@SwooshBakery624@programming.dev
2026-09-19 05:49 UTC
Snap has a better sandbox, but only if you have an AppArmor distro. If your distro of choice uses SELinux or something else, then you’re out of luck.
Replies (1)
-
@Amaterasu@lemmy.world 2026-09-20 05:06
Actually, just having AppArmor enabled isn’t enough. Snap’s strict confinement depends on specific out-of-tree AppArmor kernel patches that Canonical bakes into Ubuntu. If your distro uses the stock Linux kernel, even with AppArmor active (like Debian, Arch, or openSUSE) snapd lacks the necessary kernel-level hooks and drops down to partial confinement. Because of this fallback, non-Ubuntu AppArmor distros don’t actually get the full Snap sandbox, they get a degraded version of it.