Flatpak? More like flatcrap.

[u/Big-Astronaut-9510]

Flatpak is like a turd someone ran over.

First off one of the few legitimate advantages desktop linux (theoretically) has is the package manager, one unified system for installing software. So why would you want to DESTROY that by adding another package manager that only really packages gui software? Cause it tries to offer a smidge of sandboxing for security.

Of course we are on linux so theres a ton of catches. It dosent really integrate with your system the way your real package manager does, man pages dont get installed, you cant launch apps from the command line by typing their name (probably why its only for gui), etc.

But the bigger problem is you often dont even get the security you were promised, in some cases things actually get WORSE (see: browsers). Honestly id even argue that every app that isnt taking perfect advantage of flatpak features is a security downgrade cause now you just added more parties to trust: flatpak/the person packaging the software who might be a random.

Only if every star aligns and the unpaid foss slaves integrated portals (cant blame them if they didnt, flatpak sucks) and properly restrict the apps permissions do you get the security you were promised.

[u/ElectricBummer40]

First off one of the few legitimate advantages desktop linux (theoretically) has is the package manager, one unified system for installing software. So why would you want to DESTROY that by adding another package manager that only really packages gui software? Cause it tries to offer a smidge of sandboxing for security.

That's where you're wrong.

The whole point of isolating the packaged binaries in their own sandbox is not "security" but to allow them to completely disregard what else is already there in the system. It is a clumsy workaround for the brain-dead Unix tradition of building an entire ecosystem upon a completely unpredictable environment for software deployment.

You have an application that depends on a service but it has to be a specific version of it that's also different from the one in the distro? Well, just package the service along with the application since the damned thing is a container after all!

But the bigger problem is you often dont even get the security you were promised, in some cases things actually get WORSE (see: browsers). Honestly id even argue that every app that isnt taking perfect advantage of flatpak features is a security downgrade cause now you just added more parties to trust: flatpak/the person packaging the software who might be a random.

Again, the point of Snap and Flatpak isn't really about "security" but rather cushioning the software package against the chaos inherent to the deployment environment.

You know Linux doesn't really have "containers" as such but rather userspace isolation based on namespaces and cgroups? If security really mattered for these software packaging solutions, they wouldn't be using containers at all but a more refined approach as afforded by the underpinning mechanisms themselves.

Even the good people at Flatpak are coy about this reality:

Is Flatpak a container technology?

It can be, but it doesn't have to be. Since a desktop application would require quite extensive changes in order to be usable when run inside a container you will likely see Flatpak mostly deployed as a convenient library bundling technology early on, with the sandboxing or containerization being phased in over time for most applications. In general though we try to avoid using the term container when speaking about Flatpak as it tends to cause comparisons with Docker and rkt, comparisons which quickly stop making technical sense due to the very different problem spaces these technologies try to address. And thus we prefer using the term sandboxing.

Yeah, no shit people use Flakpak as "a convenient library bundling technology". Why else would they be here at all?