Firejail versus Flatpak

[CocoR55]

Bonjour,

What is the difference between flatpak and firejail?
Both use sandboxes. In which case firejail is preferable and in which case flatpak?
Which is the least vulnerable?
So, many questions that I have. And you have an idea?
Let me know.

Regards,
CcoR55

[rusty-snake]

Firejail is just a sandboxing solution for programs installed via apt/dnf/pip/cargo/tar.gz/... while flatpak is a full development/building/distribution/running framework. Therefore the first question is "Do I have a choice?" i.e. if a program is only available as flatpak or only as rpm, you have to use flatpak/firejail. If you have a choice, you need to understand the differences between installing via apt/dnf and flatpak (I ignore other ways like pip or tar.gz here). For example are flatpaks always the newest version, if you use a stable distribution and a flatpak comes with a new Gtk version with a theme rework it will not integrate into your DE (visually).

Pro/Con table:

firejail	flatpak
finer and more detailed permission model	easier permission model
sandbox configuration is maintained by a community who wants to make tight sandboxes (not always possible)	sandbox configuration is maintained by the developer/distributor (often the same person), if he/she does not want to get bug reports like "firefox can not write to ~/.bashrc" the permissions are often very weak (= effectively no sandbox)
apps have a shared base system	apps have a private base system
dbus filtering	dbus filtering
private netns possible	private netns not possible (without custom wrapper scripts)
not supported by apps/libraries	supported by libraries like GIO (=better integrated into the app an its workflow)
shared xdg_{cache,config,data}_dir	private xdg_{cache,config,data}_dir
can sandbox privileged programs and cli programs	can not run privileged program and isn't developed for cli programs
same permissions for pipewire (example)	restricted permissions for pipewire (example)
custom seccomp filters, mdwe, big default blacklist	only a small hardcoded seccomp filter

[rusty-snake]

flatpak update notifies you if an updated introduces new permissions. I'm not sure if gnome-software (which I do not recommend to use for updates/installation anyway) does so. Therefore you should always use flatpak update.

[rusty-snake]

You maybe also want to read the firejail/flatpak related comments at https://github.com/privacyguides/privacyguides.org/discussions/169#discussioncomment-1435572.

[topimiettinen]

Somewhat related: Flatpak Is Not the Future, especially parts 'Security' and 'Is Flatpak Fixable?'.

[kmk3]

@topimiettinen on Nov 25:

Somewhat related: Flatpak Is Not the Future, especially
parts 'Security' and 'Is Flatpak Fixable?'.

Nice, I had seen this article and thought about sharing it in here as well.

It has some interesting insights about the current container tools and has
critiques that I hadn't seen before.

Though besides Flatpak it also talks about the direction of containers in
general and about native libraries. What do you think about making a thread
specifically for the article?

[topimiettinen]

Though besides Flatpak it also talks about the direction of containers in general and about native libraries. What do you think about making a thread specifically for the article?

Well, it's not fully related, there's no mention of Firejail at all. Many of the problems listed for flatpaks and snaps are not applicable to Firejail, maybe even the opposite (like native libraries: there's no support for replacing distro libraries with something else for an app).