Is Flatpak less secure than a native package?

The sandbox improves isolation compared to traditional packages, but security depends on what permissions an app requests. Always check permissions in Flatseal — an app with 'host' filesystem access is essentially unsandboxed.

Why does the first Flatpak install download hundreds of megabytes?

The runtime (e.g., GNOME Platform or KDE Platform) bundles shared libraries for that app family and is downloaded once. Subsequent apps using the same runtime reuse it, so download sizes drop significantly.

Can I run Flatpak apps on Wayland?

Yes. Most modern Flatpak apps support Wayland natively. The xdg-desktop-portal service is required for file picking and screen sharing to work correctly under Wayland — install the portal backend matching your desktop (GNOME, KDE, or GTK).

How do Flatpak updates differ from system package updates?

Flatpak apps are versioned and updated independently of the OS. An update is downloaded to a new deployment slot and activated atomically, so a failed update never breaks the running version.

Can I use Flatpak alongside apt/dnf/pacman packages?

Absolutely. Flatpak runs entirely alongside the native package manager and does not interfere with it. You can have the system VLC from apt and a Flatpak VLC installed simultaneously, though running both at once is rarely useful.

How to Use Flatpak on Linux

Flatpak is a universal packaging format that lets you install applications in a sandboxed environment, independent of your distribution's package manager. It solves the "works on my distro" problem by bundling dependencies with the app and isolating it from the host system. Flathub is the central repository where the vast majority of Flatpak apps live — once you add it, you have access to thousands of current, maintainer-updated applications regardless of whether you're on Ubuntu LTS, Fedora, or Arch.

Install Flatpak

Many distributions ship Flatpak by default. If yours doesn't, install it from the system package manager.

Debian / Ubuntu

sudo apt install flatpak

Fedora / RHEL 9+ / Rocky 9+

sudo dnf install flatpak

Fedora ships Flatpak out of the box; this is only needed if it was removed.

Arch Linux

sudo pacman -S flatpak

After installation, log out and back in (or reboot) so that XDG_DATA_DIRS is updated and your desktop environment can find Flatpak-installed apps in the launcher.

Add the Flathub Repository

Flatpak remotes are named repositories, similar to APT sources or DNF repos. Flathub is the one you almost always want.

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

The --if-not-exists flag makes the command safe to re-run — it won't error if Flathub is already configured. On Fedora, Flathub is added but filtered by default; the command above replaces the filtered remote with the full one. Verify your remotes at any time:

flatpak remotes

You should see flathub listed with the URL https://dl.flathub.org/repo/.

Find and Install Applications

Search from the terminal

flatpak search vlc

Output lists the application name, ID (reverse-domain notation like org.videolan.VLC), version, and which remote it comes from. The application ID is what you use for all subsequent commands.

Install an app

flatpak install flathub org.videolan.VLC

Flatpak will download the app and any required runtimes (base libraries shared across apps). The first install in a runtime family — such as org.freedesktop.Platform or org.gnome.Platform — is larger because the runtime itself is downloaded once and reused.

Run an app

flatpak run org.videolan.VLC

Installed apps also appear in your desktop environment's application launcher (GNOME Activities, KDE Plasma launcher, etc.) just like any other app.

Install for the current user only

By default, flatpak install installs system-wide (requires sudo or polkit elevation). To install only for your user account:

flatpak install --user flathub org.videolan.VLC

Update Apps

Update all installed Flatpaks — apps and runtimes — with a single command:

flatpak update

Updates are atomic; if a download fails partway through, the previous version remains intact. Most desktop environments (GNOME Software, KDE Discover) also handle Flatpak updates through their GUI update managers.

Understanding the Sandbox

Every Flatpak app runs inside a container that restricts what it can access on your system. By default, an app cannot read arbitrary files on your filesystem, access hardware directly, or communicate with other processes outside the sandbox without explicit permissions.

Common permission categories include:

Filesystem access — e.g., home (full home directory), host (entire filesystem), or specific paths like /media.
Device access — webcam, microphone, USB devices, GPU.
Portals — controlled interfaces for opening files, printing, and screen capture that let the user approve each operation.
Network — on/off toggle; most apps request this.
D-Bus — ability to talk to system or session services.

To inspect what permissions an installed app currently has:

flatpak info --show-permissions org.videolan.VLC

Override Permissions with Flatseal

Flatseal is a GUI tool purpose-built for managing Flatpak permissions. It's the most user-friendly way to grant or revoke sandbox permissions without memorising command-line flags.

Install Flatseal

flatpak install flathub com.github.tchx84.Flatseal

Using Flatseal

Launch Flatseal from your app launcher or with flatpak run com.github.tchx84.Flatseal. Select any installed Flatpak from the left panel. You'll see toggles and text fields for every permission category. Common tasks:

Grant access to an external drive: Under Filesystem, add the mount path (e.g., /run/media/username/MyDrive) to the other files field.
Block network access: Toggle Network off for apps that have no reason to call home.
Allow a specific device: Enable All Devices or a specific device node under Device.

Override from the command line

If you prefer the terminal, flatpak override applies the same changes:

# Grant read/write access to your Documents folder
sudo flatpak override org.videolan.VLC --filesystem=~/Documents

# Revoke network access
sudo flatpak override org.videolan.VLC --unshare=network

# Per-user override (no sudo needed)
flatpak override --user org.videolan.VLC --filesystem=~/Documents

View current overrides for an app:

flatpak override --show org.videolan.VLC

List and Remove Apps

List installed Flatpaks

flatpak list --app

The --app flag hides runtimes so you only see user-facing applications.

Uninstall an app

flatpak uninstall org.videolan.VLC

Remove unused runtimes

When you uninstall apps, the runtimes they depended on may remain. Clean them up with:

flatpak uninstall --unused

This is safe to run periodically and can recover several gigabytes of disk space if you've installed and removed many apps over time.

Verification

Confirm everything is working correctly:

flatpak list --app
flatpak remotes
flatpak update

If apps appear in flatpak list and flatpak update runs without errors, your setup is healthy. Apps should also be visible in your desktop launcher after the next login or a systemctl --user restart xdg-desktop-portal.

Troubleshooting

App not appearing in the launcher

Log out and back in, or manually update the desktop database:

update-desktop-database ~/.local/share/applications

App can't open files from the file manager

Ensure the xdg-desktop-portal and the appropriate backend for your desktop (xdg-desktop-portal-gnome, xdg-desktop-portal-kde, or xdg-desktop-portal-gtk) are installed and running. Under Wayland this is especially important — portals are the primary way sandboxed apps access the host filesystem through user-approved dialogs.

systemctl --user status xdg-desktop-portal

Flathub shows no results after adding the remote

Run flatpak update to force a metadata refresh, then search again. A slow or interrupted initial sync can leave the local catalogue empty.

Disk usage is unexpectedly high

Check what's taking space and remove unused runtimes:

flatpak list --runtime
flatpak uninstall --unused