Request classic confinement for shieldpress-local

name: shieldpress-local

description: ShieldPress Local is a local PHP, WordPress, and Laravel development environment for Ubuntu. It provides a desktop interface for creating and managing local development sites and integrates directly with host development services and tools.

The existing Debian package already provides this host-integrated workflow. We are requesting classic confinement so that the Snap version can provide equivalent functionality.

snapcraft: Not publicly available at this time.

upstream: https://github.com/vithanhlam/ShieldPress-Local

upstream-relation: I am the original author, maintainer, and publisher of ShieldPress Local.

Publisher: vithanhlam

Store page: https://snapcraft.io/shieldpress-local

supported-category: tools for local, non-root user driven configuration of/switching to development workspaces/environments

reasoning: ShieldPress Local is a host-integrated local development environment rather than an isolated desktop application.

Strict confinement is not sufficient for the application’s core functionality for the following technical reasons:

  • ShieldPress Local starts and stops host-installed Nginx, MariaDB/MySQL, Redis, PHP, and other development binaries available through the system PATH.

  • It needs to update /etc/hosts through pkexec to map development domains such as project.test to the local environment.

  • It serves local development websites, APIs, and tools such as phpMyAdmin on locally bound TCP ports.

  • Development project workspaces can be located anywhere selected by the user and are not necessarily restricted to $HOME or Snap-specific directories.

  • It invokes host development tools and binaries, including tools such as Git, Composer, npm, WP-CLI, and other utilities installed by the developer.

  • It uses mkcert to create locally trusted HTTPS certificates and install/manage the local development CA.

  • It needs to launch host-installed editors and terminals against user-selected project workspaces.

  • It needs to interact with the host development environment in the same way as the existing .deb distribution.

A strictly confined revision of ShieldPress Local is already available on the stable channel. However, due to the Snap sandbox, that revision cannot fully interact with host system services, host-installed development tools, or /etc/hosts. As a result, it cannot provide functionality equivalent to the existing Debian package.

We have evaluated the existing Snap interfaces, but they do not provide sufficient access for this use case. ShieldPress Local acts as an orchestrator for the developer’s local host environment, rather than an application whose dependencies and data can be completely contained inside the Snap sandbox.

We are therefore not requesting classic confinement merely for convenience or to avoid adapting the application to Snap interfaces. Host integration is fundamental to the product’s purpose as a local development environment.

ShieldPress Local fits the supported classic confinement category:

tools for local, non-root user driven configuration of/switching to development workspaces/environments

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces to make the snap work under strict confinement. However, they are not sufficient to provide the host-integrated development environment described above.

Please grant classic confinement for shieldpress-local so that we can release the full 2.5.22 build to latest/stable.

This request has been added to the queue for review by the @reviewers team.

Hi @vithanhlam :slight_smile:

It is plausible that there are technical reasons why shieldpress-local needs classic to work properly in all scenarios, but please note that classic confinement is a sensitive matter and it is reserved for mature, well-known applications published by mature, well-known entities. As of today, I believe that shieldpress-local doesn’t meet this criteria because of the following reasons:

  • The project seems to be very fresh, according to the upstream repository
  • The projects seems to have little/none community around according to upstream repository (contributors, issues, PRs, etc.)
  • I could not find evidences that the project has a strong enough user base currently

Thus, considering these factors, I think shieldpress-local should not get classic confinement as of now.

1 Like