[iggldiggl]

> Flatpak, however, has a pretty simple system for a fully sandboxed app to open a file or a directory: it just opens a file or directory picker, you pick a file or directory, and the app gets access to that file or directory without getting access to anything outside what you picked.

Unfortunately that still breaks any kind of multi-file format, where opening one file might implicitly require accessing additional other files, and in some cases those additional files might even be distributed all over the directory hierarchy.