2 ms·
The MSIX apps can opt to run in a sandbox. It's not perfect, but it's _something_. Plus MSIX helps ensure clean install/uninstall as well as delta updates. Aga
by ndegruchy 2y ago
The MSIX apps can opt to run in a sandbox. It's not perfect, but it's _something_. Plus MSIX helps ensure clean install/uninstall as well as delta updates.
Again, not perfect, but serviceable.
- westurner 2y agofedora/toolbox and distrobox create containers that can access the X socket and /dev/dri/ to run GUI apps from containers. Flatpaks share (GNOME,KDE,NVIDIA,podman,) runtimes, by comparison. Re: MSIX https://news.ycombinator.com/item?id=23394302 https://news.ycombinator.com/item?id=23394302 : > MSIX only enforces a sandbox if an application doesn’t elect to use the restricted capabilities that allow it to run without. File system and registry virtualization can be disabled quite easily with a few lines in the package manifest, as well as a host of other isolation features. Flatseal and KDE and Gnome can modify per-flatpak permissions. IDK if there's a way to do per-flatpak-instance permissions, like containers. MOUNT --type=cache