I'm very in favour of improving the state of application distribution on Linux. Targeting an abstraction like Flatpack seems like a no-brainer if there are no regressions in experience to the end user.
I am not sure if this is the case, but in theory I love the idea that the app sandboxing can allow the Flatpak engine to be a source that can prompt users for permissions access (e.g. "app would like to access your location").
Last time I tried Flatpack I experienced a lot of integration issues, from GTK theming issues to applications missing features due to sandboxing.
Would love to see a high level medium-dive explainer on how Flatpack works to alleviate some of my concerns; predominantly around the limitations of sandboxing.
e.g.
Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed.
Can VSCode access any part of the FS without any performance overhead, what about language servers and that sort of thing?
Can applications like Discord that feature a voice-activated mic work? Can Discord access what game you're currently playing on Steam and set that as its status?
Originally, I thought Flatpack was much like old win32 applications where if you put a dll dependency next to the executable, it will use that rather than the system one. I got really scared of Linux app sandboxing engines when I tried Snapd and it started making virtual network devices and my system theme wasn't applied to the application - seemed very convoluted.
Flatpak used to have a lot of issues with sandboxing, but in recent years the situation has gotten better because of two things:
1. A strong push to help package maintainers fix sandboxing mistakes, expose the APIs that need to be exposed and lock down the APIs that are not needed. It used to be pretty bad but it's pretty rare to see sandboxing problems nowadays.
2. You can now use a tool called Flatseal, or in KDE a new builtin settings interface in Plasma 5.27, to modify sandboxing settings for applications in an intuitive way. If you're trying to use an IDE and just want to expose every permission to it, you can easily do that now.
3. Unrelated to Flatpak, Wayland is now getting a lot of the video capture and screen recording APIs that are needed.
> Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed.
I'm livestreaming on a regular basis, and moved from OBS as compiled by Arch Linux to OBS Flatpak. Everything just works (esp. the browser source that uses an embedded Chromium, which I never got to work with the Arch packages). Most likely that particular Flatpak is very liberal in its sandboxing, because it was even able to write into $HOME/obs-recordings/ without any permission prompt. I don't care about the sandboxing part of Flatpak too much in this particular case, so I didn't dig further.
I am not sure if this is the case, but in theory I love the idea that the app sandboxing can allow the Flatpak engine to be a source that can prompt users for permissions access (e.g. "app would like to access your location").
Last time I tried Flatpack I experienced a lot of integration issues, from GTK theming issues to applications missing features due to sandboxing.
Would love to see a high level medium-dive explainer on how Flatpack works to alleviate some of my concerns; predominantly around the limitations of sandboxing.
e.g.
Can OBS have unimpeded screen recording access? How does OBS compare in Flatpak compared to natively installed.
Can VSCode access any part of the FS without any performance overhead, what about language servers and that sort of thing?
Can applications like Discord that feature a voice-activated mic work? Can Discord access what game you're currently playing on Steam and set that as its status?
Originally, I thought Flatpack was much like old win32 applications where if you put a dll dependency next to the executable, it will use that rather than the system one. I got really scared of Linux app sandboxing engines when I tried Snapd and it started making virtual network devices and my system theme wasn't applied to the application - seemed very convoluted.