Under the GPLv3 text, you may run and modify covered works you do not convey without conditions, and mere interaction over a network is not conveying. So hosting unmodified GPL software does not by itself trigger source sharing. The AGPL differs for modified versions. Confirm your facts with counsel. Not legal advice.
The definitions that matter
GPLv3 defines two terms. To propagate a work means to do anything with it that, without permission, would make you liable for infringement, except executing it on a computer or modifying a private copy. To convey a work means any kind of propagation that enables other parties to make or receive copies. The text adds that mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.
Section 2 then says you may make, run and propagate covered works that you do not convey, without conditions, so long as your license otherwise remains in force.
Where hosting differs from shipping
| Scenario | Conveying? | What the license text suggests |
|---|---|---|
| Customers download a binary that includes GPL code | Yes | Source and license duties apply to what you convey |
| You run GPL code on your servers, users only use the UI | Not by the definition above | No conveying duty from that use alone |
| You send a container image with GPL code to a customer | Yes | Conveying duties apply |
| You modify AGPL code and run it for users | Different rule | Offer source of your modified version to remote users |
The AGPL section 13 says that if you modify the program, your modified version must prominently offer all users interacting with it remotely through a computer network an opportunity to receive the Corresponding Source of your version. That is the key reason many companies treat AGPL differently in service code.
Edge cases worth a flag
- On premise deployments. If you ship a version of the hosted product to customers, you are conveying.
- Agents and SDKs. A client library you distribute is shipped code even if the server is hosted.
- Mobile apps. App store distribution is shipping.
- Containers. Images given to customers carry every package inside them, including GPL tools in the base layer. See listing licenses inside a container image.
- Customer contracts. A contract may ban GPL in hosted services regardless of the license text. See what a no copyleft clause means technically.
What to record
For each GPL or AGPL component, note: how it is used, whether you modified it, whether any copy leaves your control, and who approved. This record answers most diligence questions on the topic. A deeper walk through the AGPL is in AGPL gates at pull request.
Try it yourself
Open the demo and see how a pull request gate checks a change. A rule such as "deny AGPL in service repos" would sit in exactly that place.
Click through it at your own pace, or open it full screen.
Safeguard policies, gates and guardrails can enforce such a rule, and SBOM and dependency scanning list the components it applies to.
Quick check
Is hosting GPL code the same as distributing it?
Per the GPLv3 text, interaction through a network with no copy transferred is not conveying. Shipping copies to customers is.
Why is AGPL treated differently?
Its section 13 adds a duty for modified versions used over a network: users must be offered the source of your modified version.
Sources
Last reviewed: 19 October 2026.
