This is a great question and speaks to a lot of confusion about the GPL. The answer is mostly “yes” here, but since the GPL is frequently seen as very scary, it is important to understand why this is allowed.
Note that you say two contradictory things in your post, first that you
don't actually distribute the software, only its output
and the contradictory second statement,
Users [may] receive a virtual machine with the pipeline set up which they can run locally
This answer is addressing only the first, since that is the usual meaning of “output:” the data that emerges as a result of processing.
However as other answers indeed note, the second statement is distributing the software which processes the data into its final form, and you do need to release source code in that context.
Let’s understand why.
The GPL is about ownership
The abstract purpose of GPL software is for people to have full ownership of their computers. What I mean is that typically, legally speaking, you (the “end user” of the computer) own the hardware of your computer: you can throw it out of a window or install whatever software you want on it. But you usually don’t own the many pieces of software running on your computer, which follow so-called intellectual property laws. Because of this, the authors of that software can say “Hey: you can’t peek inside of this code that’s running on your computer. You can’t mess around with that.” And I mean anyone can say that but in this case they can back it up with a lawsuit if you don’t listen.
You will probably never own all of the software that you run, but on a program-by-program basis that is what GPL software is trying to provide. The GPL starts from the following ideological position: “You have this computer with these programs that you have bought, and you should be able to inspect and modify those programs, so that your computer does exactly what you want it to do. You legitimately, fully own these programs: they aren’t on loan from some mega-corporation. But you can do whatever you want with that code: debug it, share it with a friend, increment all the bytes by 1 and see what that does, play it as a static-sounding symphony, or print it onto underwear.” (There is a legal corner which you can’t own, which is the ability to strip the copyright and software from their lawful owners.)
Software licenses will either get in the way of this full ownership (as proprietary ones often do) or facilitate full ownership (as open-source ones often do). And when they facilitate, they might try to also facilitate other peoples’ full ownership of copies (as copyleft ones like GPL do) or just your full ownership (as non-copyleft ones like BSD, MIT, LGPL do). Non-copyleft licenses are particularly simple and are usually much easier to read. They generally say something like: “Here is this software. We hold the copyright. It is a condition of this license that you promise not to sue us for anything. We promise not to sue you for anything either.”
Copyleft licenses have to be a little more complicated, they have to say something like “We reserve the right to sue you if you pretend that you have the right to sue someone else over this software. You don’t have that right; don’t do that.” In this sense copyleft licenses use lawsuits defensively to try to reduce the global number of intellectual property lawsuits. They resist attempts to “re-proprietarize” their code.
And this is why you are concerned; you are worried that you might fall afoul of this if you share the output of your software. So the first thing you need to ask yourself may be, “under what circumstances do I want to sue my clients for using my software?” If you are unable or unwilling to take legal actions against your clients then you are implicitly allowing them (one might even say giving them license) to do whatever they want. But let’s suppose that you really do care about suing someone if they modify how your software works.
The code is the real concern
Here’s a common misconception: the GPL emphatically does not say “anyone who modifies the source code must release their modifications for free to the public.” In fact until very recently with the advent of GitHub, publishing software publicly was a really difficult task. It’s easier now, but publication is still in a general sense, a barrier to your ownership of that software. The GPL, which hates those sorts of barriers, does not and would not ever require such a barbarous thing.
What does it say? It says, “when you distribute the modified program to someone else, you have to give them, and only them, ownership of the modified source code under this license, so that they can fully own their computers just the same as you could.” There are two similarities to what most people are expecting; there are also two differences. The similarities are: (1) most people are expecting the source code to be free-of-charge; (2) most people are expecting that it does not matter whether you distribute a compiled or source-code form. But the differences are: (1) this sharing is not triggered by modification but by transmission and (2) this sharing is not intrinsically public (though you can’t control what the recipient does with it and the recipient can share it publicly). Notice that if you are already transmitting something to someone, then the publishing burden is offset: you only have to also offer to transmit the source code alongside whatever you’re originally transmitting. Also notice that while the source code must be free-of-charge, the transmission of the whole package can cost whatever you want: the financial cost of releasing the source code to this other person is merely expected to be covered by the amount they paid you for you to hand them the software in the first place.
