high CPU usage by snapd in incus containers

[mcesaro]

• Distribution: ubuntu
• Distribution version: 23.04 lunar lobster

• The output of "incus info" or if that fails:

  • Kernel version:

  • kernel_features kernel: Linux kernel_architecture: x86_64 kernel_features: kernel_version: 6.5.1-060501-generic

  • LXC version: lxc not installed

  • lxc_features driver: lxc | qemu lxc_features:

  • Incus version:

    Client version: 0.4
    Server version: 0.4  

  • Storage backend in use: btrfs

Issue description

In my development system I migrated to incus from lxd, I removed the lxd snap and the snap package. However, I found that incus containers, just like lxd, are using the snapd service that eats a lot of CPU time.

By looking at the dmesg log, it seems that there might be a relation with apparmor, and if this is the case is there a way to get rid of it?

Thanks

• [ ] Any relevant kernel output (dmesg)

  [ 8113.706141] audit: type=1400 audit(1706177664.245:1272): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.706156] audit: type=1400 audit(1706177664.245:1273): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.713903] audit: type=1400 audit(1706177664.253:1274): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.717103] audit: type=1400 audit(1706177664.257:1275): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.717266] audit: type=1400 audit(1706177664.257:1276): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.717271] audit: type=1400 audit(1706177664.257:1277): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.717617] audit: type=1400 audit(1706177664.257:1278): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.717664] audit: type=1400 audit(1706177664.257:1279): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.717999] audit: type=1400 audit(1706177664.257:1280): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8113.718465] audit: type=1400 audit(1706177664.257:1281): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-border_</var/lib/incus>//&:incus-border_<
  [ 8194.299416] audit: type=1400 audit(1706177744.835:1288): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snap
  [ 8194.318868] audit: type=1400 audit(1706177744.855:1289): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snap
  [ 8246.370062] audit: type=1400 audit(1706177796.904:1290): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snap
  [ 8246.409907] audit: type=1400 audit(1706177796.944:1291): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snap
  [ 8430.194154] audit: type=1400 audit(1706177980.716:1292): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap-updat
  [ 8430.345696] audit: type=1400 audit(1706177980.868:1293): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.a
  [ 8430.348368] audit: type=1400 audit(1706177980.868:1294): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.b
  [ 8430.348893] audit: type=1400 audit(1706177980.868:1295): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.c
  [ 8430.366387] audit: type=1400 audit(1706177980.888:1296): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.h
  [ 8430.370322] audit: type=1400 audit(1706177980.892:1297): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.b
  [ 8430.371738] audit: type=1400 audit(1706177980.892:1298): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.d
  [ 8430.371944] audit: type=1400 audit(1706177980.892:1299): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.h
  [ 8430.374286] audit: type=1400 audit(1706177980.896:1300): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.l
  [ 8430.378752] audit: type=1400 audit(1706177980.900:1301): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.h
  [ 8480.295290] audit: type=1400 audit(1706178030.812:1306): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snap
  [ 8480.316884] audit: type=1400 audit(1706178030.832:1307): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snap
  [ 8480.335083] audit: type=1400 audit(1706178030.852:1308): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap-updat
  [ 8480.499397] audit: type=1400 audit(1706178031.016:1309): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.h
  [ 8480.500137] audit: type=1400 audit(1706178031.016:1310): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.c
  [ 8480.514838] audit: type=1400 audit(1706178031.032:1311): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.h
  [ 8480.518408] audit: type=1400 audit(1706178031.036:1312): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.l
  [ 8480.522770] audit: type=1400 audit(1706178031.040:1313): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.a
  [ 8480.525981] audit: type=1400 audit(1706178031.044:1314): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.b
  [ 8480.529934] audit: type=1400 audit(1706178031.048:1315): apparmor="STATUS" operation="profile_replace" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.b
  [ 8502.089879] audit: type=1400 audit(1706178052.603:1322): apparmor="DENIED" operation="file_inherit" class="net" namespace="root//incus-riak1_<var-lib-incus>" profile="/snap/snapd/19993/usr/lib/snapd
  [ 8502.106424] audit: type=1400 audit(1706178052.623:1323): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//incus-riak1_<var-lib-incus>" profile="snap-update-ns.lxd" name="/app
  [ 8502.325839] audit: type=1400 audit(1706178052.839:1324): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//incus-riak1_<var-lib-incus>" profile="snap.lxd.hook.install" name="/
  [ 8509.851664] audit: type=1400 audit(1706178060.366:1325): apparmor="DENIED" operation="file_inherit" class="net" namespace="root//incus-riak1_<var-lib-incus>" profile="/snap/snapd/19993/usr/lib/snapd
  [ 8509.851673] audit: type=1400 audit(1706178060.366:1326): apparmor="DENIED" operation="file_inherit" class="net" namespace="root//incus-riak1_<var-lib-incus>" profile="/snap/snapd/19993/usr/lib/snapd/snap-confine" pid=38074 comm="snap-confine" family="unix" sock_type="stream" protocol=0 requested_mask="send receive" denied_mask="send receive"
  [ 8509.855300] audit: type=1400 audit(1706178060.370:1327): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//incus-riak1_<var-lib-incus>" profile="snap.lxd.activate" name="/apparmor/.null" pid=38074 comm="snap-exec" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=0
  [ 8509.855308] audit: type=1400 audit(1706178060.370:1328): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//incus-riak1_<var-lib-incus>" profile="snap.lxd.activate" name="/apparmor/.null" pid=38074 comm="snap-exec" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=0
  [ 8509.875070] audit: type=1400 audit(1706178060.390:1329): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//incus-riak1_<var-lib-incus>" profile="/snap/snapd/19993/usr/lib/snapd/snap-confine" name="/apparmor/.null" pid=38074 comm="aa-exec" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=0
  [ 8509.875078] audit: type=1400 audit(1706178060.390:1330): apparmor="DENIED" operation="file_inherit" class="file" namespace="root//incus-riak1_<var-lib-incus>" profile="/snap/snapd/19993/usr/lib/snapd/snap-confine" name="/apparmor/.null" pid=38074 comm="aa-exec" requested_mask="wr" denied_mask="wr" fsuid=1000000 ouid=0
  [ 8535.458981] audit: type=1400 audit(1706178085.969:1331): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snapd/19993/usr/lib/snapd/snap-confine" pid=38187 comm="apparmor_parser"
  [ 8535.459001] audit: type=1400 audit(1706178085.969:1332): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="/snap/snapd/19993/usr/lib/snapd/snap-confine//mount-namespace-capture-helper" pid=38187 comm="apparmor_parser"
  [ 8535.466195] audit: type=1400 audit(1706178085.977:1333): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap-update-ns.lxd" pid=38189 comm="apparmor_parser"
  [ 8535.468886] audit: type=1400 audit(1706178085.981:1334): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.activate" pid=38190 comm="apparmor_parser"
  [ 8535.469186] audit: type=1400 audit(1706178085.981:1335): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.benchmark" pid=38191 comm="apparmor_parser"
  [ 8535.469207] audit: type=1400 audit(1706178085.981:1336): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.hook.install" pid=38196 comm="apparmor_parser"
  [ 8535.469471] audit: type=1400 audit(1706178085.981:1337): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.check-kernel" pid=38193 comm="apparmor_parser"
  [ 8535.469594] audit: type=1400 audit(1706178085.981:1338): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.buginfo" pid=38192 comm="apparmor_parser"
  [ 8535.470967] audit: type=1400 audit(1706178085.981:1339): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.daemon" pid=38194 comm="apparmor_parser"
  [ 8535.471387] audit: type=1400 audit(1706178085.981:1340): apparmor="STATUS" operation="profile_replace" info="same as current profile, skipping" label="incus-riak1_</var/lib/incus>//&:incus-riak1_<var-lib-incus>:unconfined" name="snap.lxd.hook.configure" pid=38195 comm="apparmor_parser"

