6 ms·

What does snap do that flatpak doesn't?

gjsman-1000 6y ago
Well, if you are building an IoT Device, lots of stuff for reliability. Automatic rollbacks, self-repairing, immutable FS... For a desktop user, honestly, very little.
- curt15 6y ago
  >Well, if you are building an IoT Device, lots of stuff for reliability. Automatic rollbacks, self-repairing, immutable FS... For that there is ostree, which is already supported by at least one major embedded systems vendor (https://docs.windriver.com/bundle/Wind_River_Linux_Tutorial_Using_OSTree_for_Updates_at_Run_Time_LTS_19/page/ont1573078060508.html https://docs.windriver.com/bundle/Wind_River_Linux_Tutorial_...).
  - m4rtink 6y ago
    BTW, OSTree is also the technplogy behind Fedora Silverblue, Fedora IoT and modern versions of Coee OS. Also flatpaks use OSTree internally for deduplication of all runtimes and flatpaks & for diff only downloads.
- AgentME 6y ago
  That reliability stuff sounds good on desktop too. I don't exactly enjoy re-running apt after it has mysterious failures halfway through installs.
  - gjsman-1000 6y ago
    You might find Fedora Silverblue fascinating. It's an OS that uses Flatpak for Desktop Apps exclusively, which disposable "toolboxes" for non-Flatpak apps.
    - m4rtink 6y ago
      And all the systrm stuff is immutable and managged by OSTree. This makes it posdoble to diff only download a new system state and then atomically switch to it after reboot. And if you hit any issues with it, just boot to the previous one (you can have multiple previous states).
  - galgalesh 6y ago
    `snap revert app-name` is a lifesaver..
- galgalesh 6y ago
  Actually, even for desktop Snaps have some advantages. First of all, the fact that you can put a system service in a snap: The OpenPrinting project is working on creating a snap which contains the entire Linux printing stack. This is so users of older distribution releases can still use the latest printers. Secondly, the Snap sandbox is a lot more granular than the Flatpak sandbox. Flatpak went for portability and Snap went for granularity. Snap uses AppArmor to mediate existing Linux kernel api's. As a example, you can give a Snap access to joysticks and controllers but deny it access to a USB webcam, for example. XDG Desktop Portals should make it possible to safely use certain host features such as a webcam in a Flatpak, but this requires applications to be rewritten to use the portals api. In the current state, most Flatpaks disable large parts of the sandbox because the applications would otherwise not be able to run in it.
suby 6y ago
Flatpak can not currently run on servers, only desktops. I'm not sure if there are plans to change this, if anyone knows I'd be interested in finding out.
- gjsman-1000 6y ago
  At least for now, there are no plans to change this because Flatpak (if I recall) requires dbus. You might find some interesting info on that.
  - eikenberry 6y ago
    You seem to be suggesting that servers don't run dbus. It is currently running on all my servers and I'm pretty sure it is standard on all major server oriented distros.. Am I mistaken or did I misunderstand your point?
    - gjsman-1000 6y ago
      My memory is foggy, but there was something about dbus which rendered it unsuitable for systems without a running GUI on X/Wayland. Not sure what though, it's been years.
      - danshick 6y ago
        There's nothing about D-Bus in general that is problematic, but rather that flatpak relies on the D-Bus session bus and systemd --user instances[0]. It can be made to work just fine on a server, but it may not be the most convenient arrangement due to this dependency on user sessions. [0] https://flatpak.org/faq/#Can_Flatpak_be_used_on_servers_too_ https://flatpak.org/faq/#Can_Flatpak_be_used_on_servers_too_
    - unixhero 6y ago
      Traditionally you don't want to have xorg installed on a server. If you do have it installed then yes, you would have dbus.
galgalesh 6y ago
Snaps can contain _any_ piece of Linux software, from kernels to the printing stack, to PulseAudio and finally desktop applications. Flatpak only focuses on Desktop Apps. For more information, see :https://merlijn.sebrechts.be/blog/2020-07-03-snap-vs-flatpak/ https://merlijn.sebrechts.be/blog/2020-07-03-snap-vs-flatpak... Another big difference is that the sandbox of Snap is much more granular. Snap uses AppArmor to mediate the _existing_ Linux api's. This allows you to give an app access to usb-serial devices but deny it access to a USB webcam, for example. Or to give an application access to joysticks and controllers, but deny it access to a webcam. Both Snap and Flatpak support XDG Desktop Portals to give desktop applications secure access to features such as a webcam, but this is a new API, application need to be ported to the new API before they can use these features. As a result, most snaps have much less permissions than their Flatpak counterpart because the Flatpak sandbox needs to be largely disabled for the applications to work.
- m4rtink 6y ago
  Snaps being able to install kernel modules still disturbs me even today... Seems like Canonical is crammjng everything they can into Snap - free software, privacy & security be damned!

