Manual review request for CatBee Container Studio (revision 4)

store-requests
1

Hi,

I’m requesting a manual review for CatBee Container Studio, snap catbee-container-studio, revision 4 (version 0.3.0).

The automated review completed with 42 passes, 0 warnings, and 1 failure, reporting:

human review required due to 'deny-connection' constraint (interface attributes)

The affected connection is:

browser-support → browser-support

This is expected for the application because CatBee Container Studio uses an Electron/Chromium-based UI and requires the browser-support interface.

Could someone please review revision 4 and let me know if any additional changes or information are required?

Thank you for your time and help.

Snap: catbee-container-studio Revision: 4 Version: 0.3.0

2

This request has been added to the queue for review by the @reviewers team.

3

Hello @iam-harig :slight_smile:

The review failure is triggered by this part of your snap declaration:

plugs:
  browser-support:
    interface: browser-support
    allow-sandbox: true

The browser-support interface itself is fine for Electron/Chromium-based applications and auto-connects by default. However, the allow-sandbox: true attribute is treated specially: it grants the snap access to use Chromium’s internal sandbox, which requires numerous privileged security policy rules and is considered trusted outside of snapd.

For this reason, per the browser-support interface documentation, use of allow-sandbox: true is reserved for vetted publishers (e.g. the official browser snaps such as Firefox and Chromium), hence, we can’t grant allow-sandbox: true for the catbee-container-studio snap.

For Electron applications, the standard and recommended approach is to disable Chromium’s internal sandbox and rely on snapd’s strict confinement instead, which provides equivalent (and in many ways stronger) isolation. To do this:

  1. Remove the allow-sandbox: true attribute from your browser-support plug (or drop the custom plug definition entirely and just list browser-support in your app’s plugs).

  2. Launch Electron with the --no-sandbox flag

With allow-sandbox unset (defaulting to false), browser-support will pass automated review and auto-connect, so no manual review or store declaration will be needed at all.

Happy snapping!