Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
157 changes: 151 additions & 6 deletions docs/explanation/how-snaps-work/parallel-installs.md
Original file line number Diff line number Diff line change
Expand Up @@ -9,13 +9,19 @@ myst:

Parallel installs enable you to run multiple instances of the same snap on the same system. Each instance is completely isolated from all other instances, including its name, configuration, interface connections, data locations, services, applications and aliases.

This feature is currently considered experimental. In particular, *snap install* will fail if the same snap is already installed. As a result, to experiment with parallel installs, an *experimental feature-flag* must first be enabled:
Parallel installs are enabled by default from snapd 2.79. Earlier versions of snapd treated them as an experimental feature that had to be enabled explicitly.

Not every snap can be installed as a parallel instance. Snaps that use unsupported interfaces or app properties are rejected when installed with an instance key. See {ref}`Snaps that are unsupported as parallel instances <interfaces-parallel-installs-unsupported>` for details.

To disable parallel installs, set the `experimental.parallel-instances` system option to `false`:

```
sudo snap set system experimental.parallel-instances=true
sudo snap set system experimental.parallel-instances=false
```

We recommend rebooting the system after toggling the _experimental.parallel-instances_ flag state to avoid potential namespace problems with snap applications that have already been run.
With parallel installs disabled, `snap install` fails when given an instance key.

The native package of snapd 2.79 ships a new mount unit, crucial for the correct behavior of parallel instances of classic snaps. For systems that previously did not have the feature enabled and wish to use parallel instances of classic snaps, we recommend rebooting the system after updating the native package to a version >=2.79.

## Installing multiple instances

Expand Down Expand Up @@ -90,6 +96,14 @@ network xkcd-webserver_foo:network :network manual
network-bind xkcd-webserver_foo:network-bind :network-bind -
```

Slots provided by a parallel instance are never used for automatic connections. If an instance provides a slot that another snap needs, connect it manually:

```
sudo snap connect <consumer-snap>:<plug> <provider-snap>_<instance-key>:<slot>
```

Some interfaces are not supported on parallel instances. See {ref}`Snaps that are unsupported as parallel instances <interfaces-parallel-installs-unsupported>` for details.

### Services

As with Interfaces, {ref}`Services <how-to-guides-manage-snaps-control-services>` function the same with multiple instances of a snap as they do from any one snap to another.
Expand Down Expand Up @@ -125,6 +139,7 @@ xkcd-webserver.xkcd-webserver enabled inactive
xkcd-webserver_foo.xkcd-webserver enabled active
```

