According to Door Knocker, almost half of the portals are unavailable on Ubuntu 16.04, compared to only one unavailable on Fedora 39 with GNOME, which means Flatpaks running here may have more limited capabilities than usual.
Having a rock-solid Debian stable as a desktop with up-to-date softwares when it matters. It sounded impossible a few years ago but that might be achievable now with Flatpak. That’s awesome.
I basically do this with Debian + Docker right now and yes, it is awesome
Try podman and distrobox. Podman runs as the local user and distrobox simplifies it so you can run GUI apps and have full file access
I nees to try this. I’m currently running Debian stable + Flatpak, but not being able to access all local files from things like Firefox is really forcing me to jump through hoops.
Really? It should be a XDG portal. What environment are you running?
Sway with xdg-desktop-portal-wlr. I can open a single file, but not directories of static content. So CSS, images, links all fail to load. Opening a single image or PDFs work fine.
That’s very odd. Maybe you are missing a dependency or the features you are looking for simply are not in older software
Exactly what I usual say, the best of the two worlds. There are still a few annoyance though, the theme integration part that is easy to fix and not being able to get Ungoogled working with a KeePassXC when both are Flatpaks
I also like nix because it is lighter on resources.
Cool testament to flatpak’s strengths. If an OS update makes a breaking change it won’t affect the apps. Makes sense that it works backwards too but I never thought to do it.
but only because the apps don’t get the updates
Ok, so it’s time for me to do some research on Flatpaks now. I’m an old schooler from Redhat days and haven’t kept up with the new stuff all that much.
Flatpaks is a distro independent way of installing apps, similair to snaps. However it does not require a proprietary backend like snaps do.
It uses “runtimes” that contain the libraries that are required for the app, such as freedesktop, gnome, kde and elementary. Each app requests a specific runtime and version which prevents library conflicts.
Although runtimes are shared the different versions can take up quite a bit of space. This is a common criticism of Flatpak and one of the major drawbacks compared to the distro’s native package manager. Another disadvantage is that the sandboxing can cause issues with the functionality of the app if it requires certain system functionality. Authors (and users) can configure which parts of the system to expose (dbus, files, network, etc) but sometimes this is done incorrectly (looking at you Discord) which can cause the aforementioned issues.
One of the major advantages is that it simplifies the work for Application developers, they can target 1 system and don’t have to package the application and it’s libraries for each distro. It also means that the applications aren’t dependent on the distro’s for newer versions. You can use Debian stable with a version of an app that came out yesterday.
I personally tend to use Flatpaks quite often except for software that is included in the distro by default and apps that have issues with sandboxing such as Steam and VSCode.
Sounds a bit like docker and its containers?
Yes and no. It’s much better suited for desktop applications. Try to run something playing audio in Docker. It’s doable but not pleasant in any way.
Well yeah, I only meant it sounds like a similar idea, I’d be surprised if it was powered by docker.
It’s certainly doable to run desktop apps in containers, have you tried Distrobox?
No, I didn’t. Looks interesting. Not something I’m looking for right now but I’ll keep it in mind.
Although runtimes are shared the different versions can take up quite a bit of space. This is a common criticism of Flatpak and one of the major drawbacks compared to the distro’s native package manager.
It’s actually not that much of a concern, since Flatpak does deduplication behind the scenes - yes, even between different versions of runtimes.
https://blogs.gnome.org/wjjt/2021/11/24/on-flatpak-disk-usage-and-deduplication/
As well as running on all distros, it also provides other benefits:
- You can run modern software on old/stable distros
- Dependencies being (mostly) included in the package means that different applications can more easily have different versions of dependencies
- Finicky packages are more stable for that same reason
- Distro maintainers don’t need to package as many applications (https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/46ZZ6GZ2W3G4OJYX3BIWTAW75H37TVW6/), and application maintainers don’t need to worry about multiple distros and versions of dependencies
However, some applications don’t work as well because of the sandbox, but I think this will change with the rising popularity of Flatpak, as more developers will use portals instead of direct access. Also, there are some bugs and missing features, like how heavy use of the org.freedesktop.Flatpak portal for dbus causes a memory leak (https://github.com/flatpak/xdg-dbus-proxy/issues/51), but it’s overall pretty good. Most applications I use are Flatpaks.
