Hacker News new | ask | show | jobs
by wilt 2053 days ago
This is pretty much what flatpack and snap do.
3 comments

My understanding was that this is really not what flatpack does. It could in theory, but in practice it does not: https://flatkill.org/

Have things changed since then?

This article is quite biased. Flatpak can be seen as a framework that allows to sandbox apps, but it doesn't enforce it. Some apps can't be sandboxed totally without modifications. So the take is more Flatpak apps are not systematically sandboxed.

The "sandboxed" icon issue is not even flatpak, but Gnome Software which is NOT flatpak, which makes me doubt about some other parts of this article as well.

My take on Flatpak is that it's still very much work in progress but does go on the right direction. The core issue is that it's not popular enough to be considered as an official way to package software and a lot of it is packaged by Redhat developers or the community. Which means that a package can be easily abandoned, or modifications in the software itself that would allow proper sandboxing are not happening.

I tried a snap for retroarch, and the inflexibility of the directory mappings turned me off to snaps in general.

Firejail from the above comments seems to handle this quite well with virtual homes.

One of the technical problems with directory mappings in snaps is that a directory has to exist in order for you to mount to it, and snaps use a read-only filesystem so can't mount to a directory not already pre-created in snaps. However you can connect /home and /media if you connect the relevant permission (but not /root).

It is definitely a source of general frustration, and I think largely because people are still often using it for CLI tools rather than GUI tools which can make use of portals to grant file access permission and/or use an arbitrary path more easily - which is how it works so seamlessly on macOS [and is supported by flatpak/snap for GTK3 at least].

(Disclaimer: I work at Canonical/Ubuntu in the Support organisation. But not directly with/on snaps, this is a user perspective.)

They also unilaterally decide if and when they will change/update your program which firejail would not.
True for snap but not for flatpak
Oh yeah don't deny that. Was just saying if you wanted a user friendly sandbox experience by default for apps :).