Snapcraft cleanbuild on Arch Linux with LXD - AppArmor permission error
Metadata
Current evaluation
LP #1822372 closed as not-a-bug/stale: reporter resolved the AppArmor error with an LXD profile workaround (security.nesting/privileged, raw.lxc cgroup lines); maintainer later closed it noting cleanbuild was removed as builds are clean by default.
Resolution: closed stale
Reason: The author fixed his own setup via `lxc profile edit default` adding security.nesting, security.privileged and raw.lxc lines in 2019, and ~sergiusens closed the bug in 2023 stating "cleanbuild is no longer supported, all builds by default now transparently 'cleanbuild'", so the deprecated command no longer applies.
Evaluated by: mr-cal-bot
No scores available.
Issue body
I've been trying to set up a development environment for snaps on Arch Linux.
I've set up the following:
1. Installed snapd from AUR
2. Installed and enabled apparmor.service
3. Enable snapd.service and snapd.apparmor.service
4. Installed LXD from AUR
5. Configured permissions to allow unprivileged containers
5. Verified that LXD works by starting a couple of containers and checking network connectivity
6. Installed the snapcraft snap from edge/stable (tried both) channel
LXD and snap installation seems to work as expected, however whenever I try to run `snapcraft cleanbuild` I get the following error:
```
Creating snapcraft-parsimoniously-apostolic-flo
Starting snapcraft-parsimoniously-apostolic-flo
Waiting for a network connection...
Network connection established
Hit:1 http://archive.ubuntu.com/ubuntu xenial InRelease
Get:2 http://archive.ubuntu.com/ubuntu xenial-updates InRelease [109 kB]
Get:3 http://archive.ubuntu.com/ubuntu xenial-backports InRelease [107 kB]
Get:4 http://archive.ubuntu.com/ubuntu xenial/universe amd64 Packages [7532 kB]
Get:5 http://security.ubuntu.com/ubuntu xenial-security InRelease [109 kB]
Get:6 http://security.ubuntu.com/ubuntu xenial-security/main amd64 Packages [627 kB]
Get:7 http://security.ubuntu.com/ubuntu xenial-security/universe amd64 Packages [432 kB]
Get:8 http://archive.ubuntu.com/ubuntu xenial/universe Translation-en [4354 kB]
Get:9 http://security.ubuntu.com/ubuntu xenial-security/universe Translation-en [174 kB]
Get:10 http://security.ubuntu.com/ubuntu xenial-security/multiverse amd64 Packages [5604 B]
Get:11 http://security.ubuntu.com/ubuntu xenial-security/multiverse Translation-en [2676 B]
Get:12 http://archive.ubuntu.com/ubuntu xenial/multiverse amd64 Packages [144 kB]
Get:13 http://archive.ubuntu.com/ubuntu xenial/multiverse Translation-en [106 kB]
Get:14 http://archive.ubuntu.com/ubuntu xenial-updates/main amd64 Packages [926 kB]
Get:15 http://archive.ubuntu.com/ubuntu xenial-updates/universe amd64 Packages [742 kB]
Get:16 http://archive.ubuntu.com/ubuntu xenial-updates/universe Translation-en [307 kB]
Get:17 http://archive.ubuntu.com/ubuntu xenial-updates/multiverse amd64 Packages [16.7 kB]
Get:18 http://archive.ubuntu.com/ubuntu xenial-updates/multiverse Translation-en [8440 B]
Get:19 http://archive.ubuntu.com/ubuntu xenial-backports/main amd64 Packages [7280 B]
Get:20 http://archive.ubuntu.com/ubuntu xenial-backports/main Translation-en [4456 B]
Get:21 http://archive.ubuntu.com/ubuntu xenial-backports/universe amd64 Packages [7804 B]
Get:22 http://archive.ubuntu.com/ubuntu xenial-backports/universe Translation-en [4184 B]
Fetched 15.7 MB in 4s (3508 kB/s)
Reading package lists... Done
error: system does not fully support snapd: apparmor detected but insufficient permissions to use it
Stopping local:snapcraft-parsimoniously-apostolic-flo
An error occurred when trying to execute 'sudo snap set core refresh.hold=2019-03-29T19:44:38.135422Z' with 'lxd': returned exit code 1.
