Pack a Pro-compliant snap

Follow this guide to pack a snap that contains extended security patches or meets regulatory compliance needs.

Core24 and higher

Prerequisites

Enable guest attachment

Snapcraft makes use of Ubuntu Pro’s own support for LXD instances, but this support needs to be explicitly enabled and configured. On a terminal, run:

user@host:~$
sudo pro config set lxd_guest_attach=available

This command lets Snapcraft attach its LXD instances to the system’s Pro subscription, and only needs to be executed once.

Next, restart LXD so that the new configuration takes effect:

user@host:~$
sudo snap restart lxd

Identify the required Pro services

Next, determine which Pro services fit your needs. Snapcraft supports the following services:

  • esm-apps or esm-infra: If your goal is to pack a snap for an application and include the latest security patches for a base that is no longer under Standard Security Maintenance.

  • fips, fips-updates or fips-preview: If you need to deploy a snap in a highly regulated environment that processes sensitive data.

The desired Pro services don’t need to be enabled on your system, but they do need to be available. Run pro status and check the ENTITLED column to check whether a service is available. The Ubuntu Pro Client documentation has further information on each service.

Pack the snap

Now you can pack the snap with the desired services. Provide them to the --pro option:

snapcraft pack --pro=<service>

To use multiple services, pass them to the option as comma-separated values. For example, to pack a snap with the esm-apps and esm-infra services call:

snapcraft pack --pro=esm-apps,esm-infra

Snapcraft will automatically attach the Pro subscription and enable the requested services on the LXD instance while packing the snap.

Core22

Core22 snaps use a legacy mechanism to pack Pro-compliant snaps. The mechanism uses the term Ubuntu Advantage (UA) instead of Ubuntu Pro.

Prerequisites

Identify the required Pro services

First, determine which Pro services fit your needs:

  • esm-apps or esm-infra: If your goal is to pack a snap for an application and include the latest security patches for a base that is no longer under Standard Security Maintenance.

  • fips, fips-updates or fips-preview: If you need to deploy a snap in a highly regulated environment that processes sensitive data.

The desired Pro services must be available. On a system with your Pro token attached, run pro status and check the ENTITLED column for available services. The Ubuntu Pro Client documentation has detailed information on each service.

Add a ua-services key to your snap, and list the services:

snapcraft.yaml
ua-services:
  - esm-apps
  - esm-infra

Pack the snap

Now you can pack the snap with the desired services by passing the Pro token:

snapcraft pack --ua-token <pro-token> --enable-experimental-ua-services

The Pro token can also be provided as an environment variable:

SNAPCRAFT_UA_TOKEN=<token> snapcraft pack --enable-experimental-ua-services

As Pro enablement is an experimental feature, --enable-experimental-ua-services is needed in either case.

Snapcraft will automatically attach the Pro subscription and enable the requested services in the build environment while packing the snap.