Automated License Compliance Management for Docker Images

Abstract

In the modern software development, integrating third-party dependencies has become a common practice, particularly within containerized environments using docker images. These dependencies often come with diverse licensing terms, presenting significant challenges in ensuring legal compliance. My thesis addresses the urgent need for an automated solution to manage license compliance for docker images, thereby mitigating the risks associated with manual license verification.

The primary objective of this thesis was to explore and evaluate existing open-source tools capable of systematically scanning docker images to identify and report on the licenses of their constituent dependencies. By leveraging these tools, comprehensive compliance reports were generated, significantly reducing the incidence of manual errors. Furthermore, my internship was conducted to illustrate the effectiveness of these tools in production environments, highlighting their potential to streamline development workflows and enhance legal transparency.

My internship concluded that automating license compliance using open-source solutions not only accelerates the development process but also substantially reduces legal risks while fostering the ethical use of open-source software.