Safely Discard a Preserved Snap Mount Namespace

A snap gets stuck with a stale mount namespace and refuses to start cleanly again: snap-discard-ns is the repair tool, used deliberately. You will finish with a controlled way to discard the preserved mount namespace for one snap instance, after checking exactly what will be removed. This is an administrative repair operation, not a normal snap management command. The examples use snapd 2.76.3+ubuntu24.04 and its installed helper at /usr/lib/snapd/snap-discard-ns.

Allow about ten minutes for a single investigation. You need a shell, the snapd package, and root privileges for the discard itself. The command unmounts and removes snapd's preserved namespace files, so do not run it against a snap that is actively starting or serving work. Stop or quiesce the affected workload first, using the service's normal maintenance procedure.

1. Confirm that this is the right tool

snap-discard-ns is an internal snapd helper. It discards a preserved mount namespace for one snap instance. It is not the command for removing a snap, refreshing a snap, or changing its interfaces. The public snap client should remain your first choice for ordinary snap administration.

Check the package version and helper path without changing state:

$ dpkg-query -W -f='${Package} ${Version}\n' snapd
snapd 2.76.3+ubuntu24.04
$ command -v snap-discard-ns || true
$ test -x /usr/lib/snapd/snap-discard-ns && echo 'helper is installed'
helper is installed

On another distribution the helper may be installed below a different libexec directory. Use the path supplied by that package rather than copying the Ubuntu path blindly. The manpage installed here documents the command as snap-discard-ns; the package file list supplies the absolute path.

2. Choose the exact snap instance name

The positional argument is a snap instance name. Instance names matter when a snap has a non-default instance, so copy the name exactly from the local snap list:

$ snap list
Name       Version   Rev   Tracking       Publisher   Notes
SNAP_NAME  VERSION   REV   latest/stable  PUBLISHER   -

Replace SNAP_NAME in the examples with the real value from your output. Do not include the displayed version, revision, channel, or publisher. If the snap is an instance, use the complete instance name shown by snap list.

Record the target before escalating privileges:

$ SNAP_INSTANCE_NAME='replace-with-the-exact-instance-name'
$ printf 'target: %s\n' "$SNAP_INSTANCE_NAME"
target: replace-with-the-exact-instance-name

This assignment changes only your current shell environment. It does not alter snapd configuration.

3. Inspect the preserved namespace files

snapd keeps preserved namespace state below /run/snapd/ns. The primary mount namespace is named $SNAP_INSTANCE_NAME.mnt. A per-user namespace uses the form $SNAP_INSTANCE_NAME.*.mnt. The associated mount profiles use snap.$SNAP_INSTANCE_NAME.fstab and snap.$SNAP_INSTANCE_NAME.*.user-fstab.

Inspect the exact target with a read-only listing:

$ sudo find /run/snapd/ns -maxdepth 1 -type f \
    \( -name "$SNAP_INSTANCE_NAME.mnt" \
    -o -name "$SNAP_INSTANCE_NAME.*.mnt" \
    -o -name "snap.$SNAP_INSTANCE_NAME.fstab" \
    -o -name "snap.$SNAP_INSTANCE_NAME.*.user-fstab" \) \
    -printf '%f\n' | sort
SNAP_INSTANCE_NAME.mnt
snap.SNAP_INSTANCE_NAME.fstab

The output above is illustrative: filenames depend on the target and on whether a per-user namespace exists. An empty result means there is no matching preserved state to discard, or that the name was entered incorrectly. Recheck the name before continuing.

4. Quiesce the snap before changing its namespace

Before the destructive step, make sure the snap is not starting an application, running a hook, or serving a request that depends on the preserved namespace. The correct action depends on the snap. If it provides a system service, use its documented service maintenance procedure; if it is a desktop application, close it and verify that its processes have exited.

Use ordinary inspection to look for processes whose command lines mention the instance:

$ pgrep -a -f -- "$SNAP_INSTANCE_NAME" || true
$ snap services "$SNAP_INSTANCE_NAME" 2>/dev/null || true

These checks are not a complete process or service audit. They are a prompt to investigate before proceeding. A process list that looks quiet does not authorise stopping an unrelated service. If the snap is business-critical, take the maintenance window and rollback path required by that service.

5. Discard the preserved namespace

Run the helper with elevated privileges and the exact instance name:

$ sudo /usr/lib/snapd/snap-discard-ns "$SNAP_INSTANCE_NAME"
$ status=$?
$ printf 'snap-discard-ns exit status: %s\n' "$status"
snap-discard-ns exit status: 0

A zero status means the installed helper accepted and completed the discard operation. The command does not print a success report for you to parse, so capture the exit status immediately, before running another command. A non-zero status means the operation needs investigation; preserve the diagnostic text and do not repeatedly retry it while a snap may be active.

The helper coordinates with snapd's per-snap lock. With no option, it checks and acquires the lock itself. --snap-already-locked tells it that the caller already holds that lock, and --from-snap-confine is an internal alias used by snap-confine. Do not add either option to a normal manual invocation. Passing the wrong lock state can turn a coordination problem into a misleading failure.

6. Verify the result and allow snapd to recreate state

Check the same target files again:

$ sudo find /run/snapd/ns -maxdepth 1 -type f \
    \( -name "$SNAP_INSTANCE_NAME.mnt" \
    -o -name "$SNAP_INSTANCE_NAME.*.mnt" \
    -o -name "snap.$SNAP_INSTANCE_NAME.fstab" \
    -o -name "snap.$SNAP_INSTANCE_NAME.*.user-fstab" \) \
    -printf '%f\n' | sort

For an idle target, the matching preserved files should now be absent. Do not treat the absence of every file in /run/snapd/ns as a success condition, because that directory belongs to all snaps and may contain per-user state.

Start the snap again through its normal entry point or service procedure. snap-confine can then create a fresh namespace when it needs one. Verify the application using its own health check, logs, or a small test request. If it fails to start, restore service using the procedure you used to stop it, then inspect snapd and application logs rather than manually recreating files below /run/snapd/ns.

There is no undo command that restores the discarded mount namespace. The recovery path is to let snapd and snap-confine construct a new one. Do not copy old namespace files back by hand.

7. Turn on diagnostics only when needed

Set SNAP_CONFINE_DEBUG for one invocation when you need additional diagnostic information. The manpage says that this output goes to standard error:

$ sudo env SNAP_CONFINE_DEBUG=1 \
    /usr/lib/snapd/snap-discard-ns "$SNAP_INSTANCE_NAME" \
    2>/tmp/snap-discard-ns-debug.log
$ status=$?
$ printf 'snap-discard-ns exit status: %s\n' "$status"
$ sudo sed -n '1,120p' /tmp/snap-discard-ns-debug.log

The command above writes diagnostics to a temporary file, not to a persistent snap configuration file. Remove that file after collecting the error if it contains operational details, and avoid posting its contents publicly without reviewing them.