• [ ] Container log (incus info NAME --show-log)
• [ ] Container configuration (incus config show NAME --expanded)

  $ incus config show riak1 --expanded
  architecture: x86_64
  config:
  environment.DISPLAY: :0
  environment.PULSE_SERVER: unix:/home/ubuntu/pulse-native
  image.architecture: amd64
  image.description: ubuntu 22.04 LTS amd64 (release) (20230828)
  image.label: release
  image.os: ubuntu
  image.release: jammy
  image.serial: "20230828"
  image.type: squashfs
  image.version: "22.04"
  user.user-data: |
  #cloud-config
  runcmd:
    - 'sed -i "s/; enable-shm = yes/enable-shm = no/g" /etc/pulse/client.conf'
  packages:
    - x11-apps
    - mesa-utils
    - pulseaudio
  volatile.base_image: c2f7dd935a86cfac7746857b0ba8a0352187b2889e92b6d8817fa881337975a4
  volatile.cloud-init.instance-id: fc8ee756-6396-4f7d-a4b9-7cd3d996f567
  volatile.eth0.host_name: veth88efc308
  volatile.eth0.hwaddr: 00:16:3e:4c:e9:73
  volatile.idmap.base: "0"
  volatile.idmap.current: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":100
  volatile.idmap.next: '[{"Isuid":true,"Isgid":false,"Hostid":1000000,"Nsid":0,"Maprange":1000000000},{"Isuid":false,"Isgid":true,"Hostid":1000000,"Nsid":0,"Maprange":100000
  volatile.last_state.idmap: '[]'
  volatile.last_state.power: RUNNING
  volatile.uuid: 9329abfc-5aa7-42b1-bb26-c353936e235d
  volatile.uuid.generation: 9329abfc-5aa7-42b1-bb26-c353936e235d
  devices:
  PASocket1:
  bind: container
  connect: unix:/run/user/1000/pulse/native
  gid: "1000"
  listen: unix:/home/ubuntu/pulse-native
  mode: "0777"
  security.gid: "1000"
  security.uid: "1000"
  type: proxy
  uid: "1000"
  X0:
  bind: container
  connect: unix:@/tmp/.X11-unix/X0
  listen: unix:@/tmp/.X11-unix/X0
  security.gid: "1000"
  security.uid: "1000"
  type: proxy
  eth0:
  name: eth0
  network: lxdbr0
  type: nic
  mygpu:
  type: gpu
  root:
  path: /
  pool: lxcpool
  type: disk
  ephemeral: false
  profiles:
  - default
  - pmax
  - x11
  stateful: false
  description: ""

