A snap carries its own runtime libraries, mounts read only once installed, and lets two versions sit side by side. Somebody has to make that work: unpack the package, set up the mount, open the permissions the manifest asked for, and swap in the new revision on schedule. That somebody is snapd.

What it is responsible for

snapd is the daemon behind the universal Linux package format called snap, and it handles mounting, granting permissions by rule and delivering updates. The current version is 2.78.

What the format buys is consistency across distributions. The same package on Ubuntu and on Fedora runs the same contents, and whatever libraries the system already had barely matter to it. That is also where the cost sits, since bundled dependencies mean the same runtime is stored several times over.

What 2.78 changed

Version 2.78 was released on 7 October 2026, and it is not a pre release. Three areas take up most of the changelog.

The first is full disk encryption. Reconfiguring now refreshes the keyring, rebuilds state, and judges the encryption status through the complete flow; keys travel over an in memory file descriptor. For Ubuntu Core devices, configuring the security level of a Thunderbolt port with no further setup is now supported.

The second is components and configuration. A seed refresh takes components into account and blocks removal of a component named in the seed, and the runtime environment of an application can now locate the component directory. The configuration database reads and writes built in entries, passes changes through the constraint set before touching state, and reports errors down to the specific key.

The third is interfaces. This release adds a driver observation interface, lets the content interface share files through components, teaches power control to recognise the standard charge threshold attributes, and allows restart with a flag on the shutdown interface. A few other patches deal with device identification and paths containing spaces. Audit logging now records administrative actions and unauthorised access as who, what and why, which makes an investigation considerably clearer than before.

A handful of items affect daily use: the disk space check gained a reservation option and refreshes only the necessary packages when room runs short, quota groups came out of preview, the user prompt that announces an application refresh is on by default, and restart in recovery mode became a one shot entry.

Three levels of isolation

Strict confinement is the default. It closes an application in using three pieces of the kernel: AppArmor holds the access rules, seccomp holds the system calls, and namespaces separate the view of the file system and of processes, so the application cannot see the world outside its container. A camera or the user directory is reachable only through an interface declaration.

Classic confinement leaves a gap for software that has to touch the whole system, and it only takes effect when the parameter is passed explicitly at install time, which amounts to giving up the isolation. Devmode targets packagers: it still runs under the strict rules but can reach system resources and print which interfaces are still missing. It is a debugging level, and such packages do not update themselves.

Interfaces connected on demand

An application under strict confinement has to declare the interface for each system capability it wants, and then the user or the system completes the connection. The documentation keeps a long alphabetical list, one entry from audio playback and camera through Bluetooth to device control.

The design writes what an application can do into its own declaration, so it is legible before installation. The price is that some features need an interface connected by hand, and the first use of a particular device is where people tend to stall.

Updates arrive, and can be undone

Refreshes are the business of the refresh mechanism, which by default runs on a fixed rhythm, and the previous revision stays in place after a new one takes over. If something turns out wrong, one rollback command returns to the earlier revision without hunting for an old package.

Anyone who would rather it stayed still can hold refreshes for a single package or change the system wide refresh policy. The documentation notes that holding refreshes needs version 2.58 or later.

Reach across distributions

The installation section lists eighteen distributions: Ubuntu, Debian, Fedora, CentOS, Red Hat, Rocky, AlmaLinux, Arch, Manjaro, openSUSE, Linux Mint, Kali, Parrot, Pop!_OS, Elementary, KDE Neon, GalliumOS and Raspberry Pi OS.

That reach is one of the format's main selling points. Where the same software must be supplied to several distributions at once, packaging it once beats maintaining a separate set for each.

The tie to immutable systems

Ubuntu Core is Canonical's embedded system, described officially as an immutable, minimal and strictly confined Linux. There is no traditional package manager on such a system; the applications and updates of the whole machine travel the snap road, and delta updates, over the air upgrades and deployment to offline environments all depend on it.

On those devices snapd is not merely a way to install software but a base component that keeps the system in a consistent state. Much of what 2.78 changed around full disk encryption, seed refresh and recovery mode serves exactly that setting.

What to know beforehand

Automatic updates are the default behaviour and not an optional feature. Anyone who dislikes the rhythm has to switch it off, and after that has to watch security updates personally, a trade worth thinking through in advance.

Package size is the other frequent complaint. Bundling dependencies means duplication, with one runtime stored separately in several packages, which shows on a small machine short of disk.

It also leans on kernel features. Inside a container, on a minimal system, or where kernel modules have been trimmed, the isolation may not work as expected, and that is the layer to inspect first when trouble appears.

snapd solves the problem of one package running on any distribution: dependencies travel along, isolation comes in three levels, interfaces connect on demand, and updates push themselves while leaving one rollback available. The weight of 2.78 sits on encryption, components and interfaces, which few people will notice day to day; look towards the immutable system line and it becomes obvious.