Linux containers are a great way to deliver (not just) open source software and they are used everywhere for this purpose. From open source aspect the problem with container images is that they hide what kind of open source software is in the image, and what are the licenses of the software. When an organization complies with open source licenses, it needs to check and ensure the license terms of all the open source software used in the organization and follow accordingly (e.g. place licenses to product documentation or share source code), but the current situation makes this laborious and not effective. In this BoF I would like discuss if it is a good idea to collect the open source software and their licenses into the metadata of the container images. If it turns out to be a good idea I would like to ask for some advices how to make the first steps to design and implement this.
