Subtle differences between devmode and classic confinement snaps

snapd
1

I once believed they are nearly the same except that the devmode snaps runs in AppArmor complain mode but it seems that the difference is much more. This topic collects them and should probably be merged into Snap confinement .

  • Devmode snaps don’t receive updates from the Snap Store while classic snaps do

  • Snapcraft ships command wrappers that set the in-snap dynamic linker variables(LD_*) and runtime search PATHs in devmode snaps but NOT in classic snaps.

    # in devmmode snap, prime/command-utsushi.wrapper
#!/bin/sh
export PATH="$SNAP/usr/sbin:$SNAP/usr/bin:$SNAP/sbin:$SNAP/bin:$PATH"
export LD_LIBRARY_PATH="$LD_LIBRARY_PATH:$SNAP/lib:$SNAP/usr/lib:$SNAP/lib/x86_64-linux-gnu:$SNAP/usr/lib/x86_64-linux-gnu:$SNAP/usr/lib/x86_64-linux-gnu/mesa-egl"
export LD_LIBRARY_PATH="$SNAP/usr/lib:$SNAP/usr/lib/x86_64-linux-gnu:$LD_LIBRARY_PATH"
export LD_LIBRARY_PATH=$SNAP_LIBRARY_PATH:$LD_LIBRARY_PATH
exec "utsushi-launch" "$@"

    # in classic snap, prime/command-utsushi.wrapper
#!/bin/sh
exec "utsushi-launch" "$@" # errors as the launcher script isn't in host's command search PATHs

  • Devmode snaps sees the core snap’s root filesystem (with some exceptions exposed from the host) while the classic snaps sees the host’s root filesystem

Comments, updates welcome.

2 Likes
2

Classic snaps are also not allowed to use any interfaces, while (as you noted) devmode snaps do use them but run in complaint mode … devmode snaps are typically for debugging and for sharing with your fellow developers to debug confinement issues before you go strict with them.

while classic snaps are the equivalent to “grab this tarball from some website and extract it to /opt and the application will ship everything it needs by default”

2 Likes
3

Unless the application is not designed to be relocatable :-/ which is common in classic confinement snapped applications

4

Indeed, i was only outlining the delivery process here … these /opt tarballs are often from upstream and created initially with the relocation in mind … (that an app needs to be re-locatable is not a difference between classic and devmode snaps though, they both need to work from $SNAP/$SNAP_DATA and friends)

1 Like
5

A practical problem of such differences is that one simply can’t develop a classic confinement snap package under devmode as the Snapcrafters Template task "Create a snap that runs in devmode" instructs to as the environment difference is pretty much unavoidable.

6

Yeah, that seems like a documentation issue …

1 Like