Flatpak – a security nightmare – 2 years later (2020)

Perhaps make it an optional setting?

"Enhanced Sandboxing (Warning: This feature is experimental, and may cause issues for some apps.)" or something of the sort.

Semi-related. I wanted to run Amarok 1.4 recently (because I had been having a discussion about how no music player on Linux touches MusicBee, and the last one that had promise, before the developers lost their minds, was Amarok 1.4 - yes I know about Clementine etc but MusicBee still wipes the floor with all of them. This is a digression).

Anyway, I spent about an hour attempting to get get it to run on my up-to-date Mint laptop. Now, Amarok 1.4 is 12 years old, so if you want to get it to run, you'll either have to compile it (which means getting your hands on the 12 year old KDE libs), run a 12 year old Linux distribution in a VM, or... Dockerize it. Now you see where the flatpak connection comes in.

Step 1: Find an Ubuntu 8.10 ISO and mounted it:

sudo mount -o loop ubuntu-8.10-desktop-amd64.iso /mnt/intrepid

Step 2: Unqsquash the filesystem:

sudo apt-get install -y squashfs-tools sudo unsquashfs -f -d /tmp/unsquashfs /mnt/intrepid/casper/filesystem.squashfs

Step 3: Import the tarball into a Docker image:

sudo tar -C /tmp/unsquashfs -c . | docker import - ubuntu/intrepid

Step 4: Run interactively and install Amarok:

docker run -it --entrypoint=/bin/bash ubuntu/intrepid

(NOTE: At this point, it was pretty hard to find an apt repo for Ubuntu 8.10 but, amazingly, one or two still exist online. So I edited the apt sources, ran apt-get update && apt-get install -y amarok. I also created a user to run Amarok - one whose uid/gid matched my own user. These commands are left as an exercise for the reader)

So I dockerized Amazok 1.4.10 / Ubuntu 8.10. What next? Well, I could have created a Dockerfile that started "FROM ubuntu/intrepid" and repeated all of my manual work I did in the interactive container, but I'm not keeping this thing, so I just did this the hacky way:

docker export quirky_mendel -o ubuntu_intrepid_amarok.tar

docker import intrepid_amarok.tar amarok:1.4.10

Now I have a docker image called "amarok:1.4.10" which I can share on Docker Hub! Does it work?

docker run -it --entrypoint=/usr/bin/amarok --rm --name amarok --net=host --user amarok --privileged -e DISPLAY=:0 -v ${HOME}/.Xauthority:/home/amarok/.Xauthority amarok:1.4.10

IT WORKS! A 12 year old music player running in a docker container on the latest Linux Mint. My alternative to Flatpak / Snap etc. Is it safe? Nope! It's running in an Ubuntu image that wasn't updated since 2008.

Containers on the desktop are a symptom of a festering underlying disease. They are not the cure for anything. Modern linux development is extremely rapid pace and is 100% targeted at the needs of the corporate entities paying for the development. This extremely fast pace of change in the kernel and underlying libs, langs, and compilers means that a desktop environment put together 4 years ago cannot realistically compile or run software written today.

That's okay for mega-corps who re-build the entire software universe every time they want to make a change. Or for those who ignore desktop entirely and just "deploy" containers.

And that's lead us to today. Linux desktop can't live for more than a few years on it's own. In order to deal with the backwards incompatible features some desktop distros have shifted to using containers. But this doesn't fix the futureshock. It only makes things for desktop users worse.

TBF you could put support into the two common GUI toolkits, to defer to a Flatpak portal.

y