How to make your application into a Flatpak Owen Taylor Red Hat Flock 2017 August 29, 2017 The Flatpak !odel O" Init Display System Server Kernel Libraries O" ● Applications as O" packages ● #roblems: Init Display Kernel System Server – Tied update cycles – Distribution specific packages Libraries – (o security GIMP tuxkart O" App App Init Display System Server Kernel GIMP Libraries tuxkart Libraries Libraries O" App App Init Display Libraries Libraries System Server Kernel GIMP tuxkart Libraries Runtime Libraries • Avoids duplication on disk and in memory • Security updates in one place O" App App GIMP Libraries tuxkart Libraries Init Display System Server Kernel Runtime Libraries Libraries App App Scribus Libraries Chrome Libraries Runtime Libraries &esktop Applications ✔)i$reOffice ✔*+!# ✔tuxkart ✔-clipse ✔*oogle . rome ✗!aria&/ ✗Wordpress ✗vi 0here do you get Flatpaks ● From application creators – Open source projects – .ompanies ● Or 'rom )inux distri$utors ● &ecentrali3ed 0 ere do you get Runtimes ● 45pstream” runtimes – org7'reedesktop.#latform – org7gnome7#latform – org7kde7Plat'orm ● &istri$ution runtimes – org7'edoraproject.Platform &istribution advantages ● #ackaging of older applications ● -xisting $uild recipes ● "ecurity updates mec anism Security and #ermissions Application Environment Permissions Network Application Display Server Environment (Wayland) Network Application Environment Display Server (X11) (not effectively sandboxed) Filesystem access Permissions Network Application Display Server Environment (Wayland) File Portal Print Portal Portals Filesystem Printing access system #ortals ● "imple, in erently secure system services 8&-Bus) ● "afe 1ia user interaction ● Availa$le portals – File, Print, " ow UR+, (etwork Status, HTTP Proxy .onfig ● *(OME and ;&- $ackends Portal Demo Flatpak Implementation ● -ac application as it’s own Filesystem namespace – Runtime is available at =usr – Application and $undled libraries at =app ● Other kernel security 'eatures – #+D and 5+& namespaces – seccomp OSTree ● 4git 'or $inaries6 ● &eduplication – On disk – +n memory – On the network ● Atomic updates O.+ Images ● Alternate way to distri$ute a Flatpak ● From Open .ontainer Initiati1e 8 ttps%==www.opencontainers.org/: ● -volution of t e &ocker format ● Advantages: – avoids lots o' small 'iles – allows distri$ution alongside server containers OSTree OSTree Docker/OCI Repository Repository Registry Flatpak GNOME Software Flatpaks from Fedora Packages 0hy Flatpak if you can RP!> ● "and$oxing ● Relia$le upgrades wit out re$ooting ● Ability to try out applications from newer/older Fedora ● Installation on top of Atomic Workstation Flatpak ? A module packaged into a container image Flatpak ? A 8particular sort of) module packaged into a 8particular sort o': container image The big picture ● Modules% – 'latpak-runtime module – One module per Flatpak application ● Built into OCI Images $y t e Fedora )ayered +mage Build "ervice ● &istri$uted via registry7'edoraproject.org 0 y modules ● (atural way to do re$uilds of packages with –prefix=/app ● Increased packager fle,i$ility ● Alignment wit general modularity e''orts ● (o e,tra new infrastructure components Fedora Infrastructure ● !odule /uild "ervice 8!/": – manages module builds in Ko2i ● #roduct De'inition .enter 8#&.) @ stores in'ormation about module $uilds ● On Demand .ompose "ervice (O&.") – creates yum repositories 'or module builds ● Fedora )ayered +mage /uild "ervice 8F)+/") – builds containers and now flatpaks ● registry.'edorapro2ect.org @ stores containers and now flatpaks An example Flatpak Eye of *(OM- +mage Aiewer eog7yaml ● Module metadata 'ile ● &escri$es w at packages should $e $uilt ● And what t ose packages depend upon document: modulemd version: 1 eog.yaml data: summary: Eye of GNOME Application Module description: The Eye of GNOME image viewer (eog) is the official image viewer for the GNOME desktop [...] license: module: [ MIT ] dependencies: buildrequires: flatpak-runtime: f26 base-runtime: f26 perl: f26 common-build-dependencies: f26 shared-userspace: f26 requires: flatpak-runtime: f26 profiles: default: rpms: - eog components: rpms: eog.yaml eog: rationale: Core application ref: f26 buildorder: 3 exempi: rationale: Dependency ref: f26 buildorder: 2 libexif: rationale: Dependency ref: f26 buildorder: 2 glade: rationale: Build dependency for libpeas ref: f26 buildorder: 1 libpeas: rationale: Dependency ref: f26 buildorder: 2 .reating eog7yaml ● ttps://pagure.io/flatpak-module-tools $ flatpak-module create-modulemd \ --from-package eog -o eog.yaml ● ttps://githu$.com/fedora-modularity/depc ase ● Future common module tools flatpak.2son ● Has flatpak-specific metadata ● &escri$es the runtime environment flatpak.json { "id": "org.gnome.eog", "runtime": "org.fedoraproject.Platform", "runtime-version": "26", "command": "eog", "tags": ["Viewer"], "finish-args": ["--filesystem=host", "--share=ipc", "--socket=x11", "--socket=wayland", "--socket=session-bus", "--filesystem=~/.config/dconf:ro", "--filesystem=xdg-run/dconf", "--talk-name=ca.desrt.dconf", "--env=DCONF_USER_CONFIG_DIR=.config/dconf"] } man 'latpak9$uild9'inis )ocal build $ mbs-build local $ flatpak-module create-flatpak -l eog:f26 \ --module eog --info flatpak.json [ prints path to org.gnome.eog.flatpak ] $ flatpak-install --user <path_to_bundle> $ flatpak run org.gnome.eog ;oji Build (in progress) $ fedpkg clone module/eog && cd eog $ mbs-build submit $ koji-containerbuild flatpak-build candidate \ git://pkgs.fedoraproject.org/module/eog#origin/master \ --git-branch=master –module=eog:master $ flatpak remote-add –registry \ fedora-candidate candidate-registry.fedoraproject.org $ flatpak install fedora-candidate org.gnome.eog $ flatpak run org.gnome.org #roject status ● /uilding modules wit pre'i,=/app Working ● )ayered Image Build Ser1ice support for Flatpak – atomic-reactor – osbs-client Working, unmerged – ko2i9containerbuild ● OCI "upport in docker registry 8e,isting patc : ● -,porting browsing in'o 'rom docker registry Needs to be written ● Installing 'latpaks 'rom a docker registry Questions? https%=='edorapro2ect.org/wiki=Workstation=Flatpaks ttps%==flatpak.org CFlatpakApps irc7'reenode.net:#flatpak irc7'reenode.net:#fedora-workstation .