Ubuntu – snap apps now won’t start with “cannot perform readlinkat()” error

This relates to "assertions" in snapd. In this case, that is the verification that the snap comes from a trusted party. Since you're installing a local snap, you have no assertions for it, and snapd doesn't trust it. Think of it a bit like sideloading Android apps, if you've ever done that. Granted, the error message could certainly be a little more helpful.

Regardless, you can get past this during your testing with the --dangerous flag:

$ sudo snap install --dangerous <snap>

note: there was some churn on this flag; in earlier releases it was --force-dangerous.

after some initial troubleshooting. i was able to find the RC myself. it seems apparmor blocked both grep: /proc/self/mountinfo and creating socket in /var/run/docker.sock

syslog.1:Nov 30 02:18:27 ubuntu-xenial kernel: [ 5359.923039] audit: type=1400 audit(1480472307.476:349): apparmor="DENIED" operation="open" profile="snap.docker.dockerd" name="/proc/19448/mountinfo" pid=19448 comm="umount" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
syslog.1:Nov 30 02:18:27 ubuntu-xenial kernel: [ 5359.923053] audit: type=1400 audit(1480472307.476:350): apparmor="DENIED" operation="open" profile="snap.docker.dockerd" name="/proc/19448/mounts" pid=19448 comm="umount" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
syslog.1:Nov 30 02:38:28 ubuntu-xenial kernel: [ 6560.900141] audit: type=1400 audit(1480473508.452:362): apparmor="DENIED" operation="connect" profile="snap.docker.docker" name="/run/docker.sock" pid=20591 comm="docker" requested_mask="wr" denied_mask="wr" fsuid=0 ouid=0

But why is that. why 16.04 got the default apparmor profile shipped (in /var/lib/snapd/apparmor/profiles/snap.docker.docker) that would block dockerd daemon from starting.