Your Ubuntu-based container image is probably a copyright violation | Hacker News Reader

Your Ubuntu-based container image is probably a copyright violation

mjg59.dreamwidth.org

44 pointsjustincormack33 comments

> is probably a copyright violation

No, it's not. The relevant language (which this post cites) from the Canonical IP policy deals with trademarks, not copyrights:

Any redistribution of modified versions of Ubuntu must be approved, certified or provided by Canonical if you are going to associate it with the Trademarks. Otherwise you must remove and replace the Trademarks and will need to recompile the source code to create your own binaries.

Canonical is trying to prevent third parties from passing off forks as genuine versions of Ubuntu. (Not that I agree with its approach, but that's what this language does.) Distributing a Docker image to your own web server doesn't "associate it with the Trademarks."

(edit: formatting)

If you're only distributing internally then you're fine, but that's because it's explicitly called out as permitted - the image is still associated with the trademarks.

You're confusing "distributing a copy of Ubuntu to run on a server you own" with "distributing a copy of Ubuntu for the public to download." The former is not a trademark violation. Nor does it violate the terms of the Canonical IP policy quoted above.

No, I said that the former was explicitly permitted. Whether it violates the section of the policy you quoted is therefore irrelevant. But you appear to be asserting that the phrase "associate it with the Trademarks" has something to do with trademark law, which doesn't seem clear.

All Ubuntu packages contain the string "Ubuntu" in their version string, could entirely be considered copyright violation since you're shipping a trademark.

A comment[1] in the original article points out that even deriving from Debian is risky from the perspective of both copyright and trademark litigation.

> (...) Whether either case stands any chance in court is not clear at all, though, but that's the point: There's a non-zero chance of success for Canonical. Thus, unless you have a large legal department and a budget to match, it's now just no longer a sane business decision to have this doubt looming over your product. You'll want to stay clear of this risk. (...) I believe Debian should take action.

[1] http://mjg59.dreamwidth.org/36312.html?thread=1419480#cmt141...

If you generate a container image that is not a 100% unmodified version of Ubuntu (ie, you have not removed or added anything), Canonical insist that you must ask them for permission to distribute it. The only alternative is to rebuild every binary package you wish to ship... other than ones whose license explicitly grants permission to redistribute binaries and which do not permit any additional restrictions to be imposed upon the license grants - so any GPLed material is fine.

So, as usual, GPL software, with its strong user protections, is more practical for "business" use.

That's a bit of leap. For this particular issue, which seems to be of questionable tenacity (is there any example of legal precedent for a company successfully enforcing such a clause in this kind of situation), GPL would "solve" the problem, in the same way that MIT or BSD or whatever would solve it: by having a different license that didn't include the cited condition.

GPL also introduces the other fun elements, chief among them being the "viral" nature, and I'm sure we opinionated HN folks could debate for weeks on whether the GPL as a whole is "more practical for business use".

I'm not sure whether you understood what I was trying to say. For any particular package that had originally had an MIT or BSD license, Canonical's requirement to remove trademarks and rebuild would apply. However, since GPL forbids that sort of requirement for derived works, and it was Canonical that happily sprinkled their trademarks everywhere in the first place, Canonical cannot make that requirement with respect to GPL packages.

Given the layer which provides ubuntu is unmodified, how is it possibly a copyright violation? I have layers on top, yes, but you can still get to the original distribution.

I've asked on the blog but presumably this also affects Vagrant images too?

I've never understood the appeal of Ubuntu on the server, and stuff like this just reinforces that opinion.

As a sysadmin I've used SLES, CentOS, and Ubuntu on my servers. As far as getting what I need to do done, Ubuntu wins every time. I have played with Debian on virtualbox vm's a bit, but it's never "just worked" for me.

Also, since I don't distribute any images, the IP issue does not effect me at all. So why exactly would this issue matter in regards to using Ubuntu on the server?

Agreed, used Ubuntu on servers since 10.04LTS and they've been absolutely spot on, zero complaints.

It's also the (ime) best supported server distro in terms of third party packages.

In addition the LTS versions work well with vagrant and spinning up a dev box from a bash script is trivial (it's a couple of hundred lines of bash script most of which is reusable across projects).

If we where a massive shop I'd probably look at CentOS but so far I've not had the need.

If I were hosting an app that wouldn't require upgrading to up to date versions of whatever language it runs on, and I didn't want to upgrade the OS for 10 years or so, I'd look at CentOS.

But with how rapidly PHP/Ruby/Python/Java/etc advance, I prefer an OS that mostly keeps up with their latest versions. And Ubuntu's PPA system makes that a lot easier if you can find a PPA you trust.

