After a year and a half of development, a new stable branch of the Flatpak toolkit 1.18 has been released, providing a system for building self-contained packages that are not tied to specific Linux distributions and are executed in a special container, isolating the application from the rest of the system. Support for running Flatpak packages is available for Fedora, CentOS, Debian, Arch Linux, Gentoo, Linux Mint, Alt Linux, and Ubuntu. Flatpak packages are included in the Fedora repository and are supported in the native application management programs GNOME and KDE.<\/p>\n
Key innovations in the Flatpak 1.18 branch:<\/p>\n
Flatpak simplifies the distribution of software not included in the standard repositories of distributions by preparing a single universal container, freeing developers from the need to create separate builds for each distribution. For users concerned about security, Flatpak allows dubious applications to run in a container, providing selective access to only the necessary network features and user files. Users interested in the latest updates can install the most recent test and stable releases of applications without needing to alter their system. For example, Flatpak packages are available for LibreOffice, GIMP, Inkscape, Kdenlive, Steam, 0 A.D., Visual Studio Code, VLC, Slack, Telegram Desktop, Android Studio, and more.<\/p>\n
To reduce size, the package includes only application-specific dependencies. Basic system and graphical libraries (GTK, Qt, GNOME and KDE libraries, etc.) are provided as plug-in standard runtime environments. The key difference between Flatpak and Snap is that Snap uses the main system environment components and isolation based on filtering system calls, while Flatpak creates a separate container from the system and operates large runtime sets, providing not packages as dependencies but standard system environments (for example, all the libraries needed for GNOME or KDE applications).<\/p>\n
In addition to the typical system environment (runtime) installed through a special repository, additional dependencies (bundle) required for the application to function are supplied. Together, the 'runtime' and 'bundle' form the contents of the container, with the 'runtime' being installed separately and linked to multiple containers, allowing for the avoidance of duplication of common system files. <\/p>\n
A system can have multiple different 'runtime' environments (GNOME, KDE) or several versions of the same 'runtime' (GNOME 50, GNOME 49). The application container, as a dependency, binds only to a specific 'runtime', without considering the individual packages that make up the selected 'runtime'. All missing elements are packed directly with the application. When creating the container, the content of the 'runtime' is mounted as a partition \/usr, and the 'bundle' is mounted in the directory \/app. <\/p>\n
The content of the 'runtime' and application containers is created using OSTree technology, where the image is atomically updated from a Git-like repository that allows for version control methods to be applied to the distribution components (for example, the system can be quickly rolled back to a previous state). RPM packages are translated into the OSTree repository using the rpm-ostree layer. <\/p>\n
Selective installation and updating of packages within the working environment is not supported \u2014 the system is updated not at the level of individual components, but entirely, atomically changing its state. Tools are provided for incrementally applying updates, eliminating the need for a complete image replacement with every update.<\/p>\n
The isolated environment created is independent of the distribution used and, with proper package configuration, does not have access to user files and processes or the main system, and cannot directly access hardware, except for output via DRI. Graphics output and input organization are implemented using the Wayland protocol or through X11 socket forwarding. Interaction with the external environment is based on the DBus messaging system and a special API called Portals. <\/p>\n