In Ubuntu Server and other modern Linux distributions backed by Canonical, snapd (the Snappy daemon) is the core background service responsible for managing Snap packages. To ensure these containerized applications remain secure and up-to-date, systemd utilizes the snapd.timer unit. This recurring timer automatically triggers background updates for all installed snaps (typically checking four times a day). While automated background updates are highly beneficial for consumer desktops to patch zero-day vulnerabilities silently, they introduce a severe operational liability on mission-critical production servers, database clusters, or strict air-gapped environments. An unprompted background update to a critical package (like a database or a reverse proxy) can introduce breaking changes, consume unpredictable network bandwidth, or cause spontaneous service restarts, directly violating rigid change-management protocols.
This guide explains how to completely disable the snapd timer in Ubuntu Server, enforcing an absolute block on automated background package updates and ensuring the administrator retains total, manual control over the system’s software lifecycle.
Stop and Mask the snapd Timer
Because the snap refresh mechanism is deeply integrated into Ubuntu’s core update architecture, simply modifying the snap configuration (e.g., snap set system refresh.timer=...) only delays updates; it does not permanently halt the underlying systemd invocation. To enforce a strict, immutable block, we must explicitly mask the timer unit.
- Log into your Ubuntu Server via SSH using an account with
sudoprivileges. - Stop the timer to halt any currently scheduled execution:
sudo systemctl stop snapd.timer - Stop the associated service unit that the timer invokes, aborting any active background refresh tasks:
sudo systemctl stop snapd.refresh.service - Mask both the timer and the refresh service units. This symlinks them to
/dev/null, creating a hard block against future activation by package triggers, cron jobs, or manual invocations:sudo systemctl mask snapd.timer sudo systemctl mask snapd.refresh.service
Verify the Service Lockdown
By masking the timer, you guarantee that systemd will completely reject any attempt to invoke the automated snap refresh routine, ensuring that CPU, disk I/O, and network resources are never consumed unpredictably by the package manager.
To verify the lockdown is successful, attempt to start the timer manually:
sudo systemctl start snapd.timerSystemd will return a fatal error stating that the unit is masked (e.g., Failed to start snapd.timer: Unit snapd.timer is masked). Furthermore, running systemctl list-timers --all will confirm that the snapd.timer is completely absent from the active timers list. All snap packages will now remain locked at their current versions until an administrator manually executes a snap refresh command. The server’s update pipeline is now strictly secured and deterministic.