# canonical/snapd architecture

> Architecture diagram of the GitHub repository canonical/snapd, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-25). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/canonical/snapd
- Repository: https://github.com/canonical/snapd

## Overview

snapd is the system service and command-line tool for installing, updating, removing, and operating snaps, while enforcing their isolation and resource permissions. The usual control path is a user invoking the snap command, which communicates with the daemon; the daemon exposes management APIs and coordinates stateful work. Separate system-startup components prepare boot and recovery environments, while interface policy code generates confinement rules. The README establishes these product capabilities, but the sampled source is incomplete, so links between internal lifecycle managers are intentionally limited.

Main entry points: [`daemon/api.go`](https://github.com/canonical/snapd/blob/master/daemon/api.go) (Management endpoints), [`client/client.go`](https://github.com/canonical/snapd/blob/master/client/client.go) (API client), [`daemon/daemon.go`](https://github.com/canonical/snapd/blob/master/daemon/daemon.go) (Background daemon), [`cmd/snapd/cli/main.go`](https://github.com/canonical/snapd/blob/master/cmd/snapd/cli/main.go) (snap command)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_management["Management API"]
  node_cli["snap command<br/>[main.go]"]
  node_client["API client<br/>[client.go]"]
  node_daemon["Background daemon<br/>[daemon.go]"]
  node_api["Management endpoints<br/>[api.go]"]
end

subgraph group_package["Package Lifecycle"]
  node_assertions["Assertion trust<br/>[asserts.go]"]
  node_snapmeta["Snap metadata"]
end

subgraph group_security["Confinement"]
  node_interfaces["Interface permissions<br/>[core.go]"]
  node_apparmor["AppArmor policy<br/>[backend.go]"]
  node_seccomp["Seccomp policy<br/>[main.go]"]
  node_confine["Execution confinement<br/>[snap-confine.c]"]
  node_namespace["Namespace updates<br/>[main.go]"]
end

subgraph group_startup["Boot and Recovery"]
  node_gadget["Device layout<br/>[gadget.go]"]
  node_image["System image creation<br/>[image_linux.go]"]
  node_bootstrap["Initramfs bootstrap<br/>[main.go]"]
  node_boot["Boot and recovery<br/>[boot.go]"]
end

subgraph group_coordination["State Coordination"]
  node_state["Shared state engine<br/>[stateengine.go]"]
end

node_user(("System operator"))
node_store(("Snap ecosystem"))

node_user -->|"runs commands"| node_cli
node_cli -->|"issues requests"| node_client
node_client -->|"HTTP requests"| node_daemon
node_daemon -->|"dispatches requests"| node_api
node_state -->|"coordinates lifecycle"| node_daemon
node_api -->|"handles assertions"| node_assertions
node_api -->|"manages snaps"| node_snapmeta
node_api -->|"manages connections"| node_interfaces
node_store -.->|"serves ecosystem requests"| node_client
node_interfaces -->|"generates policy"| node_apparmor
node_seccomp -->|"provides syscall policy"| node_confine
node_confine -->|"updates mount profile"| node_namespace
node_image -->|"uses device layout"| node_gadget
node_bootstrap -->|"prepares boot"| node_boot
node_boot -->|"uses device metadata"| node_gadget

