Does snap packages run similar to containers (docker / rkt etc) or use different underlying technology?

Question

The technology(underlying mechanism) used by containers like docker/rkt etc is a well documented and published. At a high level - they use namespace and cgroups for isolation and resource limiting respectively.

Now Snap (or snapd) is a kind of packaging, deployment and runtime (hope its a runtime too) developed for linux platforms / distros. I am trying to understand what kind of tech snap uses at runtime and what sort of isolation (and resource limiting.. if provided) snap provides.

I have referred through wiki (snap) and few articles. But they don't explain the underlying technology to satisfaction.

Abstract from - What You Need to Know About Snaps on Ubuntu 20.04

at run time that the snap file is mounted on a block loop device. This allows the file’s internal SquashFS file system to be accessed.

and

The application is executed in an encapsulated, ring-fenced way, so its files can’t interfere with those on your computer

Any thoughts on the runtime internals (underlying technology of snap)... thanks for any answers !!

--there is no tag for snap on sof yet. Quite sad :-( Request someone to create one.
snap could be a hit like containers some time in future.

Answer 1

There is a document in the Snap repository that goes into a bit more depth on the underlying mechanisms used by Snap:

https://github.com/snapcore/snapd/wiki/snap-confine-Overview

To give a quick overview here:

• Snap uses cgroups, as you surmised in your question
• There isn't really a "runtime"; cgroups are a feature of the Linux Kernel. The Kernel is the closest thing to a runtime used by Snap. Or, you could consider Snap itself to be the runtime.
• Snap is really only concerned with OS level isolation, eg libraries, binaries, etc.
• Snap doesn't really enforce device isolation or security.
• For security, Snap instead heavily relies on AppArmor and Seccomp.
• If you're on a distro that doesn't use AppArmor, Snaps have no security mechanisms.