Open-Source Licenses: Concepts Operators Need

Why operators should care

Licenses matter when you redistribute, wrap, or expose modified network services — not only when lawyers appear. Treat license fit like RAM and backup targets.

This page is **concepts**. For how to use Orivana directory filters, see Using license filters.

Permissive (MIT, BSD, Apache-2.0)

Keep notices; generally allow proprietary wrappers around unmodified upstream. Apache-2.0 adds explicit patent language — useful when combining many deps.

Personal private deploy is usually low friction. Redistributing appliances or client bundles without NOTICE files is where pain starts.

Copyleft (GPL family)

Strong copyleft typically requires offering corresponding source when you **distribute binaries**. Running GPL only for yourself on a home server is a different fact pattern than selling a preloaded appliance.

Weak copyleft (LGPL, MPL) often allows proprietary linking under conditions — read the SPDX text, not forum slogans.

AGPL and network delivery

AGPL is discussed when modified versions are offered as a network service. Hobby private wikis rarely trigger product panic; public multi-tenant modified services need careful reading (and counsel for commercial cases).

Containers are a license graph

Base image + runtime + fonts + app each carry licenses. Scan what you pin:

syft docker.io/library/nginx:1.27-alpine -o spdx-json > nginx.spdx.json

Archive LICENSE/SBOM with the tag you deploy.

Write one-line decisions

## license note
- Upstream: ExampleApp, Apache-2.0
- Use: private household, no redistribution
- Reviewed: YYYY-MM-DD

Not legal advice

Educational only. Commercial redistribution, dual-licensing, or unusual combinations need a lawyer familiar with open-source compliance.

Related reading

See Using license filters, How to choose your first stack, and Cost of self-hosting.