Everybody knows that allowing different applications unlimited access to each other’s data is not exactly optimal from a security point of view. While servers have enjoyed containers to isolate applications from each other, we lack a good solution for the desktop. Or do we? There is, obviously, flatpak. Unfortunately, flatpak present itself as a “Linux application sandboxing and distribution framework”. This will not do. I already have a distribution. I’m pretty happy with it.

Nice series of blog posts I found detailing how to use bubblewrap (the sandboxing tool used by Flatpak) to sandbox regular programs.

  • @shirro@aussie.zoneEnglish
    10•4 months ago

    I was setting up a modded minecraft launcher for the family to use and and I have trust issues with the modding ecosystem and kids installing random jar files. I used bwrap and it works really well. The launcher uses wayland, minecraft typically X, needs dri access for opengl, pipewire, input devices, networking and dns resolve to connect to servers etc. Doesn’t need filesystem access to much other than some shared libs (ro) and a directory in .config. There is a bit of trial and error involved and making the bwrap robust to differences between desktops (different sockets for dns or mdns resolvers) and makes me appreciate apps packaged as flatpak as this level of sandboxing should be standardised for all distributed apps. Half the stuff in AUR should be bwrapped IMO.