Selling / Providing Customers a Service on an Embedded Device with an Open Source OS

Question

I have researched this question quite a lot on stackexchange but my thoughts are inconclusive, the different licenses involved and options by the distribution vendors are giving me a headache.

My question is basically if there is any way around the high fees the distribution vendors are charging for their professional solutions if one is just casually (by casually I mean low volume sales but with commercial intent, not as a private hobby) developing and selling embedded devices (i.e. 20-30 devices p.a.).

Now to my concrete case:

Suppose I'd want to setup an embedded device and want to use a FOSS operating system (Debian, Ubuntu, any non commercial Linux distribution for instance) in a commercial setup, i.e. as a gateway computer. These are typically licensed with parts of GPL, LGPL, GPLv2, GPLv3 and other, more permissive licenses.

Suppose I automatically install (and most definitely update) a database on this system with the package manager but the package repository itself provided by the database developer. Suppose the database and all its accompanying software is licensed with Apache 2.0, BSD or MIT license. And suppose I do develop a program that gets executed on this operating system. The program should perform operations in connection with the OS, i.e. make IO operations from Ethernet to the database, maybe provide a server but there is no compiling or heavy shell scripting (maybe only to start an update routine) involved, perhaps a ssh connection may be used for maintenance.

Suppose I wanted to sell a pre-configured device with a FOSS OS, some Apache 2.0 and MIT licensed programs and own compiled source code along with the system to a customer. Do I then have to disclose my source code to customers, according to the GPL?

If not (meaning the stated above is in accordance to the GPL): Which pitfalls might occur?

If yes (meaning the stated above would violate the GPL and I'd need to disclose my source code): Does providing the device (the embedded device is kept as a property of mine) and just charging a monthly/yearly service fee change the situation (I think, as far as I understand this answer (although in that and this case the device was intended to be lend) here, not)?

Research

A similar case is discussed here:

But in this case the aspect of maintenance and (re)installing/updating system components (i.e. if a security risk bug is fixed and a system program need to be updated) is not addressed

This answer gives an insight to the above problematic. But my question remains: Is using the system's package manager to update system parts in an automated fashion and using system interfaces considered "intimate enough" or is this perfectly in accordance to the GPL?

In this answer I understand that if I do what I stated above I have to be prepared to provide full source code for 3 years

I want to thank you for taking the time reading through this wall of text and furthermore thank you in advance for providing me with an answer.

Answer 1

Suppose I wanted to sell a pre-configured device with a FOSS OS, some Apache 2.0 and MIT licensed programs and own compiled source code along with the system to a customer. Do I then have to disclose my source code to customers, according to the GPL?

No, you do not have to disclose your source code to your customers, assuming your own application does not link to any libraries under the GPL license (LGPL or GPL+linking exception is fine), and assuming you did not copy any (L)GPL-licensed code into your application.

The Linux system libraries all have an exception in their license that allows you to create/distribute a user-space application under a license that is not compatible with the GPL license of the kernel.

For package managers, your application is just data they install on the system and thus the licenses of the packages are not affected by the license of the package manager itself.

If not (meaning the stated above is in accordance to the GPL): Which pitfalls might occur?

What you have to take into account is that you are required to inform your customers about the various licenses that apply to the third-party components in your device.

Also, you must provide the source code of all GPL parts in your device (or a written offer to send it) to your customers and if any code is under the GPLv3 license, then you also have to provide the information a customer needs to update/replace those parts themselves.