Comment by greatgib
6 months ago
I don't want to discount the work they are doing, and that it has no value, but a little bit shocking that they expect to go all commercial with this, in the Oracle way, while just "packaging" and so relying on open source software that they will not contribute to.
Also, I'm a little bit wondering at how much all of this is really copyrightable in the end. Because if you keep it private I understand, but here it is basically for each package just a few lines, recipes to build the components that they don't own. Like trying to copyright the line "make build".
And it might be each the single and obvious way to package the thing anyway.
And speaking at the built artefacts, usually a binary distribution of third party open source software with common license should preserve the same rights to the user to access the source code, the instructions to build, and the right to redistribute...
"Makefile" they have written and copyrighting is very non trivial and there are many man-months of effort. Configuring all sorts of software just with env vars and make it usable is not an easy feat.
Have a look at https://github.com/bitnami/containers/tree/main/bitnami/post... as example.
It might be worth a commercial license for some of their current user-base, no doubt.
Not everything that's authored and published is eligible for copyright. Copyright applies to only the creative elements of a work that are unique. Things that are facts, or are necessary for function are not copyrightable.
They likely hold a copyright on the exact expression of their documentation, but the facts and information in that documentation, and necessary configuration such as port numbers, and dependency selection are not subject to copyright.
Surely some of this complexity is self-inflicted, like an SSL cert renewal tool built with InstallBuilder: https://github.com/bitnami/bncert
This has to be a joke, right? Months of effort for a makefile? In which world do people live these days
You seriously underestimate this in general case. Build system may be made in weeks, but is polished in months or even years, to account for all the different usage and environment scenarios. Otherwise, it's typically very fragile.
2 replies →
The effort you put into a work doesn't determine copyright. You can own the copyright to a photograph that took seconds to take. And you can spend every hour of the day keeping a meticulous log of room temperature, and not have a copyright, because a table of facts isn't copyrightable.
1 reply →
Wasn't the point of the post you replied to that it isn't just a simple makefile ? That repo contains quite a lot carefully assembled scripts for each image that handles a lot of corner cases.
Tell me you haven't ever written even a moderately complex Makefile without telling me you haven't ever written even a moderately complex Makefile.
It would only take you a weekend!
3 replies →
In the world where "developers" cannot even wipe their buttocks without AI.
What probably carries more value is the helm charts that they provide which are also on their way out.
The images themselves have official replacements (for example, looking at https://hub.docker.com/u/bitnami why wouldn’t I use Node or Postgres images from the official sources instead).
I have no idea how many people actually used their helm charts though.
They do keep some of them more up to date, for example the bitnami python image had system packages patched faster than the official one. But if you are willing to pay then chainguard is a better solution.
ChainGuard is $$$$$$$
We talked to them a couple years ago. A lot of what they are doing besides Wolfi is using Alpine which removes alot of findings by default
13 replies →
Some other open source projects have also shipped Bitnami software in their own helm charts, i.e. APISIX's etcd instance is the Bitnami chart pulled in as a dependency.
Not that it ever worked well, we had to scale it to 1 because the quorum would constantly break into unrecoverable states.
[dead]