuntu. After figuring out that CentOS wasn't the direction I wanted to go.

lightlyused 11y ago

Why I stick with either Debian or Gentoo. Ubuntu on the desktop, sure, but for the server hell no. I now have another reason to stay far away from redhat based distributions for anything, yes even centos.

x5n1 11y ago

i don't see them upholding this violation in court so i will carry on.

JupiterMoon 11y ago
Trademarks are "enforce it or lose it". They may have to if they want to keep their trademark (stupid system I know). EDITED s/use/enforce/ Thank you lightlyused
- x5n1 11y ago
  yeah let's see a test case and then i'll worry about it.
  - JupiterMoon 11y ago
    The only issue is if they make you the test case.
- lightlyused 11y ago
  They are using it, perhaps you mean "enforce it or lose it"?
  - JupiterMoon 11y ago
    Thanks for correction. I edited it.
- geofft 11y ago
  One of the things you get with trademarks is a right to license them. There's no law that stops Canonical from granting a trademark license to anyone who uses or depends on unmodified Ubuntu binaries.
  - JupiterMoon 11y ago
    Have they licensed it? If so no worries otherwise...

facorreia 11y ago

A comment[1] in the original article points out that even deriving from Debian is risky from the perspective of both copyright and trademark litigation. > (...) Whether either case stands any chance in court is not clear at all, though, but that's the point: There's a non-zero chance of success for Canonical. Thus, unless you have a large legal department and a budget to match, it's now just no longer a sane business decision to have this doubt looming over your product. You'll want to stay clear of this risk. (...) I believe Debian should take action. [1] http://mjg59.dreamwidth.org/36312.html?thread=1419480#cmt1419480 http://mjg59.dreamwidth.org/36312.html?thread=1419480#cmt141...

jessaustin 11y ago

If you generate a container image that is not a 100% unmodified version of Ubuntu (ie, you have not removed or added anything), Canonical insist that you must ask them for permission to distribute it. The only alternative is to rebuild every binary package you wish to ship... other than ones whose license explicitly grants permission to redistribute binaries and which do not permit any additional restrictions to be imposed upon the license grants - so any GPLed material is fine. So, as usual, GPL software, with its strong user protections, is more practical for "business" use.

akerl_ 11y ago
That's a bit of leap. For this particular issue, which seems to be of questionable tenacity (is there any example of legal precedent for a company successfully enforcing such a clause in this kind of situation), GPL would "solve" the problem, in the same way that MIT or BSD or whatever would solve it: by having a different license that didn't include the cited condition. GPL also introduces the other fun elements, chief among them being the "viral" nature, and I'm sure we opinionated HN folks could debate for weeks on whether the GPL as a whole is "more practical for business use".
- jessaustin 11y ago
  I'm not sure whether you understood what I was trying to say. For any particular package that had originally had an MIT or BSD license, Canonical's requirement to remove trademarks and rebuild would apply. However, since GPL forbids that sort of requirement for derived works, and it was Canonical that happily sprinkled their trademarks everywhere in the first place, Canonical cannot make that requirement with respect to GPL packages.

grhmc 11y ago

Given the layer which provides ubuntu is unmodified, how is it possibly a copyright violation? I have layers on top, yes, but you can still get to the original distribution.