Hi there - I’m trying to make use of flatpaks, but keeping them isolated from my host (as I need to experiment with a bunch of settings and I don’t want to bork my host environment. Again.)

Has anyone had actual success making this work? I’ve only been able to get anything to install by sudo-ing, but even then, I cannot get things to run. It’ll fail with file not found (but which file? verbose mode doesn’t help) or fail to connect to the system bus.

I’ve seen some posts about unmounting /var/lib/flatpak on initialization but I’ve had no luck there. (I’m on Fedora 39, which, to be honest, I’m rather enjoying.)

Is this a technique that anyone has had luck with? Worth pursuing?

FWIW, my big goal is to run bottles and I’ve had far more luck with bottles (which strongly recommends flatpak) than with winehq.

  • @[email protected]OP
    3•10 months ago

    Thanks - this gives me a few leads.

    I know that I’m not getting a full sandbox - that’s ok. Ultimately I’m trying to get bottles running in the hopes of getting a semi-contained environment for me to test out yabridge and getting reaper to load the vsts without crashing. (Reaper is the easy part, the plugins not so much…)

    A modicum of isolation here (even if not complete) will help me figure things out. Obviously, if I need different kernel/flags the host will get it too.

    If I unshare-devsys, will that disable audio? (I’m still trying to get a clear picture of what’s shared and what isn’t with distrobox/podman (with docker, it feels a bit more straightforward, but I’m not sure docker would be the right choice here…)

    • @[email protected]M
      3•10 months ago

      Audio works. Not sure how though, --unshare-devsys is supposed to not share the hosts devices, but I guess audio devices are an exception.

      The full isolation flags are:

      --unshare-devsys:          do not share host devices and sysfs dirs from host
--unshare-ipc:          do not share ipc namespace with host
--unshare-netns:        do not share the net namespace with host
--unshare-process:          do not share process namespace with host
--unshare-all:          activate all the unshare flags below
      • @[email protected]OP
        2•10 months ago

        Thank you! I just read that and assumed audio wouldn’t. I don’t have warm fuzzies about this.

        That said, I’ll give it a go.

      • @[email protected]OP
        1•10 months ago

        Unfortunately no luck here. Same issue even when setting --unshare-all flag. I suspect I need to try a different approach.