Elektrine lite

← Feed

@Lemmchen@feddit.org

TIL: It is 2026 and you still can not run Snaps in strict mode on Debian-based systems

2026-05-20 19:41 UTC

Debian 13: $ uname -r 6.12.88+deb13-amd64 $ snap debug sandbox-features|grep confinement confinement-options: classic devmode $ snap debug confinement partial $ aa-enabled Yes Ubuntu (24.04): $ uname -r 6.8.0-117-generic $ snap debug sandbox-features|grep confinement confinement-options: classic devmode strict $ snap debug confinement strict $ aa-enabled Yes What does this mean, you ask? Well, basically every Snap package you thought was running isolated in it’s own little sandbox were running unconfined the whole time. The prorpietary app you removed the :home connection from, so it wouldn’t be able to access your home directory? Well, it could have exfiltrated all our private files in the meantime. How is this not a bigger deal and how are Snaps ever to become mainstream when even today, more than 10 years after the introduction of snaps, you can’t run them sandboxed on a huge portion of Linux distros?

Replies (11)

  • @hendrik@palaver.p3x.de 2026-05-20 19:54

    If I had to guess, this isn’t a bigger issue because Snap is mostly pushed by Canonical. And in a bit of a weird way (proprietary backend, exclusive apps) so… reception in the rest of the Linux community is …mixed. To put it charitably. It’s probably not high priority for a lot of people outside of the Ubuntu ecosystem.

    Open ##2726800

  • @davel@lemmy.ml 2026-05-20 20:01

    Hardly anyone but Ubuntu users use snap, because snap was created by Ubuntu, and their efforts to get other distros to adopt it never gained traction. Debian users are especially uninterested in using snap, and some people are on Debian are ex-Ubuntu users who switched because they didn’t like snap.

    Open ##2726917

  • @Eggymatrix@sh.itjust.works 2026-05-20 20:16

    Because snap is an absolute abomination and no one in their right mind is loosing time maintaining it. If canonical whants to push their crap on debian too, they will need to put in the time to make it work. I really hope they are not making debian developers loose their precious time on this cancer.

    Open ##2727179

  • @whatiswrongwithyou@lemmy.ml 2026-05-20 20:30

    It’s not a big deal because the answer to the problem is “don’t run snaps”.

    Open ##2727373

  • @placebo@lemmy.zip 2026-05-20 20:36

    Companies are more likely to use Ubuntu instead of plain Debian or another Debian-based distro on their workstations. No one in this chain aims to bring snap packages to other distros and ensure that they work properly there.

    Open ##2727430

  • @pogmommy@lemmy.ml 2026-05-20 23:31

    I mean I get the concern but I’d be surprised if even 1% of Debian users had any interest in running snaps

    Open ##2729323

  • @makingStuffForFun@lemmy.ml 2026-05-21 06:25

    Thank the gods. Nobody wants that proprietary walled garden in Ubuntu. It’s just a toll for Ubuntu to control, and maybe even sell itself one day to Goog’s or MS or similar. Don’t want it in Debian.

    Open ##2733005

  • @adarza@lemmy.ca 2026-05-20 22:42

    file a debian bug report against snapd.

    Open ##2735726

  • Who TF cares? If you want containerized apps, run Flatpak. There is no application packaged for Snap that I’ve not seen packaged for Flatpak, too. And Flatpak is better in basically every way.

    Open ##2738245

  • @adarza@lemmy.ca 2026-05-21 13:33

    have you actually looked at a snap’s status? root@cave:~# lsb_release -d Description: Debian GNU/Linux 13 (trixie) root@cave:~# uname -r 6.12.88+deb13-amd64 root@cave:~# snap debug sandbox-features|grep confinement confinement-options: classic devmode root@cave:~# snap debug confinement partial root@cave:~# aa-enabled Yes root@cave:~# snap info --verbose hello-world name: hello-world summary: The 'hello-world' of snaps health: status: unknown message: health has not been set publisher: Canonical✓ contact: snaps@canonical.com links: contact: - mailto:snaps@canonical.com license: unset description: | This is a simple hello world example. commands: - hello-world.env - hello-world.evil - hello-world - hello-world.sh notes: private: false confinement: strict devmode: false jailmode: false trymode: false enabled: true broken: false ignore-validation: false snap-id: buPKUD3TKqCOgLEjjHx5kSiCpIs5cMuQ tracking: latest/stable refresh-date: today at 07:43 CDT installed: 6.4 (29) 20.5kB - root@cave:~# snap run hello-world.evil Hello Evil World! This example demonstrates the app confinement You should see a permission denied error next /snap/hello-world/29/bin/evil: 9: /snap/hello-world/29/bin/evil: cannot create /var/tmp/myevil.txt: Permission denied root@cave:~#

    Open ##2738853

  • @lagoon8622@sh.itjust.works 2026-05-21 13:51

    What is this, troll day? Nobody cares about snap bc none of us use it. It’s a colossal fuckup and nobody cares about it

    Open ##2739318