Canonical’s Enterprise Store: Distributing Snaps Without Direct Internet Access
Canonical has recently unveiled the Enterprise Store, designed as a local proxy for distributing Snap packages in networks where outgoing internet connections are limited. This innovative service primarily targets regulated industries and organizations with strict internet access policies, serving as a vital tool for environments that require air-gapping.
What is the Enterprise Store?
The Enterprise Store functions as an advanced version of the Snap Store Proxy, enabling registered clients within an organization’s internal network to communicate through a centralized instance. This setup eliminates the need for each system to access the Snap Store directly. Instead, the Enterprise Store retrieves Snap packages, caches them, and then delivers them to internal clients. This method not only enhances security but also optimizes availability.
Cache and Offline Updates for Restricted Networks
One of the primary benefits of the Enterprise Store is the local cache feature, which significantly speeds up download times for frequently accessed packages while reducing bandwidth requirements. In fully isolated environments, it operates in offline mode, effectively functioning as a local Snap Store. Administrators can export the necessary Snaps and metadata from an internet-enabled system and subsequently import them into a secure environment, thereby streamlining the update process.
Furthermore, administrators can specify which particular version of a Snap package clients should receive. This version pinning serves as a safeguard, ensuring systems do not unexpectedly upgrade to a newer version during critical operations.
Understanding Snaps and Charms
Snaps are self-contained Linux packages that bundle applications with their dependencies and metadata. Managed by the Snapd tool, these packages can be installed and updated seamlessly across target systems. On the other hand, Charms come from the Juju ecosystem and contain the operational knowledge needed for application deployment, configuration, scaling, integration, and maintenance.
Currently, Charm support is only available in offline mode through a local Charmhub instance. However, it is essential to note that while the Enterprise Store facilitates the distribution of Charms and Charm bundles, it does not cover APT packages and other runtime dependencies, which businesses must manage separately. Kubernetes Charms, in particular, further require a distinct local OCI registry for container images.
Enhancing High Availability
To ensure high availability, multiple instances of the Enterprise Store can be set up behind a reverse proxy. Should any instance go offline, the reverse proxy can redirect requests to other functioning units, thereby maintaining service continuity. These proxies can also distribute traffic load and verify the health of backend services through regular checks.
Ensuring Snap Integrity
One significant advantage of the Enterprise Store is that it does not alter the integrity mechanisms associated with Snap packages. The package files and their cryptographic signatures remain intact, allowing Snapd to verify both the integrity and provenance of retrieved snaps. Acting as a controlled distribution point, the Enterprise Store upholds these essential verification processes.
Open for Business: Licensing and Usability
Canonical makes the Enterprise Store accessible under Ubuntu Pro, which is free for personal use on up to five machinesāideal for testing in lab settings. However, organizations intending to install the Enterprise Store on more than 25 clients will need to acquire a license. Canonical also offers support for planning, deployment, and maintenance, particularly for larger or regulated environments.
Conclusion
The introduction of Canonical’s Enterprise Store marks a significant step forward in providing secure and efficient Snap package distribution within controlled environments. With features that cater to the unique needs of regulated industries, the Enterprise Store not only enhances operational efficiency but also reinforces security protocols in today’s increasingly complex digital landscape.
