"Is license A compatible with license B?" cannot be answered without context. Collect four facts first: the exact license and version of each component, how the components are combined, how you distribute the result, and who receives it. With those, a reviewer or counsel can answer in minutes.
The four facts
1. Exact licenses and versions. Not "GPL" but the SPDX identifier, such as GPL-2.0-only or GPL-3.0-or-later. Not "Apache" but Apache-2.0. The versions matter because compatibility is often directional and version specific.
2. How the code is combined. Options include a copied source file, a static link, a dynamic link, a separate process, a plugin, a network call and a container that merely sits beside another. Different combinations are treated differently by different licenses, and the license text, not folklore, decides.
3. How you distribute. Shipped as a downloadable binary, sent to one customer, embedded in a device, offered as a hosted service, or kept internal.
4. Who receives it. Customers, the public, an acquirer, or only your staff.
A question template
Copy this into a ticket:
- Component A: name, version, SPDX license, where it came from.
- Component B: same fields.
- Combination: how A and B are connected, with a short diagram or link to code.
- Distribution: form and audience.
- Goal: the license you want for the combined work.
- Deadline: the release it blocks.
A reviewer who sees this can tell whether they need more facts or can simply answer.
Why directional matters
Compatibility is rarely symmetric. Code under a permissive license can often be included in a project under a more restrictive license, but the reverse is a different question. The license texts say which terms they allow you to apply to the combined work. For example, the MPL FAQ says executables built with MPL code can be licensed under other terms as long as recipients keep their rights to the MPL covered source. That is a statement about one direction in one license.
What to keep
File the answer with the dependency record: question, facts, answer, who answered, date. The next person who asks the same thing can reuse it.
This post is a process guide, not legal advice, and a license compatibility conclusion for a real release belongs with counsel.
Quick check
Is compatible the same as allowed to ship?
No. Compatible says licenses can coexist in one work. You still have to meet each license's own conditions.
Does a container make two licenses separate?
It depends on how the components interact and on the license text. Do not assume. Ask with the four facts.
Safeguard's SBOM and dependency scanning supplies the license and version facts for the first step.
Sources
Last reviewed: 19 October 2026.
