Auto-connection request: openshell (adjust `docker` auto-connect rules)

store-requests privileged-interfaces
1

I’ve been working with the upstream OpenShell devs on some improvements to the openshell snap. We’ve identified an issue where the docker plug is not auto-connected if the docker snap happens to be already installed when the openshell snap is installed: https://github.com/NVIDIA/OpenShell/pull/2869#discussion_r3964575409

The openshell snap already has the following snap-declaration assertion:

plugs:
  docker:
    allow-auto-connection: true
  home:
    allow-auto-connection: true
  kvm:
    allow-auto-connection: true
  log-observe:
    allow-auto-connection: true
  personal-files:
    allow-auto-connection: true
    allow-installation:
      plug-attributes:
        read: \$HOME/\.kube/config
      plug-names:
        - kube-config
  system-observe:
    allow-auto-connection: true

This means that the openshell:docker is eligible to autoconnect to any docker slot which is present. However, the docker interface has implicitOnClassic: true, which means that there’s always a system :docker slot present. The docker snap also provides its own docker:docker-daemon slot. Thus, if the docker snap happens to be installed, there are two docker slots eligible for auto-connection, so snapd auto-connects neither, leaving it up to the user to decide which to connect.

This presents an inconsistent user experience for people trying to use the openshell snap. What we want is for the openshell:docker plug to always auto-connect to the system :docker slot. Connecting to this slot means that openshell has access to whatever Docker daemon happens to be present –- importantly, that Docker daemon could be provided by the docker snap, but it could also be a traditional Docker installation. By auto-connecting to the :docker slot always, the openshell snap will always work consistently with Docker, regardless of the latter’s installation method.

To do this, we request the following change to the openshell snap’s snap-declaration assertion:

plugs:
  docker:
    allow-auto-connection: true

should become

plugs:
  docker:
    allow-auto-connection:
      slot-snap-type:
        - core

Please let me know if you have any questions or you need additional information from me.

Thank you!

2

This request has been added to the queue for review by the @reviewers team.

3

Hello @oac :slight_smile:

Thanks for the detailed breakdown of the issue!

Your analysis of the dual-slot ambiguity is spot-on. Since openshell simply needs to communicate with whichever active Docker daemon is managing the host’s socket -regardless of whether Docker was installed via standard Linux packages or the docker snap- targeting the system slot ensures consistent behavior across all deployment scenarios without altering the security scope of the plug.

Thus this is a +1 from me for this update!

1 Like
4

Thanks! I believe @mlathara already took care of this request (the assertion update has already been made and propagated to the openshell snap). But I appreciate the vote of confidence :slight_smile: I’ll close this request as complete.

1 Like