Flatpak 1.18.1

Flatpak decouples applications from the distribution underneath them. An app is built once against a runtime and runs identically on Debian, Fedora, and Arch, sandboxed from the host filesystem by default and granted access through portals when it needs a file, a camera, or the network.

Update this one promptly

Version 1.18.1 is a security release fixing ten CVEs, including full sandbox escapes and paths to arbitrary root privilege escalation. Sandbox escapes matter more in Flatpak than in most software, because the sandbox is the entire value proposition. Check what you are running and update:

flatpak --version
sudo apt update && sudo apt upgrade flatpak   # or your distro's equivalent

Everyday use

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo
flatpak install flathub org.gimp.GIMP
flatpak update
flatpak list --app

Flathub is the de facto application repository, and adding it is effectively a required setup step on distributions that do not preconfigure it.

The tradeoffs

Runtimes are shared between applications, so disk usage is less alarming than the first install suggests, but it is still higher than native packages. Theming integration has historically been imperfect, and sandboxed apps sometimes need explicit permission adjustments (Flatseal is the usual tool) to reach directories you expect them to reach. In exchange you get current application versions on stable distributions, and a security boundary that native packages simply do not have.

Versus Snap and AppImage

Snap is Canonical’s equivalent with a proprietary backend store; AppImage is a single portable file with no sandbox or update mechanism by default. Flatpak sits between them: an open ecosystem with real sandboxing and a working update path.

Verify Your Download

Release tarballs and signatures are published on GitHub; most users should install through their distribution’s packages instead.