--- title: Strictly Confined MicroK8s description: MicroK8s is now available as a strictly confined snap on 1.25! What is strict confinement? In summary, it is a snap confinement level that provides complete isolation, up to a minimal access level that’s always deemed safe. Strictly confined snaps can not access files, networks, processes, or any other system resource without requesting s […] url: https://canonical.com/blog/strictly-confined-microk8s?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Berkay Tekin Öz](https://canonical.com/blog/author/berkayoz "More about Berkay Tekin Öz") 26 August 2022 # Strictly Confined MicroK8s [1.25](https://canonical.com/blog/tag/1-25) [kubernetes](https://canonical.com/blog/tag/kubernetes) [MicroK8s](https://canonical.com/blog/tag/microk8s) [strict](https://canonical.com/blog/tag/strict) --- Share the article MicroK8s is now available as a strictly confined snap on 1.25! ``` snap install microk8s --channel=1.25-strict/stable ``` #### What is strict confinement? In summary, it is a snap confinement level that provides complete isolation, up to a minimal access level that’s always deemed safe. Strictly confined snaps can not access files, networks, processes, or any other system resource without requesting specific access. Strict confinement uses security features of the Linux kernel, including AppArmor, seccomp, and namespaces to prevent applications and services from accessing the wider system. #### How does this all work? Interfaces are the key, which can be thought of as a resource access request. Each snap’s interface is carefully selected by the creator to provide specific access to a resource according to its requirements. An interface needs to be connected to be active, and connections are made either automatically (at install time) or manually, depending on their function. Visit [here](https://snapcraft.io/docs/supported-interfaces) for a list of supported interfaces. #### What does this mean for MicroK8s? For example, MicroK8s has interfaces for container runtimes, network rules, etc. which can be seen [here](https://github.com/canonical/microk8s/blob/41001a8b0dc026a181a80b216e10cb78f11b158e/snap/snapcraft.yaml#L589-L804). So when a snap is installed, its metadata is examined and used to derive AppArmor profiles, Seccomp filters, and device cgroup rules, alongside traditional permissions. This combination provides a strong application for confinement and isolation for the Kubernetes runtime. As we all know, Kubernetes is a highly dynamic environment which hosts a lot of applications that are used for a wide variety of solutions. And often times these applications interact with the host machines in a way that can be not so secure. Strict confinement makes sure that this dynamic environment is isolated from the hosts and that applications are doing what they’re supposed to be doing. So any CVEs, malicious actors, bugs, etc. will be limited with this isolation. Although there are caveats to this isolation, for example, some applications require elevated access to critical system resources which might not be granted they are viewed as vulnerabilities. But fear not, MicroK8s comes with an addon system with verified and tested applications that will work on strict confinement. So most of the general use cases will be covered, and the strictly confined ecosystem will grow over time. If there are things that don’t run as expected under strict confinement you can try to find what’s causing the problem by using snappy-debug. ``` snappy-debug.security scanlog ``` This command will list any AppArmor denials in the currently installed and running snaps and suggests appropriate interfaces and fixes for the issues. You can also try running the snap in devmode. A devmode snap runs as a strictly confined snap with full access to system resources and produces debug output to identify unspecified interfaces. You need to install the snap with the devmode flag. ``` snap install microk8s --channel=1.25-strict/stable --devmode ``` You can report bugs and problems by opening an issue on [GitHub](https://github.com/canonical/microk8s/issues/new/choose). ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### How to set up a micro lab: four principles for a reliable homelab](https://canonical.com/blog/how-to-set-up-a-reliable-homelab) After over a decade of running a homelab, I have learned a few difficult lessons. Although it begins as a “lab,” you inevitably end up with something you want to keep. If a... [Jake Nabasny](https://canonical.com/blog/author/slapcat) 17 March 2026 [### Accelerating AI with open source machine learning infrastructure](https://canonical.com/blog/accelerating-ai-with-open-source-machine-learning-infrastructure) The landscape of artificial intelligence is rapidly evolving, demanding robust and scalable infrastructure. To meet these challenges, we’ve developed a comprehensive reference... [Andreea Munteanu](https://canonical.com/blog/author/munteanuandreea) 20 March 2025 [### Deploy your Spring Boot application to production](https://canonical.com/blog/deploy-spring-application-to-production) In this article we walk through the steps required to deploy a Spring Boot application to production using Juju and Kubernetes. The goal is to showcase the integration of the... [Javier de la Puente](https://canonical.com/blog/author/javierdelapuente) 13 January 2026 [### Harnessing the potential of 5G with Kubernetes: a cloud-native telco transformation perspective](https://canonical.com/blog/harnessing-the-potential-of-5g-with-kubernetes-a-cloud-native-telco-transformation-perspective) Telecommunications networks are undergoing a cloud-native revolution. 5G promises ultra-fast connectivity and real-time services, but achieving those benefits requires an... [Benjamin Ryzman](https://canonical.com/blog/author/benjaminryzman) 10 December 2025