"Failed to enable snapd service" on ubuntu-24.04: Focal's AppArmor and the Linux 7.0 kernel in snapcraft, rockcraft and charmcraft builds
Starting with the ubuntu-24.04 image 20261026.354, the runner's kernel moved from 6.17.0-1022-azure to 7.0.0-1017-azure. Canonical's build tools (snapcraft, rockcraft, charmcraft) build inside an LXD container of the target base and install snapd there. When that base is Ubuntu 20.04 (Focal), Focal's apparmor_parser 2.13 cannot load its profiles into the 7.0 kernel, snapd.service fails to start, and the build stops while it sets up the container. The image 20261101.360 has the same kernel, so a re-run fails the same way, and GitHub cannot pin an older kernel in the image (runner-images #15197).
What it looks like
From rockcraft with build-base: ubuntu@20.04 (craft-actions #144):
Executing in container: lxc --project rockcraft exec local:base-instance-rockcraft-buildd-base-v71--... -- env ... systemctl restart snapd.service Failed to enable snapd service. * Command that failed: 'lxc --project rockcraft exec ... systemctl restart snapd.service' * Command exit code: 1 * Command standard error output: b'Job for snapd.service failed because the control process exited with error code.\nSee "systemctl status snapd.service" and "journalctl -xe" for details.\n' craft_providers.errors.BaseConfigurationError: Failed to enable snapd service.
Inside the container, the cause is the AppArmor parser, which exits with status 185:
/sbin/apparmor_parser: Unable to replace "...": Profile doesn't conform to protocol
snapcraft fails the same way for a snap with base: core20, because it builds in a Focal container too (the report in #15197 is a core20 snap). The job passed a few days earlier on the same workflow, which is why it looks like a broken runner: the only change is the image, and with it the kernel.
The two fixes
- Move to a newer base:
base: core22orcore24for a snap,build-base: ubuntu@22.04or later for a rock. Ubuntu 20.04 is out of standard support, so this is the fix GitHub recommends. - Until then, run that job on
runs-on: ubuntu-22.04, whose kernel still accepts Focal's AppArmor profiles. Canonical's own CI moved its Focal builds back toubuntu-22.04(craft-actions #144).
The same rejection has been reported on Ubuntu 26.04 hosts (charmcraft #2816), so moving the job to ubuntu-latest as it becomes 26.04 does not avoid it.
Telling it apart
- If the Set up job step shows
ubuntu-24.04version 20261025.353.1 and its "Included Software" link does not open, that image was served without published release notes. GitHub is looking into it, and it is not the cause of this failure; the kernel change is (#15197). - A container that starts but whose process is killed by AppArmor with
docker-default//&unconfinedin the log is a different change on Ubuntu 26.04 (Postgres never starts in Docker on Ubuntu 26.04).
See failed jobs from IntelliJ IDEA
Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, so a packaging job that started failing after an image update stands out, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).
Get it on JetBrains Marketplace
GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu and Snapcraft are trademarks of Canonical Ltd.; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by any of them.
More: Postgres never starts in Docker on Ubuntu 26.04 · "The ubuntu-latest label will migrate to Ubuntu 26" · GitHub Actions plugins for IntelliJ IDEA compared · 日本語