Therefore: if this program runs on your server, nobody else’s, and other people only interact with the program by sending packets to your server, usually no source code release is needed. That code runs on your computer, nobody else’s. Since the GPL code doesn’t execute on anyone else’s machine, they cannot demand to see the source for the running program, even if it was modified. There are minor exceptions but they consist of programs which transmit GPLed parts of their own source code to the client so that the client can run them; these snippets need to satisfy the GPL of course.
On the flip side, when you send a virtual machine to someone, you are sending them code which they execute on their computers, and the GPL absolutely demands that they be able to control what’s running on their computers: so you will want to release source code in such a case, even with that VM boundary making things somewhat murky.
The GPL also allows a lot of strange things
Now, you might still be able to distribute some mechanism to process data, without disclosing that mechanism, even under the GPL. So it’s worth discussing what your options are here. How can you give someone else a computer program modified as GPL, if you are very worried about them sharing the source code?
First, a caution
First let me say that this is usually an unreasonable fear. Bryan Cantrill has run big tech companies for years and pointed out in some public talks that Open Source has never been a problem for his companies. Heck, it’s a perk for his developers—it helps him hire great talent. If I can distill why he thinks your fears are unreasonable, I’d say that it comes down to about three surprising practical facts:
- Your competitor companies are proud; they would often rather die than use your software. They’re thinking “oh that’s Acme stuff, but we’re better than them,” even when their company is financially crashing, on fire, into the ocean.
- Your competitor companies are often just as afraid of open-source licenses as you were before you read this. They’re thinking “If we do improve on Acme’s software, we’ll have to give those improvements back to them! We’ll be helping our competitors out!”
- Your competitor companies that are big enough to take your code and then beat you on your home turf would often rather buy your company outright, so that they get your platform and they don’t have to lose profits competing with you.
Open-source software has the very nice property that it becomes effectively immortal while proprietary software can and will die whenever the proprietors declare “it’s no longer in our financial interests to keep developing and supporting this software; bye!” without open-sourcing that software (which can itself be a mammoth task if parts were contracted out to others). Cantrill saw this personally when his company (Sun) was bought out by Oracle. If “we” means a particular legal entity, then maybe open source sounds crazy. But think about why we form LLCs: the promise of “if someone sues us into oblivion, we can fold this company and start anew.” In that sense “we” means the people who are working at this particular legal entity, and that “we” might want to outlive the death or acquisition of the company that they happen to be working at right now. Open source allows the software to outlive that, too.
So usually “my competitors will get to see my code!” is an unreasonable concern, when compared to the benefits of (a) your clients sometimes fix your software for you, (b) you occasionally convert competitors into clients, (c) you can advertise open-source contributions to hire better developers, (d) “you” the people making up the company have protections against company-level disaster.
But what options do you have?
You can retain ownership of physical hardware. Some medical devices run a combination of proprietary and GPL software, most notably by running Linux. They make it explicitly clear that the hospital who is buying that device is renting it out from the company, perhaps for a one-time fee: the device-company still owns the device and therefore they do not have to share the source code with the hospital.
You can sell support. In the comments,
@perkins suggests that you might hand over the source code but that you also might say “hey, if you DO mess with any of this code, I will refuse to support it or send you any new updates I write.” Someone might desire their working relationship with you more than they desire to use their legal freedoms.
You can sell proprietary plugins. There is an isomorphism between data structures and the control structures that consume them, so very often you may see a “platform” that is GPL but there are totally-optional “plugins” or “modules” which are proprietary. This requires some up-front effort, and you may want to run it by a lawyer (I am not one) to make sure that it does not count as “linking” in the GPL sense.
Again, these are usually not what you want to do and you are usually underestimating how proud your competitors are. But options do exist.
