How to manage Flatpak packages conveniently and securely on Linux

If you use Linux daily, sooner or later you'll run into the Flatpak packages and their unique way of managing themThey don't work the same way as typical .deb or .rpm files, and although they may seem a bit intimidating at first, they actually offer a lot of advantages in terms of compatibility, isolation, and security.

In this article we will see How to manage Flatpak packages easilyboth from the terminal and with specialized graphical tools such as Warehouse o Flat SealThe idea is that you finish reading with the feeling of having the subject under your control, without fear of breaking anything and knowing exactly what each command and each option does.

What is Flatpak and why is it worth using?

Flatpak is an application distribution system for Linux designed primarily for desktop programs, which seek something similar to what the apps en Android: package everything necessary so that each application works independently of the base system.

Unlike classic package managers, Flatpak runs applications in an isolated environment or “sandbox”Thanks to this, the software is much more separated from the operating system, the risk of an app breaking something critical is reduced, and stricter permission policies can be applied by leveraging the XDG Desktop Portals.

One of its key features is that Use shared runtime environments or runtimesInstead of each package carrying all the duplicate libraries, many apps share a common base, such as org.freedesktop.Platform, org.gnome.Platform o org.kde.PlatformThis saves space and ensures that updates to these runtimes benefit all applications that use them.

Furthermore, Flatpak does not depend on a daemon always running in the backgroundIt only runs when something needs to be installed, updated, or launched, making it a very lightweight solution. Importantly, it allows you to install user-level applications without requiring superuser privileges, which is very useful in shared environments or when you don't want to modify the system too much.

To make matters worse, we're talking about an ecosystem decentralized and openThere isn't a single company controlling everything: anyone can set up their own repository (the famous "remote" repositories), although by far the most popular is Flatub, which has become the nerve center for obtaining updated Flatpak applications.

Flatpak versus APT and Snap: practical differences

In distributions like Ubuntu, several package management systems coexist. APT handles the classic .deb files of the system, Snap also works with universal packages Flatpak focuses on the desktop with its own philosophy. Knowing how they differ helps you choose wisely in each case.

With Flatpak, tasks like search, install, list, update, or remove applications They are done with commands like this:

• Search: flatpak search palabra_clave
• Install: flatpak install flathub app.id
• List apps: flatpak list --app
• See info: flatpak info app.id
• Update all: flatpak update
• Delete app: flatpak uninstall app.id
• Clean up residue: flatpak uninstall --unused

Compared, APT uses commands like apt search, sudo apt install o sudo apt autoremove, and Snap resorts to snap find, sudo snap install o sudo snap refreshEach system has its advantages: APT is ideal for the system itself and shared libraries; Snap emphasizes automatic updates and cross-version compatibility; Flatpak feels more natural for... modern desktop applications with detailed permissions.

In terms of features, Flatpak offers strong sandboxing, user installations without root, Boot Fast and medium package sizes (generally larger than a .deb, but smaller than many snaps). It doesn't force automatic updates, so you decide when you want to update your app collection.

Install Flatpak on your Linux distribution

Before anything can be managed, it's necessary to make sure that Flatpak is installed and properly configured on your system. In many modern distributions it comes pre-installed, but in others you have to use a classic package manager to get it ready.

In Debian and Ubuntu-based systems, it is common to use APT for installing Flatpak supportIn recent versions of Ubuntu, simply install the corresponding package from the official repositories and, if you want integration with the graphics store, add the corresponding plugin. The typical Ubuntu installation guide usually includes this step as part of the setup process.

In other distributions such as FedoraFlatpak support is usually enabled from several versions ago, so in many cases you'll just need to Add Flathub remote and start installing software. Arch Linux resorts to pacman to install the package flatpakWhereas in openSUSE o Linux Mint The official repositories also include Flatpak and, in the case of Mint, it integrates quite well with the software's graphical manager.

If you want to get down to specifics, The installation process from the terminal in many distros involves something like this::

• sudo apt install flatpak on Ubuntu or Debian type systems
• sudo yum install flatpak in distros that still use yum or dnf
• sudo pacman -S flatpak in Arch and derivatives

Once the engine is installed, It is essential to add Flathub as a remote To access most applications, you can use:

flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo

After that, You can check that everything is correct. executing commands like flatpak --version or listing the available remotes with flatpak remotesIf Flathub appears in the list, you're ready to start installing applications.

