How canonical/snapd works
snapd is the system service and command-line tool for installing, updating, removing, and operating snaps, while enforcing their isolation and resource permissions. The usual control path is a user invoking the snap command, which communicates with the daemon; the daemon exposes management APIs and coordinates stateful work. Separate system-startup components prepare boot and recovery environments, while interface policy code generates confinement rules. The README establishes these product capabilities, but the sampled source is incomplete, so links between internal lifecycle managers are intentionally limited.
Main entry points: api.go Management endpoints · client.go API client · daemon.go Background daemon · main.go snap command
Components 18
Management API
- snap command
cmd/snapd/cli/main.go - API client
client/client.go - Background daemon
daemon/daemon.go - Management endpoints
daemon/api.go
Package Lifecycle
- Assertion trust
asserts/asserts.go - Snap metadata
snap
Confinement
- Interface permissions
interfaces/core.go - AppArmor policy
interfaces/apparmor/backend.go - Seccomp policy
cmd/snap-seccomp/main.go - Execution confinement
cmd/snap-confine/snap-confine.c - Namespace updates
cmd/snap-update-ns/main.go
Boot and Recovery
- Device layout
gadget/gadget.go - System image creation
image/image_linux.go - Initramfs bootstrap
cmd/snap-bootstrap/main.go - Boot and recovery
boot/boot.go
State Coordination
- Shared state engine
overlord/stateengine.go
Other components
- System operator
- Snap ecosystem
Connections 15
- System operator → snap command: runs commands
- snap command → API client: issues requests
- API client → Background daemon: HTTP requests
- Background daemon → Management endpoints: dispatches requests
- Shared state engine → Background daemon: coordinates lifecycle
- Management endpoints → Assertion trust: handles assertions
- Management endpoints → Snap metadata: manages snaps
- Management endpoints → Interface permissions: manages connections
- Snap ecosystem → API client: serves ecosystem requests
- Interface permissions → AppArmor policy: generates policy
- Seccomp policy → Execution confinement: provides syscall policy
- Execution confinement → Namespace updates: updates mount profile
- System image creation → Device layout: uses device layout
- Initramfs bootstrap → Boot and recovery: prepares boot
- Boot and recovery → Device layout: uses device metadata