Often yes. The GNU FAQ says the GPL lets you distribute an aggregate of separate programs, even when other licenses are nonfree, as long as you do not stop users from exercising their GPL rights. The catch is that the programs must truly be separate, not one program in two pieces.
This is general information, not legal advice.
Definition: aggregate versus one combined program
An aggregate is a set of separate programs distributed together, for example on the same disk, image or installer. The FAQ's example is a CD-ROM. Each program keeps its own license.
A combined work is different. Once two parts form one program, the GPL applies to the whole when you distribute it.
How the FAQ draws the line
The FAQ says the line between two programs and one program with two parts is a legal question that judges ultimately decide. It offers a criterion with two inputs: how the parts communicate, and what they exchange.
- Same executable file: definitely combined.
- Designed to run linked together in a shared address space: almost surely combined.
- Pipes, sockets and command line arguments: normally separate programs.
- Intimate exchange of complex internal data structures: could still count as one program even over a pipe.
| Mechanism | Usual reading in the FAQ |
|---|---|
| Linked into one executable | One program |
| Shared address space by design | Almost surely one program |
| Separate process, command line arguments | Normally separate |
| Separate process, pipes or sockets with simple messages | Normally separate |
| Separate process swapping rich internal structures | Could be one program |
Containers do not change the answer
The FAQ addresses this directly. Putting code in containers has no effect on whether it is a single work or an aggregate. A Docker image holding your proprietary service and a GPL tool is analysed the same way as two programs on a disk. What matters is how they talk, not the packaging.
The one condition on the aggregate itself
You cannot release the bundle under terms that stop users from doing what each program's own license allows. So an installer EULA that forbids extracting or redistributing the GPL tool conflicts with the GPL.
Steps to check a bundle
- Name each GPL licensed program in the package.
- Draw how your code talks to it: link, process call, socket, shared memory.
- Write down the data crossing the boundary. Simple commands point to separate programs.
- Provide the GPL license text and source offer for the GPL program.
- Rewrite any EULA clause that would limit the GPL program's rights.
- Record the reasoning so the next release does not repeat the analysis from scratch.
Try it yourself
Use the dependency inventory demo to see how a component list marks what ships in the product. Look for items flagged as bundled versus build time, since that is where a bundle review starts.
Click through it at your own pace, or open it full screen.
Safeguard's dependency scanning and SBOM generation give you the inventory of what is in the build, and its policies and gates can enforce your license decisions on pull requests. A free scan is available at gold.safeguard.sh/scan.
Quick check
Is calling a GPL command line tool from my app a combination?
The FAQ says command line arguments are normally used between separate programs, so it is normally separate. Intimate data exchange could change that reading.
Does putting both in one Docker image make them one work?
No. The FAQ says containers do not change the single work or aggregate analysis.
Can my EULA ban redistribution of the whole bundle?
Not for the GPL parts. You cannot use a license that blocks rights the GPL grants for that program.
Sources
Last reviewed: 19 October 2026.
