Classic confinement request: lc-salt-minion

[durrendal]

To make the review of your request easier, please use the following template to provide all the required details and also include any other information that may be relevant.

---

• name: lc-salt-minion
• description: the agent component of the SaltStack IaC tool bundled up as a snap package.
• snapcraft: https://krei.lambdacreate.com/Snap/lc-salt-minion/src/branch/trunk/snap/snapcraft.yaml
• upstream: GitHub - saltstack/salt: Software to automate the management and configuration of infrastructure and applications at scale. · GitHub
• upstream-relation: maintainer of salt for Alpine Linux, maintainer of saltext-s3fs, author and maintainer of saltext-nebula
• supported-category: I don’t believe this falls into a supported category yet. I do not believe puppet, chef, or similar agent based configuration management systems have been packaged as snaps yet.
• reasoning: for salt-minion to manage the underlying system it needs to have access to modify the configuration of that system. This means running arbitrary commands on the system running the salt-minion, controlling the contents of files under privileged paths such as /etc, or managing system services.

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap to work under strict confinement.

[store-requests-bot]

This request has been added to the queue for review by the @reviewers team.

[ogra]

@durrendal

supported-category: I don’t believe this falls into a supported category yet.

This would be a hard blocker then, being in a category that is in the supported list is mandatory, the list can be found at:

Process for reviewing classic confinement snaps

Classic confinement review process Background As of snapd 2.20, snappy supports confinement: classic which allows the snap to run without restrictions. Future releases of snapd will also support a classic interface (name TBD) that operates similarly. Snaps specifying classic confinement may target the stable channel, but are only supported on classic distro systems (ie, not on Ubuntu Core). Because classic confinement snaps run without restrictions, use of classic confinement effectively grant…

[yomonokio]

Hello @durrendal!

As @ogra already explained, for a snap to be a good candidate for classic confinement, it must fall under one of the categories in the supported list. Since this snap does not meet those criteria, we cannot grant classic confinement for lc-salt-minion (#reject).

If you need further assistance, feel free to ping us

[jslarraz]

I think the technical reasons are clear and even if it does not clearly fit a category, I think it may fit the purpose of classic confinement. In addition, salt is a very well-known project. Then, I think this deserves at least to ask @pedronis for an override