Dunno why people try to push app isolation on Linux desktop. It'd be better and more comfortable to make task/workspace isolation easier. You have all your apps installed system wide as usual, and you isolate processes in sandbox per your current task. Isolating individual apps and having to deal with permission prompts and protals, and persistence of permissions is uh, not very user friendly anyway. Feels like this…
> ... and you isolate processes in sandbox per your current task. Oh is that all? If you start writing up the requirements to make that happen (without permission prompts and portals, right?), I think you'll find that would be even more difficult than app isolation and have even more backward compatibility issues.
Can't imagine how per-app isolation would even work for me. Sounds like something inspired from android world where there's no such thing as having the same app run mutliple times on different workspaces/windows, etc. and the usability correspondingly suffers.
Portal thing even bit me recently. I leave dbus and window manager socket in the sandbox, so I can use GUI apps without too much trouble, and a few months back firefox started showing me files from outside the sandbox and hiding files in the sandbox in file save dialog, which confused the hell out of me, until I found out someone decided to add a remote file access via some dbus service or whatever. Dangerous. I had to remove dbus socket sharing completely from the sandbox at some inconvenience.