Pack a Pro-compliant snap

Follow this guide to pack a snap that contains extended security patches or meets regulatory compliance needs.

Core24 and higher

Prerequisites

Enable guest attachment

Snapcraft makes use of Ubuntu Pro’s own support for LXD instances, but this support needs to be explicitly enabled and configured. In a terminal, run:

sudo pro config set lxd_guest_attach=available

This command lets Snapcraft attach its LXD instances to the system’s Pro subscription, and only needs to be executed once.

Restart LXD so the new configuration takes effect:

sudo snap restart lxd

Identify the required Pro services

Next, determine which Pro services fit your needs. Snapcraft supports the following services:

  • esm-apps or esm-infra: If your goal is to pack a snap for an application and include the latest security patches for a base that is no longer under Standard Security Maintenance.

  • fips, fips-updates or fips-preview: If you need to deploy a snap in a highly regulated environment that processes sensitive data.

The desired Pro services must be available. On a system with your Pro token attached, run pro status and check the ENTITLED column for available services. The Ubuntu Pro Client documentation has detailed information on each service.

Pack the snap

Pack your Pro-compliant snap with the pack command, listing the desired services with the --pro option:

snapcraft pack --pro=<service>

To use multiple services, pass them to the option as comma-separated values. For example, to pack a snap with the esm-apps and esm-infra services call:

snapcraft pack --pro=esm-apps,esm-infra

Snapcraft will automatically attach the Pro subscription and enable the requested services on the LXD instance while packing the snap.

Core22

Core22 snaps use a legacy mechanism to pack Pro-compliant snaps. The mechanism uses the term Ubuntu Advantage (UA) instead of Ubuntu Pro.

Prerequisites

Identify the required Pro services

First, determine which Pro services fit your needs:

  • esm-apps or esm-infra: If your goal is to pack a snap for an application and include the latest security patches for a base that is no longer under Standard Security Maintenance.

  • fips, fips-updates or fips-preview: If you need to deploy a snap in a highly regulated environment that processes sensitive data.

The desired Pro services must be available. On a system with your Pro token attached, run pro status and check the ENTITLED column for available services. The Ubuntu Pro Client documentation has detailed information on each service.

List the desired services with the ua-services key in your project file:

snapcraft.yaml
ua-services:
  - esm-apps
  - esm-infra

Pack the snap

Pack your Pro-compliant snap with the pack command, providing the Pro token with the --ua-token option:

snapcraft pack --ua-token <pro-token> --enable-experimental-ua-services

The Pro token can also be provided as an environment variable:

SNAPCRAFT_UA_TOKEN=<token> snapcraft pack --enable-experimental-ua-services

As Pro enablement is an experimental feature, the --enable-experimental-ua-services option is needed in either case.

Snapcraft will automatically attach the Pro subscription and enable the requested services in the build environment while packing the snap.