Ubuntu: Enterprise Store distributes Snaps without direct access to the Internet

Canonical has announced the launch of the Enterprise Store, a locally operated proxy designed to distribute Snap packages within networks that have limited or no direct internet access. The service targets regulated industries, corporate networks with strict internet access policies, and air-gapped environments. It is part of Ubuntu Pro, which provides long-term support for Ubuntu-based systems. The Enterprise Store builds upon the existing Snap Store Proxy concept, aiming to eliminate the need for each system within a company to connect directly to the central Snap Store. Instead, registered clients communicate through an instance hosted within the organization’s internal network. This instance fetches Snap packages during normal operations, stores them temporarily, and distributes them to internal client systems. In networks with restricted internet connectivity, the Enterprise Store functions as a local cache, reducing bandwidth usage and accelerating repeated downloads. For fully isolated environments, it operates in offline mode, acting as a local version of the Snap Store. Administrators can initially download required Snaps and metadata on a system with internet access before importing them into the isolated environment. Administrators also have the ability to specify exact revisions of a Snap package that clients should receive. This feature, known as pinning, helps prevent unexpected upgrades of systems while they are in operation. Snaps are self-contained Linux packages that bundle applications along with their necessary libraries and metadata. They are installed and updated using Snapd on target systems. Charms, on the other hand, originate from Canonical's Juju ecosystem. These are operators containing knowledge related to the installation, configuration, scaling, integration, and ongoing operation of an application. According to Canonical, Charm support is currently available only in offline mode. Companies can then provide Charms and Charm Bundles via a local Charmhub instance. However, the Enterprise Store does not cover APT packages or additional runtime dependencies of Charms, which must be managed separately. Kubernetes Charms also require a separate local OCI registry for container images, which the Enterprise Store does not include. For high availability, multiple instances of the Enterprise Store can be deployed behind a reverse proxy. If one instance fails, the proxy can redirect requests to another accessible unit. Reverse proxies can also balance loads and detect unreachable backend services through health checks. The integrity verification mechanisms of Snaps remain unchanged according to Canonical. The package files and their cryptographic proofs stay intact. Snapd continues to verify the integrity and origin of retrieved Snaps. The Enterprise Store serves as a controlled distribution point without bypassing these security measures. The Enterprise Store is offered as part of Ubuntu Pro. Ubuntu Pro is free for private use on up to five machines, allowing users to test the solution in a lab environment. According to Canonical, a license is required for Enterprise Store installations involving more than 25 clients. The company offers planning, setup, and operational support for larger or regulated environments.