[alblue]

The difference with a VM image (or an .iso, for that matter) is that it contains both your program and the JRE in the same deployable unit, which is what the license permits.

Docker containers, by contrast, store each layer separately, so that you can build up a runtime by overlaying multiple layer elements. Each software install results in its own layer being created and then pushed independently. This allows deltas to be shipped more efficiently since they only store the changes for each layer. However it now means that you're shipping the JRE separately from your application, which is against the rights given by the license.