Slimpack

My shot at creating a lighter flatpak client with (almost) no containerization of the applications.

Why?

Some might be big proponents of the whole isolation thing, but I believe that only works in theory with simple apps, as anyone who has tried to get anything running under flatpak can tell you. In my humble opinion, isolation offers too little security benefits for the heaps of problems it creates - yet again, we are solving a problem that really wasn't a problem. To be more precise, the following are some major issues with flatpak, which isolation creates:

• You need to do a lot of fiddling before you get the themes right
• Basic UI features (like drag-n-drop) just don't work
• You get mysterious "file doesn't exist" errors
• Flatpak just straight up installs 3 other distros to run your apps, which takes up A LOT of space
• Apps usually come with enough permissions to be unsafe, but not enough permissions to work properly, partially due to laziness and the shitty permission system flatpaks have
• The CLI is TREMENDOUSLY bad

However, flatpak did one thing - it created a network. If you want to publish an application, probably the easiest way to do so is to do it using flatpak. This has resulted in a lot of apps being published exclusively for flatpak. However, we don't have to deal with this whole debacle, as we can just create and use an alternative client that just runs the apps, but outside of their designated containers. At the end of the day, we are still distributing files, just with some permissions metadata sprinkled in.

This project aims to do just that - be the minimalistic client that allows you to just run the darn flatpak app, without having to fiddle with flatseal for 2 hours.

Why not?

This project is VERY early stage. You are expected to know what you're doing, and you will brick your system if you don't. At the very least, you are expected to take a quick look trough the code. The whole process of running an app using this client is very manual, but will improve in the future, to a point where you can just integrate it into discover or another client of your choosing.

How?

Since the flagship flatpak client needs to download the apps from a repository, we can do that too. In short, this project implements a simple OSTree client (without all the BS the flagship client comes with) that can successfully list the remote refs (apps) and download any given app (and its metadata).

The other big (and not yet implemented) part of the project is the actual repacking of the app. In short, each app has dependencies and a specific runtime it demands to be present. The original flatpak client will 1. download the runtime (for all intents and purposes a distro) and 2. download all the dependencies it has. This client in stark contrast will only download the dependencies and PRAY to the lords that the correct runtime libraries are already present on the host.

The last thing this project does is create a light container around the application, so that the application-specific dependencies and the app itself can be layered on top of the existing system. Now, don't be mistaken, I'm not doing this because it's the most minimalistic way to do it, but because flatpak basically REQUIRES this architecture. However, the container won't isolate the container any further. In the future, a more configurable isolation might be created, but for the moment, I'm trying to achieve the bare minimum.

Usage

First of all, you need to build the project. This is done via the make command. You will need lua 5.4, curl, zlib and some sort of cc installed. The executable will be dst/slimpack.

TODO: add actual usage when the tool is done lol