For anyone failing to run snap packages inside of #Incus containers, this is why:
https://bugs.launchpad.net/snapd/+bug/2042512
Bug #2042512 “snapd hardcodes apparmor check for lxc- and lxd-, ...” : Bugs : snapd

snapd appears to be hardcoding a Go version of https://gitlab.com/apparmor/apparmor/-/blob/master/parser/rc.apparmor.functions?ref_type=heads#L108 in https://github.com/snapcore/snapd/blob/master/cmd/snapd-apparmor/main.go#L95 I've had the apparmor logic fixed here: https://gitlab.com/apparmor/apparmor/-/merge_requests/1112 So snapd needs a matching change. Unfortunately as snapd is under the Canonical CLA, I will not be contributing this otherwise trivial fix myself.

Launchpad
Shoutout to @alexmurray for submitting a fix upstream!
@stgraber @alexmurray well, with the CLA we all really can't.
@brauner @stgraber pardon my ignorance but why?
@alexmurray @stgraber snapd requires the Canonical CLA, no?
@brauner @stgraber yes AFAIK but my question was more asking why do you say you can't sign the CLA?

@alexmurray @stgraber it's not that we can't it's that we don't want to. CLAs are terrible and we've never required one for any of our projects.

In a way CLAs are one (of many) reasons why #upstart never stood a chance against #systemd. Or look at the #hashicorp debacle.

@brauner @alexmurray Well, it's possible that Christian can't as his copyright likely belongs to his employer, so would need to go through Microsoft legal for approval.

In my case, it's definitely that I don't want to. I'm more inclined to assign copyright on more narrowly scoped cases where the beneficiary is a non-profit organization, but I'm not interested in assigning my copyright to a for-profit entity.

@stgraber @brauner fair enough - indeed, CLAs definitely do complicate things and add a barrier to entry sadly.