Linux application sandboxing and distribution framework (formerly xdg-app)
pwithnall Merge pull request #2119 from mwleeds/implement-deploy-collection-id
Replace xa.collection-id with ostree.deploy-collection-id
Latest commit 56b23fe Sep 21, 2018
Permalink
Failed to load latest commit information.
.github Add a GitHub issue template Apr 3, 2018
app Replace xa.collection-id with ostree.deploy-collection-id Sep 20, 2018
bubblewrap @ ace88fc Update bubblewrap to 0.3.0 Aug 8, 2018
buildutil Fix whitespace issues (remove TAB usage) Oct 17, 2017
ci CI: Don't build ostree Jun 29, 2018
common Replace xa.collection-id with ostree.deploy-collection-id Sep 20, 2018
completion Add zsh completion script May 29, 2018
data Clarify object paths and bus names for portals Sep 5, 2018
dbus-proxy @ 0e78d10 Update dbus-proxy version to get .gitignore Sep 13, 2018
dbus.service.d install dbus systemd service file snippet Jul 26, 2016
doc Explain fallback-x11 Sep 4, 2018
env.d Get the system installation dir right in XDG_DATA_DIRS May 20, 2016
libglnx @ 470af87 Update to latest libglnx Jul 21, 2018
m4 Import ostree's compiler warnings, fix up callers Mar 27, 2017
po Merge pull request #2105 from AsciiWolf/cs-update Sep 16, 2018
portal spawn: More precise error messages Aug 28, 2018
profile Improve and simplify profile snippet Mar 14, 2017
scripts flatpak-coredumpctl: -b option ignored the argument. Sep 7, 2018
session-helper utils: Add flatpak_fail_error that takes an error code Jul 10, 2018
system-helper system-helper: set IO class to idle Sep 4, 2018
tests Replace xa.collection-id with ostree.deploy-collection-id Sep 20, 2018
triggers Pass location of exports to triggers as arg1 Feb 9, 2016
.gitignore Add flatpak_cache_http_uri: cache downloads based on HTTP headers Aug 9, 2018
.gitmodules Import dbus-proxy as a submodule instead Sep 13, 2018
.papr.yml Update CI to f28 May 31, 2018
CODE_OF_CONDUCT.md Create CODE_OF_CONDUCT.md Feb 5, 2018
COPYING Add COPYING to reflect license headers Mar 31, 2015
Makefile.am Import dbus-proxy as a submodule instead Sep 13, 2018
NEWS Update NEWS Sep 13, 2018
README.md README: Add an Oxford comma Apr 6, 2018
acinclude.m4 Add AX_COMPARE_VERSION to acinclude.m4 Sep 9, 2016
autogen.sh Use upstream gettext Jul 15, 2016
configure.ac Bump version to 1.0.2 Sep 13, 2018
flatpak.pc.in Drop libgsystem dependency Aug 22, 2016
flatpak.png Add the logo to README.md Jun 2, 2016
uncrustify.cfg uncrustify: Don't modify brackets Jul 8, 2018
uncrustify.sh uncrustify: Don't modify valgrind header. Jul 8, 2018

README.md

Flatpak icon

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

See https://flatpak.org/ for more information.

Community discussion happens in #flatpak on Freenode and on the mailing list.

Read documentation for the flatpak commandline tools and for the libflatpak library API.

Contributing

Flatpak welcomes contributions from anyone! Here are some ways you can help:

Hacking

Flatpak uses a traditional autoconf-style build mechanism. To build just do

 ./configure [args]
 make
 make install

Most configure arguments are documented in ./configure --help. However, there are some options that are a bit more complicated.

Flatpak relies on a project called Bubblewrap for the low-level sandboxing. By default, an in-tree copy of this is built (distributed in the tarball or using git submodules in the git tree). This will build a helper called flatpak-bwrap. If your system has a recent enough version of Bubblewrap already, you can use --with-system-bubblewrap to use that instead.

Bubblewrap can run in two modes, either using unprivileged user namespaces or setuid mode. This requires that the kernel supports this, which some distributions disable. For instance, Debian and Arch (linux kernel v4.14.5 or later), support user namespaces with the kernel.unprivileged_userns_clone sysctl enabled.

If unprivileged user namespaces are not available, then Bubblewrap must be built as setuid root. This is believed to be safe, as it is designed to do this. Any build of Bubblewrap supports both unprivileged and setuid mode, you just need to set the setuid bit for it to change mode.

However, this does complicate the installation a bit. If you pass --with-priv-mode=setuid to configure (of Flatpak or Bubblewrap) then make install will try to set the setuid bit. However that means you have to run make install as root. Alternatively, you can pass --enable-sudo to configure and it will call sudo when setting the setuid bit. Alternatively you can enable setuid completely outside of the installation, which is common for example when packaging Bubblewrap in a .deb or .rpm.

There are some complications when building Flatpak to a different prefix than the system-installed version. First of all, the newly built Flatpak will look for system-installed flatpaks in $PREFIX/var/lib/flatpak, which will not match existing installed flatpaks. You can use --with-system-install-dir=/var/lib/flatpak to make both installations use the same location.

Secondly, Flatpak ships with a root-privileged policykit helper for system-installation, called flatpak-system-helper. This is dbus activated (on the system-bus) and if you install in a non-standard location it is likely that this will not be found by dbus and policykit. However, if the system installation is synchronized, you can often use the system installed helper instead - at least if the two versions are close in versions.