(interfaces-parallel-installs-aliases)=
## Application names and aliases

Snap application names for multiple instances are adjusted according to the following pattern:
Expand Down Expand Up @@ -175,6 +190,7 @@ When aliases trigger a conflict during snap installation, try passing `--unalias
$ sudo snap install snap-with-conflicting-alias_foo --unaliased
```

(interfaces-parallel-installs-environment)=
## Snap environment, data and namespace

When a snap application is run, its environment is populated with a number of `SNAP*` environment variables.
Expand Down Expand Up @@ -226,6 +242,131 @@ However, due to security concerns, user data locations are *not* similarly adjus
| HOME | /home/<usr>/snap/hello-world/27 | /home/<usr>/snap/hello-world_foo/27 |
| XDG_RUNTIME_DIR | /run/user/<uid>/snap.hello-world | /run/user/<uid>/snap.hello-world_foo |

(interfaces-parallel-installs-unsupported)=
## Snaps that are unsupported as parallel instances

Certain snaps, due to their nature, can never be parallel installed:
- snapd
- core base
- kernel
- gadget

All other snaps are subject to feature checking. Snapd checks every snap installed with an instance key and rejects it if it uses a feature that cannot work with more than one instance.

### Unsupported interfaces

Some interfaces give the snap exclusive ownership of a system-wide resource, such as a well-known D-Bus name. Others allow operations on shared hardware or kernel state that would conflict if performed by more than one instance. A snap cannot be installed as a parallel instance (unless specified with an explicit bypass flag; see {ref}`Installing an unsupported snap anyway <interfaces-parallel-installs-bypass>`) if it declares a plug or slot for one of these interfaces on an unsupported side:

| Interface | Plug supported | Slot supported |
|-----------|----------------|----------------|
| {ref}`acrn-support <interfaces-acrn-support-interface>` | No | Yes |
| {ref}`adb-support <interfaces-adb-support-interface>` | No | Yes |
| {ref}`audio-playback <interfaces-audio-playback-interface>` | Yes | No |
| {ref}`auditd-support <interfaces-auditd-support>` | No | Yes |
| {ref}`avahi-control <interfaces-avahi-control-interface>` | Yes | No |
| {ref}`avahi-observe <interfaces-avahi-observe-interface>` | Yes | No |
| {ref}`bluez <interfaces-bluez-interface>` | Yes | No |
| {ref}`checkbox-support <ref-checkbox-support-interface_checkbox-support-interface>` | No | Yes |
| {ref}`classic-support <interfaces-classic-support-interface>` | No | Yes |
| {ref}`core-support <interfaces-core-support-interface>` | No | No |
| {ref}`cuda-driver-libs <interfaces-cuda-driver-libs>` | Yes | No |
| {ref}`dbus <interfaces-dbus-interface>` | Yes | No |
| {ref}`desktop <interfaces-desktop-interface>` | Only without `desktop-file-ids` | No |
| {ref}`dm-crypt <interfaces-dm-crypt-interface>` | No | Yes |
| {ref}`docker <interfaces-docker-interface>` | Yes | No |
| {ref}`docker-support <interfaces-docker-support-interface>` | No | Yes |
| {ref}`dsp <interfaces-dsp-interface>` | No | Yes |
| {ref}`egl-driver-libs <interfaces-egl-driver-libs>` | Yes | No |
| {ref}`firmware-updater-support <ref-firmware-updater-support-interface_firmware-updater-support-interface>` | No | Yes |
| {ref}`fpga <interfaces-fpga-interface>` | No | Yes |