When I first started, my predecessor had been fighting with upgrading PHP so that we could run Drupal on CentOS... 'Course he was still on hardware blades, not VM's. So he couldn't easily switch OS's. I got to move everything to VM's, and that's when I switch everything over to Ubuntu. After figuring out that CentOS wasn't the direction I wanted to go.

They each have their strengths. If you're in Enterprise production, or scientific computing, you'll want RHEL or at least a distro based on that. Most enterprise, cluster and scientific software, as well as some hardware, is best-supported on RHEL-based distros, and the stability of these distros means few surprises during the disto's supported lifetime.

If you're hosting your own web apps on commodity servers, more into VMs and containers, or you are more concerned with tracking current versions of languages, kernels, and other software than you are with long-term stability, then Ubuntu can work well.

Agreed entirely.

The 2 year LTS release cycle combined with 5 year support means you can either stay in step lock with LTS or skip every other version and still have a year to upgrade, I retired my last 10.04 earlier this year, that thing ran in production for five years with less than 10 hours downtime :).

My experience of Ubuntu Server is that it's basically just Debian with a few management tools pre-installed (reporting, supervisord, etc).

Personally I prefer Debian because the extras Ubuntu ships usually get disabled / deinstalled on production servers, so it makes more sense to work from a minimal base to begin with.

What exactly hasn't "just worked" about Debian?

Heh. It's been long enough since I tried that I don't remember. Hence the lack of details in my post.

I do remember that I had planned on fully switching to Debian (it seemed odd to me to use a distro based on Debian instead of just Debian), but ran into enough issues that it was better to just stick with Ubuntu.

Reevaluating Debian is on my todo list for when I have time. It's been long enough that the issues I ran into before will hopefully be gone. Or maybe I'll have changed how I do things in a way that avoids those issue.

The purpose of the policy is to protect end-users - they should not download/install something thinking it is "Ubuntu", and it turns out that it isn't Ubuntu.

Ubuntu encourages derivation, but there has to be balance in protecting users and the reputation of the Ubuntu project. One of the objectives for Ubuntu has always been to enable people to build on it - that's why it's always encouraged and supported derivatives. But, but there are effects are what causes this part of the policy:

* Someone providing a version of "Ubuntu" for specific hardware, but which broke various bits of user-experience * Someone customising Ubuntu for a specific server load but replacing PHP with their own version that wasn't in the package system - consequently no more security updates to this component.

This area of the policy solely covers publicly distributing:

* If you're distributing Ubuntu without any alterations then there aren't any issues: for example people create CD's in countries with low-bandwidth. * If you're using Ubuntu for internal use then you can do whatever you want: including changing configuration, altering components etc etc etc.

If you make alterations to the OS and present to the external world (distribute it publicly) as 'Ubuntu' then you need a bit of care. It's hard to write all the permutations, but in practise it's pretty easy. Just watch for things that fundamentally alter the OS as provided: changes to kernels, system packages, default installs or system configurations. In my experience adding things is unlikely to be problematic. If you're doing things like installing applications from the archives, or generally configuring things then there's unlikely to be an issue.

Dustin wrote a good post: http://blog.dustinkirkland.com/2015/07/appellation-of-origin...

You should read the policy directly and ask Canonical if you're still unsure.

I guess so it is the same situation as far as I can see.

It's appealing because Ubuntu is the distribution that people are most familiar with. These sorts of issues aren't seen as important outside of the legal niche.

It's like when you install a copy of Debian and look for Firefox, but instead see something called Iceweasel - I assume that still happens? The name is so passive aggressive.

i don't see them upholding this violation in court so i will carry on.

Yes, and moreover, there's no trademark violation when you push an Ubuntu container to your web server.

Trademarks are "enforce it or lose it". They may have to if they want to keep their trademark (stupid system I know).

EDITED s/use/enforce/ Thank you lightlyused

One of the things you get with trademarks is a right to license them. There's no law that stops Canonical from granting a trademark license to anyone who uses or depends on unmodified Ubuntu binaries.

Have they licensed it? If so no worries otherwise...

They will give you licenses if you ask, and those licenses are apparently non-sublicensable, making them basically useless for a free-software project.

https://www.reddit.com/r/linux/comments/3de41m/fsf_statement...

They may also charge for it.

https://twitter.com/marcdeslaur/status/623262991216214016

(both of these people are Canonical employees; unclear if they are speaking officially.)

They are using it, perhaps you mean "enforce it or lose it"?

Thanks for correction. I edited it.

yeah let's see a test case and then i'll worry about it.

The only issue is if they make you the test case.

Why I stick with either Debian or Gentoo. Ubuntu on the desktop, sure, but for the server hell no. I now have another reason to stay far away from redhat based distributions for anything, yes even centos.

Reply on news.ycombinator.com