What is the classic mode of snap, and why do some snaps not install without it (e.g. MS Visual Studio)?
Solution 1:
Watch this short video that explains each of the confinement models available in snaps, why --classic exists and its use case.
Sources: The following documentation is taken from snapcraft.io: confinement policies.
strict
This is the default security policy applied to snaps. The snap has read and/or write rights only in its own install space and selected areas. It has access to libraries it bundles and/or provided by the core or ubuntu-core snap. Extended rights can be granted with interfaces, which are connected either at install time or by the user with the snap connect command. For example, the home interface will grant read rights in the user’s home.
Strict confinement gives you the following readable and/or writable paths:
- /snap/snapname/revision (read-only, snap install path)
- /var/snap/snapname/revision (read/write, per-revision data)
- /var/snap/snapname/common (read/write, common data)
- /home/$USER/snap/snapname/revision (read/write, per-revision user data)
- /home/$USER/snap/snapname/common (read/write, common user data)
See the list of environment variables for more details on what is visible to a strictly confined snap, as well as ways to access a shell within the confined space of a snap.
devmode
Developer mode, also known as devmode, uses the same security policies as strict confinement, but security denials are turned into warnings in /var/log/syslog (see Debugging). This is useful when snapping an application, to discover which interfaces need to be declared. Snaps in developer mode can not be released into the stable and candidate store channels.
classic
A snap in classic confinement behaves as a traditionally packaged application, with full access to the system. As opposed to strict and devmode, what a classic snap sees as "/" is the host system’s "/" and not the core snap’s "/". Snaps using this fully open security policy are manually reviewed in the store and are only allowed on systems where snapd is installed on top of a traditional Linux distribution, as opposed to system booting from an Ubuntu Core image. They can be released in all store channels.