Well, if you are building an IoT Device, lots of stuff for reliability. Automatic rollbacks, self-repairing, immutable FS... For a desktop user, honestly, very little.

curt15 6y ago
>Well, if you are building an IoT Device, lots of stuff for reliability. Automatic rollbacks, self-repairing, immutable FS... For that there is ostree, which is already supported by at least one major embedded systems vendor (https://docs.windriver.com/bundle/Wind_River_Linux_Tutorial_Using_OSTree_for_Updates_at_Run_Time_LTS_19/page/ont1573078060508.html https://docs.windriver.com/bundle/Wind_River_Linux_Tutorial_...).
- m4rtink 6y ago
  BTW, OSTree is also the technplogy behind Fedora Silverblue, Fedora IoT and modern versions of Coee OS. Also flatpaks use OSTree internally for deduplication of all runtimes and flatpaks & for diff only downloads.
AgentME 6y ago
That reliability stuff sounds good on desktop too. I don't exactly enjoy re-running apt after it has mysterious failures halfway through installs.
- gjsman-1000 6y ago
  You might find Fedora Silverblue fascinating. It's an OS that uses Flatpak for Desktop Apps exclusively, which disposable "toolboxes" for non-Flatpak apps.
  - m4rtink 6y ago
    And all the systrm stuff is immutable and managged by OSTree. This makes it posdoble to diff only download a new system state and then atomically switch to it after reboot. And if you hit any issues with it, just boot to the previous one (you can have multiple previous states).
- galgalesh 6y ago
  `snap revert app-name` is a lifesaver..
galgalesh 6y ago
Actually, even for desktop Snaps have some advantages. First of all, the fact that you can put a system service in a snap: The OpenPrinting project is working on creating a snap which contains the entire Linux printing stack. This is so users of older distribution releases can still use the latest printers. Secondly, the Snap sandbox is a lot more granular than the Flatpak sandbox. Flatpak went for portability and Snap went for granularity. Snap uses AppArmor to mediate existing Linux kernel api's. As a example, you can give a Snap access to joysticks and controllers but deny it access to a USB webcam, for example. XDG Desktop Portals should make it possible to safely use certain host features such as a webcam in a Flatpak, but this requires applications to be rewritten to use the portals api. In the current state, most Flatpaks disable large parts of the sandbox because the applications would otherwise not be able to run in it.

suby 6y ago

Flatpak can not currently run on servers, only desktops. I'm not sure if there are plans to change this, if anyone knows I'd be interested in finding out.

gjsman-1000 6y ago
At least for now, there are no plans to change this because Flatpak (if I recall) requires dbus. You might find some interesting info on that.
- eikenberry 6y ago
  You seem to be suggesting that servers don't run dbus. It is currently running on all my servers and I'm pretty sure it is standard on all major server oriented distros.. Am I mistaken or did I misunderstand your point?
  - gjsman-1000 6y ago
    My memory is foggy, but there was something about dbus which rendered it unsuitable for systems without a running GUI on X/Wayland. Not sure what though, it's been years.
    - danshick 6y ago
      There's nothing about D-Bus in general that is problematic, but rather that flatpak relies on the D-Bus session bus and systemd --user instances[0]. It can be made to work just fine on a server, but it may not be the most convenient arrangement due to this dependency on user sessions. [0] https://flatpak.org/faq/#Can_Flatpak_be_used_on_servers_too_ https://flatpak.org/faq/#Can_Flatpak_be_used_on_servers_too_
  - unixhero 6y ago
    Traditionally you don't want to have xorg installed on a server. If you do have it installed then yes, you would have dbus.

galgalesh 6y ago

Snaps can contain _any_ piece of Linux software, from kernels to the printing stack, to PulseAudio and finally desktop applications. Flatpak only focuses on Desktop Apps. For more information, see :https://merlijn.sebrechts.be/blog/2020-07-03-snap-vs-flatpak/ https://merlijn.sebrechts.be/blog/2020-07-03-snap-vs-flatpak... Another big difference is that the sandbox of Snap is much more granular. Snap uses AppArmor to mediate the _existing_ Linux api's. This allows you to give an app access to usb-serial devices but deny it access to a USB webcam, for example. Or to give an application access to joysticks and controllers, but deny it access to a webcam. Both Snap and Flatpak support XDG Desktop Portals to give desktop applications secure access to features such as a webcam, but this is a new API, application need to be ported to the new API before they can use these features. As a result, most snaps have much less permissions than their Flatpak counterpart because the Flatpak sandbox needs to be largely disabled for the applications to work.

m4rtink 6y ago
Snaps being able to install kernel modules still disturbs me even today... Seems like Canonical is crammjng everything they can into Snap - free software, privacy & security be damned!