Packing rocks with 20.04 build-base fails on ubuntu-24.04 runners due to kernel 7.0 AppArmor incompatibility
Metadata
Current evaluation
CI failure: legacy rock builds with ubuntu@20.04 build-base fail on ubuntu-24.04 runners due to kernel 7.0 AppArmor incompatibility. Root cause identified with workaround provided.
Suggested action: needs triage
Reason: This is a new, unlabelled issue with no maintainer response or comments. The issue is well-documented with a clear root cause (kernel 7.0 AppArmor incompatibility with Focal's apparmor_parser) and a specific workaround (change `run-rockcraft-pack-action-legacy-rock` from `ubuntu-24.04` to `ubuntu-22.04` in `.github/workflows/test.yaml`). The fix is a simple one-line workflow change, but maintainer triage is needed to confirm and apply it.
Evaluated by: mr-cal-bot
Impact:
40
Quick Win:
29
Complexity:
10
Confidence:
80
Actionability:
80
Issue body
### Problem Description
Packing legacy rocks with `build-base: ubuntu@20.04` (using `--ignore=unmaintained`) fails on GitHub Actions `ubuntu-24.04` runners when setting up the managed LXD container environment.
Example run failure:
https://github.com/canonical/craft-actions/actions/runs/41230198467/job/124622626564
```text
2026-10-31 18:37:52.314 Executing in container: lxc --project rockcraft exec local:base-instance-rockcraft-buildd-base-v71--340754a018ac492f45d4 -- env ... systemctl restart snapd.service
Failed to enable snapd service.
* Command that failed: 'lxc --project rockcraft exec local:base-instance-rockcraft-buildd-base-v71--340754a018ac492f45d4 -- env CRAFT_MANAGED_MODE=1 ... systemctl restart snapd.service'
* Command exit code: 1
* Command standard error output: b'Job for snapd.service failed because the control process exited with error code.\nSee "systemctl status snapd.service" and "journalctl -xe" for details.\n'
craft_providers.errors.BaseConfigurationError: Failed to enable snapd service.
```
### Root Cause
Starting with runner image `20261026.354` for `ubuntu-24.04`, GitHub Actions updated the host Azure kernel to Linux 7.0 (`7.0.0-1017-azure`).
1. When Rockcraft builds a rock targeting `ubuntu@20.04`, `craft-providers` provisions a `core20` LXD container and runs `apt-get install -y snapd`.
2. When `systemctl restart snapd.service` executes inside the container, Focal's `/sbin/apparmor_parser` (v2.13.3) attempts to load the `snap-confine` AppArmor profile into the Linux 7.0 kernel.
3. The kernel rejects Focal's profile format with:
`/sbin/apparmor_parser: Unable to replace "...": Profile doesn't conform to protocol` (exit status 185; see also [canonical/charmcraft#2816](https://github.com/canonical/charmcraft/issues/2816)).
4. `snapd.service` crashes on startup inside the container, causing `craft-providers` base container provisioning to fail.
### Workaround / Impact
- In `craft-actions` CI, the `run-rockcraft-pack-action-legacy-rock` test should run on `ubuntu-22.04` runners instead of `ubuntu-24.04`. Runners on `ubuntu-22.04` use Linux kernel 5.15/6.5 where Focal's AppArmor parser remains compatible.
- Users building rocks with `build-base: ubuntu@20.04` in GitHub Actions workflows need to use `runs-on: ubuntu-22.04` (or upgrade their rock's build-base to 22.04+).
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen/qwen3.6-35b-a3b |
Impact:
40
Quick Win:
29
Complexity:
10
Confidence:
80
Actionability:
80
|
needs triage | CI failure: legacy rock builds with ubuntu@20.04 build-base fail on ubuntu-24.04 runners due to kernel 7.0 AppArmor incompatibility. Root cause identified with workaround provided. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
No related issues found above the similarity threshold.