Apparmor denied in prepare-device hooks

This issue is clearly another manifestation of https://bugs.launchpad.net/snappy/+bug/1595993, https://bugs.launchpad.net/snappy/+bug/1644573 and the related Hooks calling snapctl are broken with just Seccomp enabled. Perhaps golang doesn’t compile code that requires the apparmor network rules on ARM? Perhaps the denials were there but you didn’t wee them due to kernel rate limiting?

To work around this immediately, use (like you said):

hooks:
  prepare-device:
    plugs:
    - network-bind