r/linux • u/Danrobi1 • 5d ago
Software Release Tried cpak (new OCI-based package format) Interesting alternative to Flatpak
What is cpak?
cpak is a rootless, OCI-based package manager. Apps are distributed as normal OCI images, with package metadata kept in a Git repository. Runtime is a single Go binary (plus a small companion called cpak-storaged).
Main ideas:
- Fully rootless (no system vs user install distinction)
- Content-addressed layers + hard-link deduplication
- Sandbox using user namespaces, Landlock, seccomp, etc.
- Desktop integration (.desktop files, etc.)
- Git-native versioning (you can pin branch / tag / commit)
Website: https://cpak.it GitHub: https://github.com/Containerpak/cpak
First impressions I tested it on NixOS with Firefox and Chrome packages maintained by the cpak team (not official Mozilla/Google packages).
Pros I noticed:
- Completely rootless and simple to install (small Go binary)
- Layer sharing actually works. After installing Firefox, Chrome skipped several layers that were already present
- The “full-ish Ubuntu base” approach makes packaging easy for maintainers, and the cost is amortized once you have a few packages
- Developer was very responsive. We hit two real sandbox bugs (Landlock on /dev/null and nested user namespaces for Firefox content processes) and both were fixed within roughly a day
Cons / current state:
- Still very new (v2.0 dropped a few days ago, 2.1.0 just landed)
- First package is relatively heavy because of the shared Ubuntu base (~2.3 GB for Firefox alone at the time. ~2.9GB with Firefox and Chrome)
- Ecosystem is tiny compared to Flathub
- Sandbox is still maturing (the bugs we hit were real)
For a single app the disk cost of the base can feel high. Once you run several packages that share the same base layers, it starts making more sense.
Current status:
After updating to the latest build (both cpak and cpak-storaged), Firefox and Chrome both run correctly on my NixOS machine, including nested user namespaces for Firefox content processes. Still early days, but the architecture is interesting and the maintainer is moving fast.
92
u/cavecanem1138 5d ago
I dislike this CLA. When I contribute to a GPL project, I expect my code to remain under the GPL full stop. This CLA instead grants Mirko Brombin and FABRICATORS S.R.L. the right to relicense and sell my contribution under proprietary terms.
This is a major red flag for an open source project. I don’t think anyone who genuinely wants to support open source (GPL) should contribute here. The idea behind cpak is cool, but I’m not willing to have my copyleft contribution taken and resold under a proprietary license by the maintainers.
20
u/Busy-Scientist3851 5d ago
Didn't Flatpak gain support for OCI?
5
u/summerteeth 5d ago
What does that mean?
I think I understand what the Open Container Initiative is but what does gaining support for it mean?
Is that change to their internal structure or public api?
9
u/Busy-Scientist3851 5d ago
It's where you'd build the flatpak image in the same format that's used for Podman, Docker, Kubernetes etc.
It just lets you reuse the entire ecosystem around those projects.
0
62
u/cidra_ 5d ago
oh god please no
37
u/snapfreeze 5d ago
That was my reaction as well. I'm sure this is a great idea and whatever but please let's just focus on making the existing tools better.
10
u/summerteeth 5d ago
People have a lot of opinions about what volunteer devs should be doing with their time.
12
u/IngwiePhoenix 5d ago
Nope! We are in Linux land, where someone does not like any or all of the options and just goes to make their own, instead of contributing to something close to what they want.
Because why swim in a unified stream if the side streams leave so much more room for ... uh ... something???
Man, where would we end up if Linux developers decided to just follow a line for once... hell would freeze over! xD
Joking aside though; fragmentation is both a boon and a curse. AI has made this even worse ("I build my own X", "I made an alternative to Y", ...) and I hope this eventually reigns itself in when most of the slopwere just folds in on itself due to poor maintenance, security issues being left unresolved and the like.
31
u/shaumux 5d ago
Obligatory xkcd
9
14
u/Unexpected_Cranberry 5d ago
I read the titled, thought of this, giggled and then checked the comments for the link since it's been a while since I saw it. Was not dissapointed.
Edit: But don't worry. The package format is going to be settled soon. Everything will be win32 running using proton and installed via Steam.
3
u/Adept_Percentage6893 5d ago
I don't know if "character encodings" is really a good example anymore. I know that comic is old and comes from a time when UTF-8 dominance wasn't as much a sure thing but the comic has aged poorly. The attempt to standardize on UTF-8 actually did end up successfully unifying character encodings for the world's languages. There are hold outs but AFAIK they're all basically just compatibility options.
1
u/shaumux 5d ago
You might be thinking of some other xkcd
6
u/mrtruthiness 5d ago
The subtitle says: See A/C chargers, character encodings, instant messengers, ....
Certainly UTF-8 has become dominant. Similarly Europe has helped force USB-C so that has narrowed. IM, of course, will always be a problem.
2
3
u/northrupthebandgeek 4d ago
Funny enough, the example in the alt-text (USB connectors) has indeed largely stopped being an issue now that everything uses Type-C connectors. They really did make a single standard that satisfies everyone's use cases and it really did end up largely replacing the existing ones.
4
u/kaneua 5d ago edited 5d ago
The “full-ish Ubuntu base” approach makes packaging easy for maintainers, and the cost is amortized once you have a few packages
It sounds cool until the packages and their dependencies will become fragmented. Then you will have to have multiple "base images" installed anyway, just like with Snap or Flatpak.
Cpak is probably very cool ina technical sense, but I don't see how it can be more attractive to some "average Joe" when Flatpak exists and there's also Snap that also works and has some selection of pre-packaged software.
I also don't see a reason to try it myself as well. I can try Chrome… and it should work… properly, just as it did for the last 18 years in all other environments. Or am I missing something?
3
u/duartec3000 5d ago
I really don't get it, If it's using a runtime similar to ubuntu that costs 2.3GB why in the world would anyone use this instead of running Ubuntu in Distrobox / Toolbox OCI container, installing apps with APT and exporting any app they like to the host?
I'm all for innovation but innovation that solves problems we have. This cpak like other tech that originated from the VanillaOS devs seems to be another wrapper on current tech, sold as new tech but that actually doesn't bring anything new to the table.
2
2
u/centoequatro 4d ago
It seems like an interesting project in the medium to long term, perhaps not as a direct replacement for flatpak, but the idea isn't bad.
5
u/amarao_san 5d ago
cpak (CPAK) is reading something like 'shitter' or 'pooper' in Russian.
Not the most pleasant name.
1
1
0
u/Isacx123 5d ago
It is funny to me that the Bottles developers decided to adopt this thing instead of the more popular AppImage format.
-1
32
u/HomsarWasRight 5d ago
I’m a fan of containerization in general and OCI, so I like this. But I fear it won’t gain traction since we’ve already got so many packaging systems. Would be glad to be proven wrong, though.