click node_cli "https://github.com/canonical/snapd/blob/master/cmd/snapd/cli/main.go"
click node_client "https://github.com/canonical/snapd/blob/master/client/client.go"
click node_daemon "https://github.com/canonical/snapd/blob/master/daemon/daemon.go"
click node_api "https://github.com/canonical/snapd/blob/master/daemon/api.go"
click node_state "https://github.com/canonical/snapd/blob/master/overlord/stateengine.go"
click node_assertions "https://github.com/canonical/snapd/blob/master/asserts/asserts.go"
click node_snapmeta "https://github.com/canonical/snapd/tree/master/snap"
click node_interfaces "https://github.com/canonical/snapd/blob/master/interfaces/core.go"
click node_apparmor "https://github.com/canonical/snapd/blob/master/interfaces/apparmor/backend.go"
click node_seccomp "https://github.com/canonical/snapd/blob/master/cmd/snap-seccomp/main.go"
click node_confine "https://github.com/canonical/snapd/blob/master/cmd/snap-confine/snap-confine.c"
click node_namespace "https://github.com/canonical/snapd/blob/master/cmd/snap-update-ns/main.go"
click node_gadget "https://github.com/canonical/snapd/blob/master/gadget/gadget.go"
click node_image "https://github.com/canonical/snapd/blob/master/image/image_linux.go"
click node_bootstrap "https://github.com/canonical/snapd/blob/master/cmd/snap-bootstrap/main.go"
click node_boot "https://github.com/canonical/snapd/blob/master/boot/boot.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_client,node_daemon,node_api toneBlue
class node_assertions,node_snapmeta toneAmber
class node_interfaces,node_apparmor,node_seccomp,node_confine,node_namespace toneMint
class node_gadget,node_image,node_bootstrap,node_boot toneRose
class node_state,node_user,node_store toneIndigo
```

## Components

### Management API

- [snap command](https://github.com/canonical/snapd/blob/master/cmd/snapd/cli/main.go): `cmd/snapd/cli/main.go`
- [API client](https://github.com/canonical/snapd/blob/master/client/client.go): `client/client.go`
- [Background daemon](https://github.com/canonical/snapd/blob/master/daemon/daemon.go): `daemon/daemon.go`
- [Management endpoints](https://github.com/canonical/snapd/blob/master/daemon/api.go): `daemon/api.go`

### Package Lifecycle

- [Assertion trust](https://github.com/canonical/snapd/blob/master/asserts/asserts.go): `asserts/asserts.go`
- [Snap metadata](https://github.com/canonical/snapd/tree/master/snap): `snap`

### Confinement

- [Interface permissions](https://github.com/canonical/snapd/blob/master/interfaces/core.go): `interfaces/core.go`
- [AppArmor policy](https://github.com/canonical/snapd/blob/master/interfaces/apparmor/backend.go): `interfaces/apparmor/backend.go`
- [Seccomp policy](https://github.com/canonical/snapd/blob/master/cmd/snap-seccomp/main.go): `cmd/snap-seccomp/main.go`
- [Execution confinement](https://github.com/canonical/snapd/blob/master/cmd/snap-confine/snap-confine.c): `cmd/snap-confine/snap-confine.c`
- [Namespace updates](https://github.com/canonical/snapd/blob/master/cmd/snap-update-ns/main.go): `cmd/snap-update-ns/main.go`

### Boot and Recovery

- [Device layout](https://github.com/canonical/snapd/blob/master/gadget/gadget.go): `gadget/gadget.go`
- [System image creation](https://github.com/canonical/snapd/blob/master/image/image_linux.go): `image/image_linux.go`
- [Initramfs bootstrap](https://github.com/canonical/snapd/blob/master/cmd/snap-bootstrap/main.go): `cmd/snap-bootstrap/main.go`
- [Boot and recovery](https://github.com/canonical/snapd/blob/master/boot/boot.go): `boot/boot.go`

### State Coordination

- [Shared state engine](https://github.com/canonical/snapd/blob/master/overlord/stateengine.go): `overlord/stateengine.go`

### Other components

- **System operator**
- **Snap ecosystem**

## Connections

- System operator → snap command: runs commands
- snap command → API client: issues requests
- API client → Background daemon: HTTP requests
- Background daemon → Management endpoints: dispatches requests
- Shared state engine → Background daemon: coordinates lifecycle
- Management endpoints → Assertion trust: handles assertions
- Management endpoints → Snap metadata: manages snaps
- Management endpoints → Interface permissions: manages connections
- Snap ecosystem → API client: serves ecosystem requests
- Interface permissions → AppArmor policy: generates policy
- Seccomp policy → Execution confinement: provides syscall policy
- Execution confinement → Namespace updates: updates mount profile
- System image creation → Device layout: uses device layout
- Initramfs bootstrap → Boot and recovery: prepares boot
- Boot and recovery → Device layout: uses device metadata