Administering snap packages on Ubuntu: updates, holds, confinement and safe removal

What it is

Snap is Ubuntu's separate package format and daemon (snapd); it does not exist by default on Debian. snap list shows installed snaps with their tracking channel, revision and any notes (such as held); snap info <name> shows what channels and confinement a given snap offers before installing it.

Why it matters

Unlike apt packages, snaps refresh themselves on a background schedule the administrator did not necessarily trigger — by default "scheduled to refresh four times per day" — which matters for change control on a server where an unplanned application update is unwelcome, and confinement matters because a snap with broad system access defeats much of the isolation the format is meant to provide.

How to apply

• Inspect the current update schedule and any holds with snap refresh --time and snap list (a held snap shows held in the Notes column).
• To pause updates for one snap, indefinitely or for a fixed period: snap refresh --hold=<name> or snap refresh --hold=24h <name>; the hold "command holds, or postpones, snap updates for individual snaps, or for all snaps on the system". Release it with snap refresh --unhold <name>.
• For fleet-wide policy instead of per-snap holds, set the system options refresh.timer (custom schedule) or refresh.hold (delay all refreshes until a given RFC 3339 date/time) with snap set system refresh.hold="2026-10-01T00:00:00Z".
• Before installing a snap that needs elevated access, check its confinement: snap info <name> reports strict, classic or devmode. A snap's "confinement level controls the degree of isolation it has from the user's system"; classic snaps run with no sandboxing at all and should be treated like any other unconfined package install.
• For troubleshooting a misbehaving snap, read its own log stream: journalctl filtered to the snap's unit, or install the helper (snap install snappy-debug) and run sudo journalctl --output=short --follow --all | sudo snappy-debug to decode AppArmor denials related to snap confinement into a readable explanation.
• To remove a snap: snap remove <name>. By default this keeps a snapshot of the snap's user, system and configuration data, "retained for 31 days", so a mistaken removal is recoverable via snap saved/snap restore; add --purge to skip the snapshot and delete everything immediately.

Pitfalls

• Holding a snap also holds its security fixes; review holds periodically the same way as an apt-mark hold.
• Hold limits changed across snapd versions: older releases capped refresh.hold at 90 days, while current snapd also accepts open-ended holds (snap refresh --hold without a duration, or refresh.hold=forever). Check snap version and the documentation for the installed release before relying on either behaviour.
• classic confinement is opt-in per snap and requires the --classic flag at install time; a script that blindly adds --classic to satisfy an error message is granting full system access, not just working around a sandboxing quirk.