Using License Filters on the Orivana Catalog

Scope of this page

This is the **directory filter workflow**. License concepts (MIT/GPL/AGPL meanings) live in Open-source licenses quick guide. Do not treat badges as compliance verdicts.

Filters narrow; LICENSE files decide

Orivana filters mirror SPDX labels when upstream is clear. Dual-license, open-core, and "enterprise module" cases still need human reading of LICENSE/NOTICE.

Personal vs product threshold

Before pinning an image, answer:

• Redistribute outside the household?
• Modify sources and expose publicly?
• Any network-copyleft dependency?
• Need patent peace for a future commercial fork?

All "personal / unmodified / private" → many licenses are low friction. One "yes" to redistribution changes the worksheet.

Deliberate Orivana workflow

1. Apply license filter(s) that match your redistribution plan.
2. Combine with Docker / language filters → shortlist 5–10.
3. Open each survivor's upstream LICENSE + NOTICE (and release notes for license changes).
4. Scan the **pinned** image SBOM if you ship or redistribute containers.
5. Record the decision in STACK.md next to compose.

syft docker.io/example/app:1.2.3 -o spdx-json > app.spdx.json
rg -i "GPL|AGPL|Apache|MIT" app.spdx.json | head

Common filter mistakes

• Badge without version (license changed at 2.0)
• Monorepo: server GPL / client MIT — know what you ship
• Open-core extras under commercial terms
• Trusting Docker Hub blurbs over GitHub LICENSE

Pair with other shortlist columns

License is one column beside Docker support, backup story, and maintainer activity — see How to choose your first stack.

Related reading

See Open-source licenses quick guide and Cost of self-hosting.