Package Mongodb about os HOT 7 CLOSED

Perhaps we can have an extras repository for things like Mongo where we explicitly don't provide indemnification.

My main concern with carrying SSPL software in Wolfi is that some startup (like, say, ours) comes to depend on it, and then MongoDB (the company) tries to shake them down and we get blamed for it.

At least in Alpine the license review community concluded that Alpine should not carry SSPL software because of this potential. Pretty much every lawyer I've ever talked to about SSPL has said it is basically cancer and should be left alone.

from os.

Should we package this? MongoDB is under SSPL license which is not an OSI-approved/FSF-approved license, and carries very high risk for our users.

from os.

If the licensing will cause an issue we can definitely reconsider. It's available on DockerHub as both a library image and one maintained by upstream mongo:

from os.

I think separate repos probably makes sense. I'd like to understand exactly what would go in that repo and what the difference in support is though.

from os.

@amouat any thoughts on whether we target this for this quarter or the next? I'll file an issue for tracking an 'extras' repo.

from os.

Let me open an internal issue for tracking a MongoDB image.

Agree on putting this in an "extras" repo.

from os.

In the meantime, for anyone coming across this issue, my suggestion is to look into creating your own melange build for MongoDB that can be used locally.

from os.