Actually, just having AppArmor enabled isn't enough. Snap's strict confinement depends on specific out-of-tree AppArmor kernel patches that Canonical bakes into Ubuntu.

If your distro uses the stock Linux kernel, even with AppArmor active (like Debian, Arch, or openSUSE) snapd lacks the necessary kernel-level hooks and drops down to partial confinement. Because of this fallback, non-Ubuntu AppArmor distros don't actually get the full Snap sandbox, they get a degraded version of it.