Classic confinement request for picoclaw

name: picoclaw

description: Tiny, fast, local-first personal AI assistant

snapcraft: picoclaw-snap/snap/snapcraft.yaml at main · kenvandine/picoclaw-snap · GitHub

upstream: GitHub - sipeed/picoclaw: Tiny, Fast, and Deployable anywhere — automate the mundane, unleash your creativity · GitHub

upstream-relation: I only maintain the snap packaging. I am not involved with Sipeed or the upstream project.

supported-category: agent/assistant that runs arbitrary user-directed code and needs to reach files and programs that aren’t known at build time (same bucket as shells and coding assistants).

reasoning:

picoclaw is a single static Go binary meant for very small hardware, but it’s a real agent: code execution, file operations, scheduled jobs, MCP servers, and connections to whatever LLM provider and messaging platforms the user picks. The footprint is tiny; the access it needs is not.

Like the other agents, what it opens and runs is the user’s call at runtime, not something I can list when building the snap. Strict confinement produces an unbounded run of snappy-debug denials with no fixed allow-list that resolves them, because the filesystem interfaces can’t cover arbitrary paths and nothing grants arbitrary execve of host tools.

That’s why it’s classic.

On isolation: classic means the agent can do whatever the person running it can do. Because of that, the docs recommend installing and running it inside an LXD container rather than directly on the host. That keeps the broad access inside a boundary the user sets up themselves (throwaway filesystem, limited network, nothing reaching the rest of their data), while the agent can still use whatever tools and files it needs inside that container. Strict confinement would just break the agent and give weaker guarantees than containing it properly anyway.

This request has been added to the queue for review by the @reviewers team.

Given @kenvandine’s profilic history and Star Developer status, I think this is a yes.

@kenvandine I think a better long-term placement for this might be under the ubuntu-snaps namespace, or even better if we can get the upstream here with a Verified Publisher account.

Thanks, Ken!

Hi @kenvandine,

Based on the details provided, the application requires access to arbitrary system files and host-specific software. Under the Snap confinement model, these requirements fall into the unsupported category for classic confinement.

picoclaw being a general AI assistant, I also do not think it falls cleanly in the same bucket as shells and coding assistants.

I highly recommend looking into how similar tools, such as claude-code and copilot-cli, utilize strict confinement.

Because the current requirements do not meet the strict criteria for classic confinement, I do not think we can approve this request.

What do other @reviewers think?

@shishirsub10 this falls into the same category as openclaw, which was granted classic. See Classic confinement request for openclaw - #3 by jnsgruk

Hi @kenvandine,

There is a open PR which adds agents/assistants to the supported category for classic. Hence, +1 from my side for granting classic to picoclaw.

I agree with @jnsgruk and it would be amazing if we could get this into upstream repository or inside ubuntu-snaps namespace.

The publisher being Canonical employee is vetted and this is now live.