Chapter 4: Flatpak — Cross-Distribution Sandboxed Apps

Flatpak is an open-source framework for distributing sandboxed desktop applications across Linux distributions. Like Snap, it bundles apps with their dependencies and runs them in a sandbox. Unlike Snap, Flatpak is not tied to a single company’s infrastructure — it uses Flathub as its primary app store, but anyone can host a Flatpak repository.

Installing Flatpak

Flatpak is not installed by default on all distributions.

# Ubuntu (18.10+)
sudo apt install flatpak

# Ubuntu with GNOME Software plugin
sudo apt install gnome-software-plugin-flatpak

# Fedora (usually pre-installed)
sudo dnf install flatpak

Adding the Flathub Remote

Flathub is the central repository for Flatpak apps. Add it once after installing Flatpak:

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

A logout/login or reboot may be needed for apps to appear in your app launcher.

Essential Commands

Finding and installing

flatpak search keyword                 # search Flathub and configured remotes
flatpak install flathub app.id         # install by app ID
flatpak install flathub org.gimp.GIMP  # example: GIMP

App IDs follow a reverse-domain naming convention (e.g., org.gimp.GIMP, com.spotify.Client). Use flatpak search to find the exact ID.

Running and managing

flatpak run app.id                     # run an installed app
flatpak list                           # list installed apps
flatpak update                         # update all installed apps
flatpak update app.id                  # update a specific app
flatpak uninstall app.id               # uninstall an app
flatpak uninstall --unused             # remove unused runtimes

Runtimes: Shared Dependencies

Flatpak apps do not bundle every dependency independently. Instead, they share runtimes — base environments (like GNOME Platform or KDE Frameworks) that multiple apps can use. This reduces total disk usage compared to each app shipping its own copy of GTK or Qt.

When you install a Flatpak app, its required runtime is downloaded automatically if not already present.

flatpak list --runtime                 # list installed runtimes

Permissions and the Sandbox

Flatpak apps run in a sandbox with restricted access to the filesystem, network, and devices. You can inspect and override permissions:

# Show an app's permissions
flatpak info --show-permissions app.id

# Grant access to a directory
flatpak override --user --filesystem=/path/to/dir app.id

# Grant home directory access
flatpak override --user --filesystem=home app.id

# Reset all overrides
flatpak override --user --reset app.id

For a graphical interface to manage Flatpak permissions, install Flatseal:

flatpak install flathub com.github.tchx84.Flatseal

Where Flatpaks Are Stored

~/.local/share/flatpak/      # user-installed apps (--user)
/var/lib/flatpak/            # system-wide apps (default, requires sudo)

You can install apps per-user to avoid needing root:

flatpak install --user flathub app.id

Flatpak vs Snap

Both solve the same problem. The main practical differences:

For desktop GUI applications, Flatpak via Flathub often has better selection and more frequent updates. For CLI tools and server software, Snap tends to have broader coverage.

Key Takeaways

• Add Flathub as a remote once: flatpak remote-add --if-not-exists flathub ...
• Install apps by their reverse-domain ID: flatpak install flathub org.gimp.GIMP
• Apps share runtimes, so disk usage is lower than it might appear.
• Use flatpak override or Flatseal to adjust sandbox permissions.
• Flatpak and Snap coexist — install both and use whichever has the app you need.