Interface management

Interfaces allow (or deny) access to a resource outside of a snap’s confinement.

Most users don’t need to worry about interfaces. Snaps are designed for strong application isolation and safe interface connections are made automatically.

An interface is most commonly used to enable a snap to access OpenGL acceleration, sound playback or recording, your network, and your $HOME directory. But which interfaces a snap requires, and provides, is very much dependent on the type of snap and its own requirements.

To see which interfaces a snap is using, and which interfaces it could use but isn’t, type snap connections <snapname>:

$ snap connections vlc
Interface       Plug                  Slot                 Notes
audio-playback  vlc:audio-playback    :audio-playback      -
audio-record    vlc:audio-record      -                    -
camera          vlc:camera            -                    -
desktop         vlc:desktop           :desktop             -
home            vlc:home              :home                -
(...)

In the above output, the camera interface is not connected because its slot is empty. This means VLC cannot access any connected cameras.

VLC can access the user’s /home directory because the home interface is connected to the system $HOME directory (denoted by the :home slot name).

See Supported interfaces for a comprehensive list of interfaces and what can of access they permit.

Slots and plugs

An interface consists of a connection between a slot and a plug. The slot is the provider of the interface while the plug is the consumer, and a slot can support multiple plug connections.

In the output to snap connections vlc (see above), every interface used by VLC is listed in the first column. The Plug and Slot columns then describe how each interface is connected.

For instance, the audio-playback interface connects VLC’s audio-playback plug to the system’s audio-playback slot so you can hear the sound it produces.

You can see which other snaps are using an interface with the interface command:

$  snap interface audio-playback
name:    audio-playback
summary: allows audio playback via supporting services
plugs:
  - chromium
  - vlc
  - zoom-client
slots:
  - core

In the above output, you can see that Chromium, VLC and the Zoom snaps are connected to the Core audio-playback slot. Core and system are synonymous.

Auto-connections

Many interfaces are automatically connected when a snap is installed, and this ability is a property of either the interface itself, or the snap.

Automatically connecting interfaces include the network, audio-playback and opengl interfaces. This auto-connection ability is carefully reviewed for each interface, where permissiveness, security and privacy implications, and the expectations of the user, are all considered.

A snap’s developer can also request that an interface is connected automatically through a manual review process. As above, these requests are carefully considered and reviewed before being granted or denied.

Interfaces not connected automatically require the user to make a manual connection (see below), such as the camera, removable-media and audio-record interfaces. Manual connections enable the user to have a complete control over what kind of access they allow.

If a snap is installed prior to an interface being granted auto-connect permission, and permission is subsequently granted and the snap updated, when the installed snap updates, the interface will be auto-connected.

For more technical details on how interface auto-connections are processed, see The interface auto-connection mechanism.

Manual connections

When you need to connect an interface manually, such as when you want to grant a snap access to audio-record for audio input, use the snap connect command:

$ snap connect <snap>:<plug interface> <snap>:<slot interface>

A slot and a plug can only be connected if they have the same interface name. For example, to connect VLC’s audio-record plug to the system’s audio-record, you’d enter the following:

$ sudo snap connect vlc:audio-record :audio-record

Disconnect interfaces

To disconnect an interface, use snap disconnect:

$ snap disconnect <snap>:<plug interface> <snap>:<slot interface>

Following our previous example, you would disconnect vlc:audio-record with the following command:

$ sudo snap disconnect vlc:audio-record :audio-record

When an automatic connection (see above) is manually disconnected, its disconnected state is retained after a snap refresh. The --forget flag can be added to the disconnect command to reset this behaviour, and consequently, re-enable the automatic re-connection after a snap refresh.