| {ref}`fwupd <interfaces-fwupd-interface>` | Yes | No |
| {ref}`gbm-driver-libs <ref-gbm-driver-libs-interface_gbm-driver-libs-interface>` | Yes | No |
| {ref}`greengrass-support <interfaces-greengrass-support-interface>` | No | Yes |
| {ref}`kubernetes-support <interfaces-kubernetes-support-interface>` | No | Yes |
| {ref}`location-control <interfaces-location-control-interface>` | Yes | No |
| {ref}`location-observe <interfaces-location-observe-interface>` | Yes | No |
| {ref}`lxd-support <interfaces-lxd-support-interface>` | No | Yes |
| {ref}`maliit <interfaces-maliit-interface>` | Yes | No |
| {ref}`media-hub <interfaces-media-hub-interface>` | Yes | No |
| {ref}`microceph-support <interfaces-microceph-support>` | No | Yes |
| {ref}`microstack-support <interfaces-microstack-support-interface>` | No | Yes |
| {ref}`mir <interfaces-mir-interface>` | Yes | No |
| {ref}`modem-manager <interfaces-modem-manager-interface>` | Yes | No |
| {ref}`multipass-support <interfaces-multipass-support-interface>` | No | Yes |
| {ref}`network-manager <interfaces-network-manager-interface>` | Yes | No |
| {ref}`nomad-support <interfaces-nomad-support>` | No | Yes |
| {ref}`nvidia-drivers-support <interfaces-nvidia-drivers-support-interface>` | No | Yes |
| `nvidia-video-driver-libs` | Yes | No |
| {ref}`ofono <interfaces-ofono-interface>` | Yes | No |
| {ref}`online-accounts-service <interfaces-online-accounts-service-interface>` | Yes | No |
| {ref}`opengl-driver-libs <ref-opengl-driver-libs-interface_opengl-driver-libs-interface>` | Yes | No |
| {ref}`opengles-driver-libs <ref-opengles-driver-libs-interface_opengles-driver-libs-interface>` | Yes | No |
| {ref}`openvswitch-support <interfaces-openvswitch-support-interface>` | No | Yes |
| {ref}`physical-memory-control <interfaces-physical-memory-control-interface>` | No | Yes |
| {ref}`pipewire <interfaces-pipewire-interface>` | Yes | No |
| {ref}`pkcs11 <interfaces-pkcs11>` | Yes | No |
| {ref}`posix-mq <interfaces-posix-mq-interface>` | No | No |
| {ref}`pulseaudio <interfaces-pulseaudio-interface>` | Yes | No |
| {ref}`ros-snapd-support <interfaces-ros-snapd-support>` | No | Yes |
| {ref}`shared-memory <interfaces-shared-memory-interface>` | Only with `private: true` | No |
| {ref}`steam-support <interfaces-steam-support-interface>` | No | Yes |
| {ref}`storage-framework-service <interfaces-storage-framework-service-interface>` | Yes | No |
| {ref}`thumbnailer-service <interfaces-thumbnailer-service-interface>` | Yes | No |
| {ref}`ubuntu-download-manager <interfaces-ubuntu-download-manager-interface>` | Yes | No |
| {ref}`udisks2 <interfaces-udisks2-interface>` | Yes | No |
| {ref}`unity8 <interfaces-unity8-interface>` | Yes | No |
| {ref}`unity8-calendar <interfaces-unity8-calendar-interface>` | Yes | No |
| {ref}`unity8-contacts <interfaces-unity8-contacts-interface>` | Yes | No |
| {ref}`upower-observe <interfaces-upower-observe-interface>` | Yes | No |
| `vulkan-driver-libs` | Yes | No |
| {ref}`wayland <interfaces-wayland-interface>` | Yes | No |
| {ref}`x11 <interfaces-x11-interface>` | Yes | No |
| {ref}`xilinx-dma <interfaces-xilinx-dma>` | No | Yes |

When an instance cannot be installed, the error names the plug or slot responsible and the reason, for example:

```
cannot install snap "network-manager_foo" as parallel instance: slot "service" with interface "network-manager" is not supported for parallel instances: owning a unique global resource cannot have parallel instances
```

### Unsupported app properties

A snap is unsupported as a parallel instance if any of its apps set one of the following properties in `snap.yaml`:

* `common-id`: the desktop file ID referenced by AppStream metadata is unique on the system.
* `bus-name`: the well-known D-Bus name the app claims is unique on the system.
* `activates-on`: D-Bus activation requires a `dbus` slot, which is not supported on parallel instances.

(interfaces-parallel-installs-bypass)=
### Installing an unsupported snap anyway

Users who understand and accept the risks of conflicts between instances may bypass these checks with `--allow-unsupported-instances`:

```
sudo snap install --allow-unsupported-instances <snap>_<instance-key>
```

Snapd remembers this choice for the instance, so later refreshes are not blocked.

If a refresh introduces an unsupported plug, slot or app property to an instance that is already installed and was fully supported, snapd blocks the refresh and adds a warning visible with `snap warnings`. To refresh the instance anyway, run:

```
sudo snap refresh --allow-unsupported-instances <snap>_<instance-key>
```

`--allow-unsupported-instances` can only be used with snaps installed with an instance key.

(interfaces-parallel-installs-shared-resources)=
### Interfaces that control shared system resources

Some supported interfaces grant control over a resource that is shared by the whole system, such as block devices or network ports. Each instance of a snap that uses one of these interfaces acts on the same system resource, and snapd does not coordinate between them. Before running more than one instance of a snap that uses such an interface, make sure that the instances are configured to manage different resources, or that only one instance is active at a time.

## Classic confinement

Snaps with {ref}`classic confinement <explanation-security-classic-confinement>` can be installed as parallel instances, but may require some setup on the part of the user, depending on the snap. Check the relevant snap's documentation for more details.

As mentioned in {ref}`the beginning description of parallel instances <interfaces-parallel-installs>`, for correct behavior of parallel instances of classic snaps, systems that previously did not have parallel instances enabled yet had at least one snap installed should reboot their system after updating the native package to snapd >=2.79.
Comment thread
maykathm marked this conversation as resolved.
Resolved

## Current limitations

There are a few limitations with parallel installs that will be addressed in subsequent `snapd` releases.
Expand All @@ -242,6 +383,7 @@ Applications built using most popular frameworks, such as Gtk/glib or Qt, and th

Snaps may provide APIs consumed by other snaps or the host system at some well known locations or addresses, such as DBus service names, /dev/shm objects or semaphores, abstract socket addresses. While the default AppArmor template has been updated to allow only instance specific access, connecting interfaces may allow a wider access capabilities that can lead to conflicts between instances of the same snap.

(interfaces-parallel-installs-ports)=
#### Ports

When snapd installs a snap with services, the services are automatically started. Services trying to bind to the same port may fail or function incorrectly. Such snaps should deliver means for configuration of the service via configure hooks.
Expand Down Expand Up @@ -270,11 +412,15 @@ Repeated failed starts of a service due to a port already in use can trigger sys

#### DBus names

Services exporting the API on DBus under a well known name may conflict with other instances of the same snap. Those may require fixes from application or snap developers.
Snaps that own a well-known D-Bus name, through a `dbus` slot or the `bus-name` app property, are not supported as parallel instances. See {ref}`interfaces-parallel-installs-unsupported`.

Snaps with plug-side `dbus` interface declarations are supported.

#### `/dev/shm`

The default AppArmor profile allows instance specific access only. Applications hardcoding paths can break. Note that some interfaces such as `mir` allow a wider access to `/dev/shm`. Such snap would need to be updated to made instance aware.
The default AppArmor profile allows instance specific access only. Applications hardcoding paths can break.

The `shared-memory` interface is only supported on parallel instances for plugs with the `private` attribute set to `true`, which gives each instance its own private `/dev/shm`. Slot-side parallel installations with `shared-memory` are not supported. Note that some interfaces such as `mir` allow a wider access to `/dev/shm`. Such a snap would need to be updated to made instance aware.

#### Socket activation

Expand All @@ -285,4 +431,3 @@ Snaps can use `listen-stream` socket definitions of three kinds: a network addre
* **`AF_UNIX` abstract sockets** must be declared with a `@snap.<snap-name>.` prefix. When generating the systemd socket unit for a snap instance, snapd automatically remaps this prefix to `@snap.<instance-name>.`, so each instance listens on its own abstract address without colliding with other instances. Clients must connect using the instance-qualified address, for example `@snap.hello-world_foo.socket` rather than `@snap.hello-world.socket`.

If, after any variable expansion or instance remapping, the resulting socket address exceeds the maximum length of 108 bytes allowed for a [Unix domain socket](https://man7.org/linux/man-pages/man7/unix.7.html) address, snapd fails to generate the socket unit and reports an error.

2 changes: 1 addition & 1 deletion docs/reference/development/experimental-features.md
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,7 @@ The following table lists all the features considered experimental.
| Name | Feature Flag | Date Introduced | Enabled by Default | Notes |
| :--- | :----------- | :-------------- | :----------------- | :---- |
| {ref}`Hotplug <interfaces-hotplug-support>` | hotplug | Jul 2018 (snapd 2.34) | NO | It controls the availability of dynamically creating slots based on system hardware. Currently only serial ports are supported (serial-port interface). |
| {ref}`ParallelInstances <interfaces-parallel-installs>` | parallel-instances | Jun 2018 (snapd 2.34) | NO | It controls the availability installing a snap multiple times. Layouts are not working properly with parallel installs due to problems with persistent mounts. |
| {ref}`Parallel installs <interfaces-parallel-installs>` | parallel-instances | Jun 2018 (snapd 2.34) | YES (snapd 2.79) | Some interfaces and app properties are not supported on parallel instances. See {ref}`interfaces-parallel-installs-unsupported`. |
| HiddenSnapDataHomeDir | hidden-snap-folder | Aug 2020 (snapd 2.46) | NO | It controls whether snap data is stored in ~/.snap/data instead of ~/snap. |
| UserDaemons | user-daemons | Aug 2020 (snapd 2.46) | NO | It controls the availability of user mode service support. Snapcraft needs to enable the `daemon-scope` setting. |
| MoveSnapHomeDir | move-snap-home-dir | Jul 2022 (snapd 2.57) | NO | It controls whether snap user data under ~/snap (or ~/.snap/data) can be moved to ~/Snap.|
Expand Down
10 changes: 10 additions & 0 deletions docs/reference/interfaces/acrn-support-interface.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
---
myst:
html_meta:
description: acrn-support interface
---

(interfaces-acrn-support-interface)=
# acrn-support interface

Expand All @@ -11,6 +17,10 @@ The `acrn` interface allows access to, and control of, user virtual machines us
**{ref}`Auto-connect <explanation-interfaces-interface-auto-connection>`**: no</br>
**{ref}`Super-privileged <reference-operations-interfaces-super-privileged-interfaces>`**: no</br>