• [ ] Main daemon log (at /var/log/incus/incusd.log)

  time="2024-01-25T08:59:27+01:00" level=warning msg=" - Couldn't find the CGroup hugetlb controller, hugepage limits will be ignored"
  time="2024-01-25T08:59:27+01:00" level=warning msg=" - Couldn't find the CGroup network priority controller, per-instance network priority will be ignored. Please use per-device limits.priority instead"

• [ ] Output of the client with --debug
• [ ] Output of the daemon with --debug (alternatively output of incus monitor --pretty while reproducing the issue)

[stgraber]

What snap packages are you running in the container?

[mcesaro]

None, I avoid snap packages as much as possible. Note that on htop I get the same issue with all the containers, not just with riak1. And I masked the snapd service.

And this is what I get from ps output:

 ps -edalf | grep snapd
1 S 1000000     1757    1601  0  80   0 -  1192 -      14:49 ?        00:00:01 snapfuse /var/lib/snapd/snaps/snapd_19993.snap /snap/snapd/19993 -o ro,nodev,allow_other,suid
1 S 1000000     2082    1937  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/bare_5.snap /snap/bare/5 -o ro,nodev,allow_other,suid
1 S 1000000     2083    1937  0  80   0 -  1209 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2105.snap /snap/core20/2105 -o ro,nodev,allow_other,suid
1 S 1000000     2084    1937  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/gnome-3-38-2004_140.snap /snap/gnome-3-38-2004/140 -o ro,nodev,allow_other,suid
1 S 1000000     2085    1937  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2015.snap /snap/core20/2015 -o ro,nodev,allow_other,suid
1 S 1000000     2087    1937  0  80   0 -  1157 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/gnome-3-38-2004_143.snap /snap/gnome-3-38-2004/143 -o ro,nodev,allow_other,suid
1 S 1000000     2088    1937  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/snapd_20290.snap /snap/snapd/20290 -o ro,nodev,allow_other,suid
1 S 1000000     2090    1937  0  80   0 -  1157 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/gtk-common-themes_1535.snap /snap/gtk-common-themes/1535 -o ro,nodev,allow_other,suid
1 S 1000000     2092    1937  0  80   0 -  1191 -      14:49 ?        00:00:02 snapfuse /var/lib/snapd/snaps/snapd_20671.snap /snap/snapd/20671 -o ro,nodev,allow_other,suid
1 S 1000000     2093    1937  0  80   0 -  1174 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/lxd_24322.snap /snap/lxd/24322 -o ro,nodev,allow_other,suid
0 S 1000000     2169    1937  0  80   0 - 514644 -     14:49 ?        00:00:00 /usr/lib/snapd/snapd
1 S 1000000     2709    2426  0  80   0 -  1185 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2105.snap /snap/core20/2105 -o ro,nodev,allow_other,suid
1 S 1000000     2710    2426  0  80   0 -  1193 -      14:49 ?        00:00:02 snapfuse /var/lib/snapd/snaps/snapd_20671.snap /snap/snapd/20671 -o ro,nodev,allow_other,suid
1 S 1000000     2711    2426  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/snapd_20290.snap /snap/snapd/20290 -o ro,nodev,allow_other,suid
1 S 1000000     2712    2426  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2015.snap /snap/core20/2015 -o ro,nodev,allow_other,suid
1 S 1000000     2713    2426  0  80   0 -  1174 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/lxd_24322.snap /snap/lxd/24322 -o ro,nodev,allow_other,suid
0 S 1000000     2863    2426  0  80   0 - 514580 -     14:49 ?        00:00:00 /usr/lib/snapd/snapd
1 S 1000000     3849    3296  0  80   0 -  1183 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2105.snap /snap/core20/2105 -o ro,nodev,allow_other,suid
1 S 1000000     3850    3296  0  80   0 -  1174 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/lxd_24322.snap /snap/lxd/24322 -o ro,nodev,allow_other,suid
1 S 1000000     3851    3296  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/snapd_20290.snap /snap/snapd/20290 -o ro,nodev,allow_other,suid
