Classic confinement request for pi-agent

store-requests classic-confinement
1

To make the review of your request easier, please use the following template to provide all the required details and also include any other information that may be relevant.

The pi coding agent is a CLI coding agent similar in scope to claude or copilot. Its focus is on extensibility, it is meant to interface with arbitrary binaries as well as read/write arbitrary files and sockets. For instance, in the course of normal operation pi resp. the LLM backend might need to launch and inspect lxc containers, connect to ext. APIs, create and run Python scripts, inspect sysfs paths, as well as run common tools such as git, uv, bash, …

Preserving this operational breadth would be impossible within strict confinement.

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap to work under strict confinement.

Note that snappy-debug can be used to identify possible required interfaces. See https://snapcraft.io/docs/debug-snaps for more information.

2

Hi @petersabaini!

A key step in the classic granting process is Publisher Vetting. To successfully vet a publisher, we need to verify their connection to the upstream. Since you’re not currently part of the upstream, could you clarify whether the upstream is willing to adopt the snap, or if they are open to having you, as the snap publisher, join the upstream (if you’re willing to do so) (#askForInfo)?

3

Hey folks!

Whilst the technical reasons are clear, I don’t think agents fit into any of the supported categories for classic confinement. This topic requires further discussion with the snapd architects to clarify whether agents can be added to the supported categories, or whether certain agents may be subject to an override granted on a case-by-case basis.

I’ll be back once the direction is clear.

1 Like