```{note}
The `acrn-support` plug is {ref}`unsupported for parallel instances <interfaces-parallel-installs-unsupported>`.
```

### Code examples

The following (third-party) repository contains recipes to create snap packages for ACRN: https://github.com/gvancuts/acrn-snap
Expand Down
11 changes: 10 additions & 1 deletion docs/reference/interfaces/adb-support-interface.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
---
myst:
html_meta:
description: adb-support interface
---

(interfaces-adb-support-interface)=
# adb-support interface

Expand All @@ -12,6 +18,10 @@

**Auto-connect**: no

```{note}
The `adb-support` plug is {ref}`unsupported for parallel instances <interfaces-parallel-installs-unsupported>`.
```


Requires snapd version _2.36+_.

Expand All @@ -21,4 +31,3 @@ The adb-support interface is used in the _guiscrcpy_ snap: <https://github.com/s

The source code for this interface is in the *snapd* repository:
<https://github.com/canonical/snapd/blob/master/interfaces/builtin/adb_support.go>

11 changes: 10 additions & 1 deletion docs/reference/interfaces/audio-playback-interface.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
---
myst:
html_meta:
description: audio-playback interface
---

(interfaces-audio-playback-interface)=
# audio-playback interface

Expand Down Expand Up @@ -34,11 +40,14 @@ snap connect vlc:audio-playback

**Auto-connect**: yes

```{note}
The `audio-playback` slot is {ref}`unsupported for parallel instances <interfaces-parallel-installs-unsupported>`. The slot owns a unique system-wide resource that instances would conflict over.
```

<h3 id='heading-code'>Code examples</h3>

The snapcraft.yaml for [VLC](https://github.com/videolan/vlc) includes audio-playback configuration:
[https://github.com/videolan/vlc/blob/master/extras/package/snap/snapcraft.yaml](https://github.com/videolan/vlc/blob/75bca603749d8bfb7048a84ea811cbdb19447596/extras/package/snap/snapcraft.yaml#L36)

The source code for this interface is in the *snapd* repository:
<https://github.com/canonical/snapd/blob/master/interfaces/builtin/audio_playback.go>

11 changes: 10 additions & 1 deletion docs/reference/interfaces/auditd-support-interface.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,9 @@
---
myst:
html_meta:
description: auditd-support interface
---

(interfaces-auditd-support)=
# auditd-support interface

Expand All @@ -8,6 +14,10 @@ The `auditd-support` interface permits snaps to operate as the [`auditd`](https:
**{ref}`Auto-connect <explanation-interfaces-interface-auto-connection>`**: no</br>
**{ref}`Super-privileged <reference-operations-interfaces-super-privileged-interfaces>`**: yes</br>

```{note}
The `auditd-support` plug is {ref}`unsupported for parallel instances <interfaces-parallel-installs-unsupported>`.
```

Unlike other `*-support` interfaces, there is no single official `auditd` snap for which this interface was intended to be used. Instead, snap packagers who wish to ship their own snap containing `auditd` or serving the role of `auditd` may request installation and connection of this interface.

The `auditd-support` interface grants access to the [`CAP_AUDIT_CONTROL` capability](https://www.man7.org/linux/man-pages/man7/capabilities.7.html), along with access to files commonly required by `auditd`.
Expand All @@ -18,4 +28,3 @@ The test code can be found in the snapd repository:</br>https://github.com/canon

The source code for the interface is in the snapd repository:
</br>https://github.com/canonical/snapd/blob/master/interfaces/builtin/auditd_support.go

Loading
Loading