Pro apt:
- storage efficient
- may be optimized for stuff like x86_64 v3 or v4
- runs as many users and easily from terminal
- needed for some low level stuff like system packages
Contra apt:
- a ton of stuff comes from outside the main Ubuntu repo. Debian doesnt have that difference afaik but still many packages may be more abandoned
- 3rd party packaging 99% of the time, i.e. "unverified". I had a lot of strange bugs especially with Ubuntu packages
- the apps ars not isolated at all
Pro Flatpak
- a ton of verified apps, nearly unavailable on other repos (that still doesnt make unverified apps insecure!)
- all apps have a sandbox that can be graphically hardened to be more secure, if the defaults are too broad
- by defaults the sandbox is pretty good
- many many apps that run everywhere
Contra Flatpak
- not suited for some apps like terminal apps or system stuff
- some apps are less maintained and use EOL runtimes etc
- some more storage space needed
- need user namespaces, nearly all distros have them enabled
- a bit slower startup time but okay
- a bit more RAM usage
In general I agree, though had something to add regarding these points:
by defaults the sandbox is pretty good
This is a rather major problem with Flatpak; the maintainer decides what permissions they need by default, not the user. The user needs to retroactively roll them back or specify global options and manually override them per-app, but that's not user-friendly at all. Though many Flatpaks do have good permissions because Flathub maintainers step in and offer suggestions before approving the Flatpak for publication, there are a number of Flatpaks that punch big holes in the sandbox; so much so that they might as well be unsandboxed.
But Bottles has a great sandbox, for instance, which is just what you'd want when running lots of proprietary Windows applications you maybe don't trust as much as your Linux-y software.
It's better than what we have with traditional packages but it can sometimes get in the way and not all beginners can easily figure out how to fix permissions issues with Flatseal. This will probably improve as we get more portals built.
some apps are less maintained and use EOL runtimes etc
Not much is different for distribution-maintained packages, either. See TheEvilSkeleton's post about how there are over 1200 unmaintained packages in the Debian repositories, and even over 400 in Arch's much smaller repositories that are outdated (!). At least Flathub applications are usually maintained by upstream, and so are usually as up to date as they can be.
not suited for some apps like terminal apps or system stuff
This isn't really true. It's only true when terminal applications need privileged access to something. Flathub ships Mesa userpace drivers and NVIDIA's proprietary userspace drivers just fine. You can package something like
yt-dlpin Flatpak just fine with--filesystem=host. Hell, they've even got Neovim on Flathub. Sure, it's a little more cumbersome to type, but you can always create an alias.Flatpak is not suitable for all graphical applications, either. Wireshark's full feature-set cannot be supported, for example.
I would add that:
- You can easily rollback Flatpaks to a previous version (even from a long time ago) with
flatpak update --commit. Much harder with traditional package systems, and you'll probably need to downgrade shared libraries too. - You get a consistent build environment with Flatpak manifests. If you want to build a newer version of a stable package you're using straight from
masteror with a few patches, all you really need to do is clone it fromflathub/whatever, change a few lines, and it has a very high chance of building properly. No need to figure out dependencies, toolchains, or sane build options. And it's all controlled from an easy-to-read and modify file.
defaults
The default is completely sandboxed. Developers need to allowlist exactly what they want. So it is transparent.
Compare that to a random app where you need to monitor its syscalls to see what it does.
KDE Plasma now includes a GUI settings page that allows to change these.
I think GNOME needs to integrate that into their settings, I mean just include damn Flatseal as a settings page...
specify global options
This is supercool and I started doing that. All apps get the env vars to force Wayland now even though they may not use it. I have my overrides and uploaded them to my dotfiles.
But Bottles has a great sandbox
Echo that
over 1200 unmaintained packages in the Debian repositories, and even over 400 in Arch's much smaller repositories
This is crazy, same on Fedora. Distros really need to start using separate repos, and automatically filter out everything that didnt get a "I maintain this" for a while.
There are packagers maintaining a shitload of apps at once.
Flathub applications are usually maintained by upstream
Not always but having this at all, and having most big names in there, is incredible. This is like a first time this happens.
easily rollback Flatpaks
Ostree is great
consistent build environment
And having it declared centrally can help add all the security benefits of the individual ones too. Really nice
- You can easily rollback Flatpaks to a previous version (even from a long time ago) with
I like flatpak as it helps me keep bloat down. I always find that native packages eventually pollute the system. Flatpaks do somewhat as well but I can manually delete the app storage if necessary
Things installed by apt almost always work as expected and are easily run from the cli.
Flatpaks are sometimes more up to date.
One thing that hasn't been mentioned yet is interopability, that is, flatpak interacting with the rest of your system.
I'm not that familair with flatpak, but in my brief experience with the steam flatpak, I had trouble getting it to recognize my controllers. Steam installed through pacman (Arch's package manager) had no such issues, on the other hand. My hunch is that this has to with flatpaks being more isolated from the rest of your system.
Im pretty sure that's just some kind of permission issue, but it can be nice to not have to troubleshoot acces rights and the like. But this is obviously a double edged sword: more isolation may also mean more security, just at the cost of ease of interaction with other components.
The steam flatpak can't install udev rules. It works if you install a packacke such as
steam-deviceson your host system. See https://github.com/flathub/com.valvesoftware.Steam/wiki#my-controller-isnt-being-detectedThe good news is that flatpak and XDG portals are progressing
Yeah, both have pros and cons. I have Steam installed through pacman and flatpak also. For me I have the Flatpak version because it contains its own version of glibc. This mostly doesn't matter, except I play Squad and it's doing something with it's anti-cheat that isn't supported in the most recent versions of glibc, so I use the Flatpak version for Squad only.
