Request classic confinement for tf-wrapper

store-requests classic-confinement
1

I understand that strict confinement is generally preferred over classic.

I’ve tried the existing interfaces.

Running strict confinement ends with errors like:

Error: exec: “tofu”: executable file not found in $PATH

2

Hi @dex4er

Strict confinement is always preferred over classic. Can you try:

access to $HOME/.terraform directory

Use personal-files interface

running other commands (terraform binary and its plugins)

Use stage-packages to ship the required binaries with your snap

Thanks

3

Hi @jslarraz

I checked the wrapper with strict confinement and it is useless. The wrapper should be able to run any version of Terraform and actually any other commands too as Terraform can run anything using local-exec.

De facto the wrapper + Terraform are kind of shell and this is legit excuse to use classic confinement.

If you won’t agree then I’m going to remove this wrapper from Snapcraft.io as it will become useless as standalone tool without access to the other commands.

4

The two reason you provided, are explicitly listed as unsupported in the Process for reviewing classic confinement snaps

  • dependent software only available on host (ship in instead snap (eg, stage-packages, build from source))
  • access to dot files in $HOME (use $HOME instead of getent*, personal-files)

So honestly, I don’t this this snap is subject for classic confinement

5

Ok, no problem. I see that Snap package is not the best option for such wrapper that runs any other command from the host then I’m removing this package from the store.

1 Like
6

Well, terraform is in fact a classic snap itself (not sure if that makes this request more valid, but it actually used a different category and different reasoning) Guidance on classic vs auto-connect for Terraform

7

This is exactly reason why I can’t use non-classic confinement yet: I can’t embed Terraform as it is not yet with strict confinement. So maybe later.

8

Let me bring this discussion the next reviewers alignment meeting. I’ll come back to you

1 Like