[afiori]

I believe that the AGPL has the same boundaries as the GPL that is if you for example run a nodejs server using a single AGPL package in your node_modules then users should be able to download the source code of your entire node app.

[josephcsible]

But now you're talking about using an AGPL library in your own program, rather than deploying just an AGPL-licensed program.

[andrewl-hn]

When you include an AGPL library your program becomes a derivative work, so the rest of your program becomes AGPL-licensed as well. The boundaries of what part of the system should or should not be included are vague, because *GPL licenses are written with C semantics in mind. So, while having a library directly in the same running process definitely makes you work a derivative, it's not clear if you the same is true if the library is a part of a different process and your program talks to it via an IPC, a filesystem, a database, an API, etc. Depending of the interpretation you may have toped-source just a tiny part of your program running on a server, or all server-side and client-side code and all supplemental scripts, tools, etc. needed for the system to run.

So, it's legally ambiguous, and since no-one has legally tested the waters the interpretation of the license can be very different, but most people prefer to stay away from AGPL code altogether.

[afiori]

libraries are software

[josephcsible]

Yes, but my point is there's a difference between "just deploy their software" and "combine their software with your software and deploy the result".

[afiori]

I agree, but for example it is not obvious whether you can deploy mixed licenses with docker-compose.