Flatpak is essentially a more controlled environment. It will contain everything it needs to work, which is good for ensuring it works but bad because you'll have duplicates. It mostly doesn't matter which you use, but occasionally it does.
This issue with glibc should have been sorted out. But yeah, if you use arch you may have some issues from time to time cause some projects broke their ABIs sometimes, but I prefer to use the one with pacman cause I only have to update my entire system with one command, also theming is an issue with flatpak that I know there is solutions out there but AFAIK are always adhoc solutions for each app.
Also, IIRC steam folder is always in a weird place using flatpak.
flatpaks are designed for gui apps, and due to packaging dependencies, they are extra heavy in disk space. flatpaks are also most often installed on the user, not systemwide, so no root permissions needed to install.
apt installs systemwide exclusively, but can have a much smaller download size if the dependencies are already installed. Apps sharing dependencies means much less disk space. cli is supported.
they are extra heavy in disk space
While they use more disk space than most native packages, this point is often exaggerated. Flatpak uses deduplication and shared runtimes if multiple apps use the same runtime.
While they use more disk space than most native packages, this point is often exaggerated. Flatpak uses deduplication and shared runtimes if multiple apps use the same runtime.
4.79 GiBwith deduplication.Worth mentioning that my entire distro with those applications included, and about 30 appimages is
4.2 GIBtotal, and that includes the home btw.
Lots, LOTS, TL;DR - flatpaks are sandboxed and work on every* distro out there, while apt packages are not and only work on debian and it's derivatives. I'd say on mint or debian, prefer using flatpaks over apt packages as you're usually gonna get newer versions of software.
What's up with all the negativity around flatpaks? I use Arch (btw) and I try to install as much as I can using flatpak. I think they are great. They are compatible, usually up to date, easy to install, easy to remove and it won't break your system. The sandbox can be edited to include more paths etc.
If I developed a Linux app I would absolutely package it as a flatpak. If a package is in pacman, however, I see no reason to use the flatpak version instead.
Huh. I didn't even realize that you can use flatpaks with arch. I've only ever used pacman and yay.
Flatpaks won't get their libs updated all at once by just updating a library. This can be very bad in cases like bugs in openssl. Instead of just updating one library and all other software benefiting from the fix, with flatpaks, you need to deal with updating everything manually and waiting for the vendor to actually create an update package.
I'm not 100% sure about this. Flatpak has some mechanisms that would allow to manage dependencies in a common fashion.
Most Flatpaks depend on the Freedesktop Platform runtime, or GNOME/KDE runtimes, which are derived from it. This contains several hundred common dependencies and librarires programs need, like
gccandpython. When you update the runtime (change it from22.08to23.08in the manifest), all the dependencies are updated too. Many simple applications don't depend on many more dependencies than are available in the runtime. Some...have more complicated dependency trees.But counterpoint: the developer will update the dependencies when they are known to work properly with the application. Upgrading GTK3 to GTK4 in the GIMP flatpak will just break the application. Same thing with Krita and the dozens of patches to libraries it depends on. If you upgrade the application in the name of security before it's compatible, all you end up with is a broken application. Which I guess is more secure, but that's not helpful to anyone.
Which means that if you have a flatpak with an uncommon library and the dev stops issuing updated flatpaks because they get hit by a bus, you could be SOL with respect to that library. Distro libs are less likely to have this happen because very few distros have a bus factor of 1—there's usually someone who can take over.
Thanks for the interesting point! I learned something today. I guess it all depends on your use-case, whether flatpaks make sense or not.
Common libraries like OpenSSL are usually bundled in runtimes. So if my application uses e.g.
org.gnome.Platform, I don't have to update my application if there is a fix in a library of that runtime, I just need to update the runtime.The runtime is also shared by all applications that use this runtime.
In addition to other people's comments, flatpaks are usually more up to date than their apt counterpart (expecially those from the debian stable repositories).
I run debian and I deliberately installed some software from flatpak (eg. Ardour and Guitarix) because the deb package is a whole version behind.Flatpaks require more storage space as all dependencies are combined in a flatpak. For me rather 2nd choice.
FYI: Flatpaks can share some dependencies and duplicate files.
They still use way more storage.
My entire distro + home + 30 appimages (which includes the equivalent flatpak applications as appimage) is
4.2 GiB
That flatpak benefit doesn't even mean anything though. It can happen that the library included won't work with your system and therefore the program itself won't either, and fixing it isn't as easy as installing an updated library deb package.
I won't use flatpak, snap, etc for that reason. If someone only makes their program buildable in to one I just won't be using that program. I don't have the time or desire to pick out binaries and resolve all dependencies manually for something that should at minimum have a basic "make install" function.
It isn't bad if you have a bunch of flatapaks as they share dependencies. For install the first install might be huge but the second app that also uses the same framework will be much smaller
Flatpak's benefits mostly exist for the developer. Apt is more tightly integrated with the distro, which is generally advantageous, but also means more work for packaging. Flatpak's benefit is that it's a compatibility layer for lots of different distros. In a perfect world, every distro would have a large library of packages in the official repo, but that's a lot of work for devs, and flatpak lets them avoid that sprawling support.
I'm using MX, debian based, apt package, I have 0 flatpak/snap. They are up to date on about everything, like the latest Firefox I got this morning in a simple .deb that nala (apt frontend) installed without problems.
I never ever installed a snap/flat in my Linux years.
Honestly you should (flatpak that is)
Flatpaks are nice and provide isolation so installed apps do not add bloat to the core system.
I thought id give flatpak firefox a shot and the profiles are broken. I might be able to fix it by making some symlinks but it left a bad taste in my mouth. I was unable to get it to recognize my userChrome.css
