skills.rest
rascheel
rascheelCOMMUNITY
Explore all skills by this author →
GitHub

snap-validator

Validates snaps in LXD containers by capturing AppArmor and SecComp denials.

7|Updated Apr 30, 2026
Search Tags:#validation#lxd#seccomp#confinement#snapcraft#apparmor#snap
One-click install
npx skills add https://github.com/rascheel/scheel-skills --skill snap-validator-rascheel
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: snap-validator
Source: https://github.com/rascheel/scheel-skills/tree/main/snap-validator
Command: npx skills add https://github.com/rascheel/scheel-skills --skill snap-validator-rascheel

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Testing a locally built snap for confinement problems requires manually provisioning clean environments, exercising every app and daemon, and translating raw AppArmor/SecComp denials into the correct snap interfaces — a slow, error-prone process that this Skill automates end to end. ## Core Features & Use Cases - Automated LXD validation: Provisions a clean LXD container, installs the snap with --dangerous, runs every declared CLI app and daemon, and captures denials via snappy-debug. - Structured results: Writes snap-validation-results.json mapping each denial to its app and suggested interface plug, so snap-packager can patch snapcraft.yaml — this Skill never patches or rebuilds itself. - Devmode crash check and store-review detection: Runs a devmode-first startup check to catch ELF interpreter and library bugs, and flags store-review-only interfaces like snapd-control and docker-support. - Cross-architecture and OCI support: Selects an arch-appropriate test environment (native LXD, LXD remote, emulation) and reports OCI rootfs reproducibility diffs. - Use Case: After building a snap, ask the agent to validate it; it installs the snap in a clean container, exercises all apps, and reports exactly which plugs each app needs. ## Quick Start Validate the snap in this project by installing it in a clean LXD container, running all its apps and daemons, and reporting any AppArmor or SecComp denials with suggested interface plugs.

Frequently Asked Questions about snap-validator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a snap for AppArmor denials?▼

Install the snap with --dangerous inside a clean LXD container, run every declared app and daemon, and capture denials with snappy-debug and journalctl. This Skill automates that loop and maps each denial to a suggested snap interface plug.

How to find which snap interfaces my app needs?▼

Run the snap under strict confinement while snappy-debug scans; it translates raw AppArmor denial lines into suggested plugs like network-bind or system-observe. When snappy-debug gives no suggestion, a denial-to-interface reference table maps common denial patterns to interfaces.

Can I validate an arm64 snap on an amd64 host?▼

A native LXD container cannot run foreign-architecture snaps. Use an LXD remote on target-architecture hardware, full-system emulation with snapd, or a QEMU/binfmt container for smoke tests only; the Skill selects the environment via a decision tree.

Why does my snap crash immediately with no output?▼

An instant exit with no output usually indicates a wrong ELF interpreter or LD_LIBRARY_PATH layout — a build-correctness bug, not a confinement issue. The devmode-first check catches this before the strict scan and records it in devmode_notes.

Does snap-validator work with classic confinement snaps?▼

No. Classic snaps run without AppArmor mediation, so interface-based validation does not apply. The Skill detects confinement: classic in snapcraft.yaml and stops immediately with an explanatory message.

Which snap interfaces require Snap Store manual review?▼

snapd-control, system-files, docker-support, and kubernetes-support cannot be self-connected and require store review. The Skill cross-checks declared and denial-suggested interfaces against this list and reports matches in store_review_interfaces.

Related Skills

Explore More Software Engineering Skills→
DojoCodingLabsDojoCodingLabs

snap-build

Package Linux desktop apps for Snap Store distribution via snapcraft.yaml and channels.

Official
Advanced
fyndxfyndx
1

bottom-sheet

Implement Gorhom Bottom Sheet modal interactions in React Native apps.

Official
Intermediate
venturecraneventurecrane

intake-to-system-sync

Synchronize leads from an intake CRM to Smokeball with deduplication and field mapping.

Official
Advanced
intendant-devintendant-dev
14

station-e2e-qa

Validates the Station canvas dashboard end to end via a Node and CDP test harness.

Official
Advanced