Flatpak
An application distribution and sandboxing framework for Linux platforms that allows developers to package applications together with their dependencies into self-contained bundles for distribution, providing cross-distribution compatibility and runtime isolation security.
Timeline (last 90 days)
Bubblewrap constrains the filesystem, network, and devices a process can see through namespaces and seccomp filters, and is often used by Flatpak as an underlying isolation layer.
Seatbelt is macOS's sandboxing framework, and bwrap (Bubblewrap) is a lightweight container tool on Linux based on user namespaces, which is used as the underlying mechanism by application sandboxes such as Flatpak
The portal-based file chooser (org.freedesktop.portal.FileChooser) is part of the XDG Desktop Portal specification and is one of the core design elements of Flatpak's least-privilege principle.
Using a pure-Python conversion library causes all conversion logic to be completed within the application process without invoking external executables, enabling operation in a closed sandbox without additional permission declarations.
Flatpak applications calling LibreOffice (soffice) must request the flatpak-spawn permission to break out of the sandbox boundary, which creates tension with Flathub security review requirements.
Bwrap (Bubblewrap) restricts process access via Linux namespaces and seccomp filters, and is one of the underlying mechanisms for Flatpak application isolation.
Bubblewrap is a low-privilege container tool on Linux, originally derived from the Flatpak project, that can create isolated namespaces without root privileges.
Flatpak and Snap applications bundle their own runtimes, which are large in size (easily hundreds of MB), have slow first launches, and suffer from friction in integrating with GTK/Qt theme engines.
Linux distribution packaging mechanisms vary, and distribution options include universal binary packages, Flatpak, Snap, or collaboration with distribution package maintainers, each with its own trade-offs.
Flatpak is led by Red Hat; applications run in a sandbox with dependencies shared through runtimes, and Flathub is its main application repository.
10 more timeline events
All Facts (20)
Zed v1.17.1-pre fixes an issue in Flatpak packaging environments where a defect in argument construction during command-line startup could accidentally open unrelated files (#62958).
70%UnverifiedBubblewrap constrains the filesystem, network, and devices a process can see through namespaces and seccomp filters, and is often used by Flatpak as an underlying isolation layer.
50%UnverifiedSeatbelt is macOS's sandboxing framework, and bwrap (Bubblewrap) is a lightweight container tool on Linux based on user namespaces, which is used as the underlying mechanism by application sandboxes such as Flatpak
50%UnverifiedThe portal-based file chooser (org.freedesktop.portal.FileChooser) is part of the XDG Desktop Portal specification and is one of the core design elements of Flatpak's least-privilege principle.
50%UnverifiedUsing a pure-Python conversion library causes all conversion logic to be completed within the application process without invoking external executables, enabling operation in a closed sandbox without additional permission declarations.
50%UnverifiedFlatpak applications calling LibreOffice (soffice) must request the flatpak-spawn permission to break out of the sandbox boundary, which creates tension with Flathub security review requirements.
50%UnverifiedBwrap (Bubblewrap) restricts process access via Linux namespaces and seccomp filters, and is one of the underlying mechanisms for Flatpak application isolation.
50%UnverifiedBubblewrap is a low-privilege container tool on Linux, originally derived from the Flatpak project, that can create isolated namespaces without root privileges.
50%UnverifiedFlatpak and Snap applications bundle their own runtimes, which are large in size (easily hundreds of MB), have slow first launches, and suffer from friction in integrating with GTK/Qt theme engines.
50%UnverifiedLinux distribution packaging mechanisms vary, and distribution options include universal binary packages, Flatpak, Snap, or collaboration with distribution package maintainers, each with its own trade-offs.
50%UnverifiedFlatpak is led by Red Hat; applications run in a sandbox with dependencies shared through runtimes, and Flathub is its main application repository.
50%UnverifiedWhen a Flatpak application calls command-line arguments, they must be forwarded through the flatpak run wrapper layer, making the argument-passing chain longer than with a native installation.
50%UnverifiedFlatpak packages an application and all its dependencies into a standalone runtime container, implements process-level sandbox isolation via technologies such as Bubblewrap, and provides a unified distribution channel through Flathub.
50%UnverifiedZed v1.16.2 fixes an argument construction defect when launching Zed via Flatpak from the command line (#62959), a bug that caused Zed to accidentally open unrelated or nonexistent files.
50%UnverifiedFlatpak appeared in 2015 and Snap appeared in 2016, providing user-friendly sandboxing solutions for desktop applications.
50%UnverifiedFlatpak provides fine-grained resource access control through the Portal mechanism, while Snap relies on an interfaces system to declare permission requirements.
50%UnverifiedFlatseal is essentially a graphical wrapper around Flatpak override configuration files, and its modifications are saved in the ~/.local/share/flatpak/overrides/ directory.
50%UnverifiedFlatseal is a graphical permission management tool designed specifically for Flatpak, capable of viewing and modifying the sandbox permissions of each installed Flatpak application for resources such as the filesystem, network, audio, GPU, Bluetooth, camera, and D-Bus.
50%UnverifiedSandbox escapes typically stem from misconfiguration or overly broad permission grants, as users often grant applications full disk access (such as --filesystem=home or --filesystem=host) in response to error messages.
50%UnverifiedFlatpak由GNOME社区主导开发（前身为xdg-app），通过Bubblewrap沙箱（基于Linux内核namespace和seccomp机制）隔离应用权限，应用需通过Portal API请求资源访问，更新采用OSTree增量更新技术
50%