← Back to context

Comment by Myrmornis

13 years ago

Docker shall not be distributed or downloaded to or in Cuba, Iran, North Korea, Sudan or Syria

This statement occurs in the docker README[0]. If at all possible, one would want to keep such channeling of potentially offensive government policy out of an open source software project's public documentation. For one thing, there are many enthusiastic open source programmers residing in the above list of countries.

The NOTICE[1] document explains that

Like all software products that utilize cryptography, the export and use of Docker is subject to the U.S. Commerce Department's Export Administration Regulations (EAR) because it uses or contains cryptography (see http://www.bis.doc.gov/index.php/policy-guidance/encryption). Certain free and open source software projects have a lightweight set of requirements, which can generally be met by providing email notice to the appropriate U.S. government agencies that their source code is available on a publicly available repository and making the appropriate statements in the README.

I'm not familiar with seeing other open source projects from American organizations state that they may not be downloaded in the above list of countries. Is the use of cryptography in docker different in a way that makes the docker organization more at risk from legal challenges from the federal government in this regard, or are docker being anal and xenophobic in blithely displaying this notice?

[0] https://github.com/dotcloud/docker/blob/master/README.md

[1] https://github.com/dotcloud/docker/blob/master/NOTICE

This is kinda a non-negotiable for them, isn't it? It's not like they suddenly decided to enforce the USG policy and make a big deal about it.

IANAL, but it seems prudent to acknowledge that the crypto work was done in the USA and therefore falls under the export policy that ALL exportable software falls under. My company has to include this warning on its software and we even have two different versions (domestic and export) to deal with this issue.

I know it's unpopular, but why make Docker answer for it? Take it up with the USG if it makes you that unhappy.

Better yet, strip out all the non-exportable code, replace it with code written from outside the USA and presto-changes, you've solved a problem for the whole world.

  • Docker maintainer here. I also hate having to put this in the README (and hate it even more each time someone from Iran offers to contribute... what a waste of talent and energy this policy creates!).

    But we triple-checked with our legal counsel and they confirmed it's the only way to stay unambiguously out of trouble. As un-tasteful as it is, it's better than causing unnecessary legal trouble for docker contributors down the road.

    If you're interested in the subject here's an edifying expose of the situation: http://harpers.org/blog/2013/08/andrew-cockburn-on-the-failu...

    • Hi, thanks for the answer! I suppose it would be possible, without impacting the legal protection afforded by the notice, to preface the notice with some language indicating that docker would prefer it not to appear in the README, e.g. "unfortunately, due to ...". But in any case, congratulations with all the momentum you've gathered and I'm looking forward to learning more about docker here.

      1 reply →

After another legal review, there is another pull request open / probably part of 0.6.5 which changes the README to have language which the DSFG considers free.