I probably just don't understand how APFS snapshots work, but this seems odd to me:
~ $ mkdir /private/tmp/snap ~ $ pwd /Users/dmd ~ $ ls foo ls: foo: No such file or directory ~ $ tmutil localsnapshot / Created local snapshot with date: 2020-02-28-191657 ~ $ tmutil listlocalsnapshots / Snapshots for volume group containing disk /: com.apple.TimeMachine.2020-02-28-191657.local ~ $ mount_apfs -s com.apple.TimeMachine.2020-02-28-191657.local / /private/tmp/snap mount_apfs: snapshot implicitly mounted readonly ~ $ ls /private/tmp/snap/Users/dmd/foo ls: /private/tmp/snap/Users/dmd/foo: No such file or directory ~ $ touch /Users/dmd/foo ~ $ ls /private/tmp/snap/Users/dmd/foo /private/tmp/snap/Users/dmd/foo ~ $ ##### WHAT? WHY IS FOO IN THE SNAPSHOT? WHY DID THE SNAPSHOT CHANGE? ~ $ rm /Users/dmd/foo ~ $ ls /private/tmp/snap/Users/dmd/foo ls: /private/tmp/snap/Users/dmd/foo: No such file or directory
Note that the file
/Users/dmd/foo is being created on the 'real' disk, but when it is created and deleted those changes are also showing up in the mounted snapshot.