Flatpaks are to distros what Alpine is for docker containers. A base for creating distro agnostic desktop applications. It’s really cool and has picked up quite some good support within the Linux community.
I think that Flatpak being Docker for desktop applications would be a better comparison.
AFAIK it’s a system to let Linux software bundle all of it’s dependencies up with it so it just works in a self contained way that doesn’t care about what else is and isn’t installed.
Advantages is that they are more reliable and user friendly than traditional approaches to Linux software installation.
Disadvantages are that they have bigger footprints where you might have the same dependencies I dependently installed for each app rather than as a single installation that they all utilise and that they need to be updated individually (as part of the flatpak.) IE if basically every app uses the same dependency and it turns out to have a huge security hole, under normal Linux software the developer would patch it, you’d update it and the hole would be filled. With Flatpaks you need each individual Flatpak developer to update the version used by their Flatpak and for you to update all those Flatpaks before the hole is plugged. I think I remember they run in some kind of sandbox to mitigate this though.
(This is going to be grossly oversimplified and possibly minorly inaccurate, but) Flatpaks are built against and run using shared runtimes, so if two Flatpaks share the same basic dependencies (and those dependencies are included in the most common runtimes, which they usually are), you only have to download the shared runtime once. Every Flatpak built on the same runtime will share the one runtime. The way you described it is a common misconception.
Now if the packager manually bundles less common dependencies into the app itself, yes, that would have to be individually updated, but that’s theoretically more of an edge case.
Mint integrates flatpak seemlessly into its graphic package management and update tools.
KDE’s “Discover Store” (gui package manager) also does as well, which is awesome. While I don’t like the idea of packaging system libraries with software due to the fact that they can and will sit out of date and hold on to vulnerabilities, I do like what flatpak is trying to achieve and the fact that we have a very solid leader in the area, putting the closed-source proprietary Snaps system firmly in second place.
Same, I have MX (Debian based) and have 100% native and 0% flatpak… Old grumpy bearded guy
Another big advantage of Flatpaks is the portability, since they live in your home.
I’ve had to reinstall distros and swap to different ones a decent amount. I simply backup and restore my home dir, and all my flatpaks get carried over, appear in my app launchers, and usually have their app data saved so I don’t even have to relogin/reconfigure to stuff. It’s as if I had just closed and opened it again.
It’s crazy this works even when completely swapping distros.
I run Arch Linux (by the way) on my work laptop. One time Unity botched their game engine on Arch, so I had to rollback my whole system to keep an older version of GTK just so I could keep doing my work.
For a good 6 months, any up-to-date application had to be a Flatpak, because updating my system was off the table. Completely saved my bacon, and let me stay on top of rolling-release apps with ease.
You could set up a development environment using distrobox in an arch container and keep the downgraded packages installed in there if it happens again
IgnorePkg?
Lol like yeah that is its point and also its weakness
Weakness?
you are still running 7 year old code with no security updates
@nicman24 Ubuntu 16.04 ESM will have security updates till 2026
Not the universe. Ubuntu is one of the most unpatched systems out there.
oh nvm i read something in the title wrong. also dont count on fast fixes for the kernel they have repeately lagged or even never arrived in older lts
This is a completely patched Ubuntu 16.04 through the Extended Security Maintenance program.
I would have tried this on Ubuntu 14.04 (supported until 2024) but Flatpak never supported 14.04 in the first place.
They are talking about the code sitting inside the flatpak I think. If a developer fails to continue updating the system libraries a flatpak contains, you retain old vulnerabilities you could have otherwise fixed with a
sudo apt update && apt upgradeor asudo pacman -Syu
Flatpak has relatively weak sandboxing, takes up a lot more storage because sometimes dependencies get bundled a few dozen times, and most distressingly depends on the application developer to be available to do things like address supply chain attacks.
I don’t think you understand flatpaks. Flatpaks have dependencies such as the gnome or KDE frameworks. Those frameworks are only installed once so I’m not sure where you are getting the idea that they are installed multiple times.
Also flatpaks usually come from flathub.org which is unlikely to be compromised. It not impossible but they seem to be pretty good about properly labeling apps.
what’s the one missing on Fedora 39?