1 S 1000000     3852    3296  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2015.snap /snap/core20/2015 -o ro,nodev,allow_other,suid
1 S 1000000     3853    3296  0  80   0 -  1183 -      14:49 ?        00:00:02 snapfuse /var/lib/snapd/snaps/snapd_20671.snap /snap/snapd/20671 -o ro,nodev,allow_other,suid
1 S 1000000     3902    3494  0  80   0 -  1083 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2015.snap /snap/core20/2015 -o ro,nodev,allow_other,suid
1 S 1000000     3903    3494  0  80   0 -  1116 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core22_1033.snap /snap/core22/1033 -o ro,nodev,allow_other,suid
1 S 1000000     3904    3494  0  80   0 -  1116 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/lxd_26200.snap /snap/lxd/26200 -o ro,nodev,allow_other,suid
1 S 1000000     3913    3494  0  80   0 -  1083 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/snapd_20290.snap /snap/snapd/20290 -o ro,nodev,allow_other,suid
1 S 1000000     3914    3494  0  80   0 -  1152 -      14:49 ?        00:00:01 snapfuse /var/lib/snapd/snaps/snapd_20671.snap /snap/snapd/20671 -o ro,nodev,allow_other,suid
1 S 1000000     3920    3494  0  80   0 -  1083 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/lxd_26093.snap /snap/lxd/26093 -o ro,nodev,allow_other,suid
1 S 1000000     3923    3494  0  80   0 -  1083 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core22_864.snap /snap/core22/864 -o ro,nodev,allow_other,suid
1 S 1000000     3926    3494  0  80   0 -  1083 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2105.snap /snap/core20/2105 -o ro,nodev,allow_other,suid
0 S 1000000     4133    3296  0  80   0 - 532949 -     14:49 ?        00:00:00 /usr/lib/snapd/snapd
0 S 1000000     4169    3494  0  80   0 - 477745 -     14:49 ?        00:00:00 /usr/lib/snapd/snapd
1 S 1000000     4328    3593  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2015.snap /snap/core20/2015 -o ro,nodev,allow_other,suid
1 S 1000000     4329    3593  0  80   0 -  1191 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/avahi_316.snap /snap/avahi/316 -o ro,nodev,allow_other,suid
1 S 1000000     4338    3593  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/avahi_310.snap /snap/avahi/310 -o ro,nodev,allow_other,suid
1 S 1000000     4339    3593  0  80   0 -  1192 -      14:49 ?        00:00:02 snapfuse /var/lib/snapd/snaps/snapd_20671.snap /snap/snapd/20671 -o ro,nodev,allow_other,suid
1 S 1000000     4342    3593  0  80   0 -  1228 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2105.snap /snap/core20/2105 -o ro,nodev,allow_other,suid
1 S 1000000     4343    3593  0  80   0 -  1174 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/lxd_24322.snap /snap/lxd/24322 -o ro,nodev,allow_other,suid
1 S 1000000     4345    3593  0  80   0 -  1124 -      14:49 ?        00:00:00 snapfuse /var/lib/snapd/snaps/snapd_20290.snap /snap/snapd/20290 -o ro,nodev,allow_other,suid
0 S 1000000     4544    3593  0  80   0 - 496211 -     14:49 ?        00:00:00 /usr/lib/snapd/snapd
1 S 1000000     5903    3837  0  80   0 -  1178 -      14:49 ?        00:00:02 snapfuse /var/lib/snapd/snaps/snapd_19993.snap /snap/snapd/19993 -o ro,nodev,allow_other,suid
0 S 1000000     6045    3837 75  80   0 - 891513 -     14:50 ?        00:04:35 /usr/lib/snapd/snapd
1 S 1000000     6882    3837  0  80   0 -  1184 -      14:51 ?        00:00:00 snapfuse /var/lib/snapd/snaps/core20_2015.snap /snap/core20/2015 -o ro,nodev,allow_other,suid
0 S 1000000     6899    1601 12  80   0 - 786410 -     14:52 ?        00:00:30 /usr/lib/snapd/snapd

[stgraber]

Then you should just remove the snapd package from that container. apt remove --purge snapd

Note that the images that we produce do not include snapd out of the box, so newer containers shouldn't have this problem.

[mcesaro]

@stgraber That solved it! My bad for not figuring out that the images from canonical included snapd by default. Thank you very much.