We are excited to announce a significant investment of €508,640 by the German Sovereign Tech Agency, through its Sovereign Tech Fund (STF) initiative, into the development and stewardship of Flatpak. This two-year initiative, co-organized by Modal and with Para-Real Ltd. as supporting organization, will accelerate the evolution of Flatpak as a secure, sandboxed platform for packaging and distributing Linux desktop software.

Flatpak serves as the primary application distribution method for image-based operating systems including Fedora Silverblue, openSUSE Aeon, SteamOS, and GNOME OS. It is the preferred format for major ecosystems such as GNOME, KDE, and elementary. By expanding Flatpak’s capabilities, this investment will directly improve the security, robustness, and overall user and developer experience of the Free Software desktop ecosystem.

Are We Sandboxed Yet?

Flatpak is a mature project and the best option that exists on GNU/Linux today, but its security and sandboxing features still trail behind those of well-funded proprietary platforms such as Android and iOS. Certain technical limitations persist, such as the inability to separate audio output from microphone access—and several critical areas, including networking and VPNs, still lack dedicated Portals.

Following significant progress made during the 2023/2024 GNOME STF project, development has slowed in recent years, due to the specialized expertise required for this kind of platform-level work and the limited capacity of the overstretched Flatpak maintainers. This hinders the adoption of secure, image-based operating systems that rely exclusively on Flatpak apps.

A Collaborative Effort

For Modal, a robust app sandboxing story is essential to creating a Free Software OS that is competitive with modern mobile platforms. Leveraging our experience co-organizing STF projects for GNOME and systemd, we have partnered with other community members to put together this new initiative to push the ecosystem forward.

The project is led on the technical side by Sebastian and Adrian, with organizational support from Kateryna and Cade. While Para-Real Ltd. serves as the supporting organization, we hope to use this investment to build long-term community capacity by growing the pool of people who know this part of the stack, and putting in place more formal structures for the Flatpak project.

We are proud to bring on board a team of experienced contractors for the technical execution: Philip Withnall, Julian Sparber, and Dhanuka Warusadura from the 2023/2024 GNOME STF project, alongside Zelda Ahmed, Ignacy Kuchciński, Hari Rana, Eva (of Bazaar), and veteran GNOME designer Sam Hewitt. The project will ramp up over the coming months and is expected to run through the end of 2027.

Technical Roadmap

The Sovereign Tech Agency has commissioned work towards closing critical gaps in the sandboxing story, introducing long-requested infrastructure, and ensuring general maintenance.

We’ll focus on the following areas:

New Portals

• Audio: Implementation of a new static socket permission for PipeWire, a WirePlumber policy to manage device access, and a portal for setting audio permissions (e.g. allowing speaker access without granting microphone access).
• Network: Isolation of networking from the host with new static permissions for specific scopes (host, local network, internet) and ports, preventing unnecessary exposure of local devices.
• VPN: A new portal modeled after Android and iOS APIs, enabling third-party VPN apps to manage system-level connections.
• Writing Assistance: A new portal for spell checking, allowing for all apps on the system to share a dictionary, even when sandboxed. Additionally, this could allow apps like Eloquent to hook into the portal and provide richer editing suggestions, such as grammar corrections.
• Password Auto-Fill: Research and architectural design for a secure password auto-fill portal to replace current insecure NativeMessaging approaches.

Infrastructure and Maintenance

• Entitlements: A new system for declaring static permissions for specific portals, allowing app store reviewers to verify capabilities and enabling the introduction of more advanced features like third-party accessibility tools.
• Intents: An abstract system for apps to declare offered services, facilitating deep-linking to sub-pages or handling specific web URLs natively.
• Portals Maintenance: Porting to libdex, adding integration tests, and improving system permission dialogs.

Watch This Space

As design and implementation begin, these plans may evolve. We invite the community to follow our progress and engage with us on Matrix in #flatpak:matrix.org and #xdg-desktop-portals:matrix.org.

Stay tuned for more!