```
It seems to suggest that it has insufficient permissions to use apparmor inside the LXD build container. But I'm not exactly sure what it means in this context and if it's a bug or a configuration issue.
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed stale | LP #1822372 closed as not-a-bug/stale: reporter resolved the AppArmor error with an LXD profile workaround (security.nesting/privileged, raw.lxc cgroup lines); maintainer later closed it noting cleanbuild was removed as builds are clean by default. | |
| stealth/space-bunny-alpha | — | closed stale | Closed as stale in LP #1822372. The author used an LXD profile workaround; later, maintainers noted cleanbuild was obsolete because builds were clean by default. | |
| stealth/space-bunny-alpha | — | closed stale | Closed as stale after prolonged inactivity. The Arch Linux/LXD cleanbuild AppArmor failure (LP #1822372) received no documented fix, resolving PR, or commit. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed as stale due to inactivity. The AppArmor permission error during snapcraft cleanbuild on Arch Linux with LXD was never addressed or resolved. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed without resolution due to prolonged inactivity. The report detailed an AppArmor permission error during snapcraft cleanbuild on Arch Linux with LXD. No comments or fixes were provided, indicating the issue was abandoned or marked as invalid. | |
| qwen/qwen3.6-35b-a3b | — | — | Closed due to inactivity with no comments or resolution. The AppArmor permission error during snapcraft cleanbuild on Arch Linux with LXD remains unresolved and appears abandoned. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Closed due to inactivity without resolution. The AppArmor permission error during snapcraft cleanbuild on Arch Linux with LXD remains unfixed. No comments, workarounds, or follow-up actions were recorded. |
Update history
| Date | Change |
|---|---|
| created |
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1689712 snapcraft cleanbuild fails in xenial with the lxd deb: KeyError: 'kernel_architecture' | snapcraft (launchpad) | closed | Fixed Xenial cleanbuild compatibility with older LXD metadata in snapcore/snapcraft PR #1305, merged as commit 8f15f697f. | |
| #1666735 snapcraft cleanbuild does not work with lxd installed via snap | snapcraft (launchpad) | closed | Fixed by merged canonical/snapcraft#1199 (commit 417989880), making cleanbuild LXD detection packaging-independent instead of relying on apt package metadata. | |
| #1746612 Snapcraft cleanbuild doesn't work if you're not using the LXD snap | snapcraft (launchpad) | closed | Closed after the missing hostfs behavior was fixed upstream in lxc/lxd#4183. Snapcraft PR #1912 offered a workaround but was not merged. | |
| #1788654 snapcraft cleanbuild doesn't work with cross-compile stage-packages | snapcraft (launchpad) | closed | Closed as an obsolete legacy cleanbuild/LXD issue after a maintainer directed users to migrate to bases; no targeted cross-architecture fix was recorded. | |
| #1992660 Snapcraft fails if Ubuntu Advantage/Pro is configured | snapcraft (launchpad) | closed | Closed without a code fix: maintainers deemed Ubuntu Pro permissions in legacy destructive builds an environment responsibility; LXD and Multipass builds remained supported. | |
| #1741753 Snapcraft clean fails on root-owned files | snapcraft (launchpad) | closed | Root-owned LXD build files broke snapcraft clean; fixed by merged PR snapcore/snapcraft#1904 (commit 6bd4c9e59), correcting raw.idmap ownership handling. | |
| #1750642 Snapcraft fails in LXD container on Debian 9 | snapcraft (launchpad) | closed | Closed as stale in September 2026 because Debian 9 and the reported Snapcraft version were outdated; no fixing PR or commit was identified. |