Basic Flatpak architecture: runtimes, IDs, and remotes

To properly manage Flatpak packages, it's helpful to understand a little bit. how it internally organizes the applicationsThere's no need to go crazy, but having a few concepts clear can save you from surprises and confusion.

First of all there are the runtimes or shared execution environmentsThese are sets of common libraries and components that multiple applications use, reducing duplication. Among the most common ones you'll find:

• org.freedesktop.Platform, which acts as a generic base with the essential libraries
• org.gnome.Platform, geared towards applications created for the GNOME desktop environment
• org.kde.Platformintended for KDE/Qt-based software
• org.freedesktop.SdkDesigned for development, with extra tools and libraries

Each Flatpak application has a identifier in reverse DNS formatThis might seem a bit long, but it's very clear. Typical examples would be org.gimp.GIMP, org.mozilla.Firefox, com.visualstudio.code o io.github.flattool.WarehouseThis ID is the one you will use in most installation, execution, and uninstallation commands.

Then there are the branches and versionsThese features allow you to differentiate between stable, beta, and nightly channels. Many remotes provide alternative branches for testing new versions without affecting the stable branch. In practice, when you install from Flathub, you usually end up with the stable branch by default, but you can specify another one if the developer offers it.

Finally, the remote or repositories These are the sources from which we obtain applications and runtimes. Flathub dominates the scene, but there are also remote repositories like GNOME Nightly, KDE, Fedora, and Flathub Beta, as well as private repositories that you can add manually.

Essential commands for managing Flatpak packages

Beyond the graphical tools, the terminal remains the most direct and transparent way to manage FlatpakWith just a few commands, you can cover virtually the entire lifecycle of an application.

If you would like to search for available applications In Flathub, from the console, you can use:

flatpak search nombredelpaquete

Once you find the application you're interested in, you'll see its Application ID and remote From which it can be installed. With that information, you can now proceed with the actual installation.

To There are two main ways to install Flatpak packages.. One downloads a file .flatpakref From the application's official website (for example, from Opera's page on Flathub), simply navigate to the download directory and run:

flatpak install com.opera.Opera.flatpakref

The other way is install from remoteThis is very common with Flathub. In this case, the typical command would be:

flatpak install flathub com.opera.Opera

In both cases, During the installation process, you can choose whether you want to install the application at the system level or only for your user account.When you choose the system level, the files are stored in /var/lib/flatpak/app and the app becomes available to all users. If you choose user installation, the path will be ~/.local/share/flatpak/app And only you will see that application.

On a practical level, the system installation Save space when multiple users share the same appsThe user version offers more privacy and flexibility, especially if you want to try things out without touching the rest of the system.

To update Flatpak applicationsThe simplest way is to run:

flatpak update

If you prefer Force the update only for your userYou can use something like:

flatpak update --user

There is also the possibility of update a specific application indicating your ID, or even using the alias flatpak upgradewhich does exactly the same thing as update.

As for the run already installed applicationsYou have the usual option of the desktop applications menu, but you can also use the console with:

flatpak run nombredelpaquete

If what you want is See what you have installed, the command is:

flatpak list

And if you need specific details of an applicationFor information such as size, origin, permissions, and more, you can use:

flatpak info nombredelpaquete

To uninstall a specific appThe typical command is:

flatpak uninstall nombredelpaquete

And when you want to do a general cleaning of runtimes and components that are no longer used by any applicationHis thing is throwing:

flatpak uninstall --unused

These commands They cover practically everything an average user needs. to defend yourself with Flatpak from the terminal, without the need for external tools, although as we will see shortly there are some really convenient graphical utilities.

Permissions, sandboxing, and advanced management with Flatseal

One of Flatpak's greatest strengths is its granular permit modelwhich allows you to decide exactly what each application can do: which folders in the file system it sees, whether it accesses the network, which physical devices it can use, etc.

All of this is based on the XDG Desktop PortalsA series of standard interfaces act as intermediaries between the standalone app and the system. Instead of granting direct access, the application requests permission from the portal, which is responsible for presenting dialogs to the user (for example, a file selector) and enforcing restrictions.

There are different types of portals, including those intended for file selection, printing, screen capture and recording, notifications, access to devices such as camera and microphone, geolocation, and network connectivityEach application declares what it needs, and the system decides how to respond.

At the command line level, permissions are expressed with options such as --filesystem=home o --filesystem=host for access to the file system, --device=dri o --device=all for devices, --socket=x11, --socket=wayland o --socket=pulseaudio for graphics and audio sockets, and parameters such as --share=network o --share=ipc to control the network and communication between processes.

If you don't want to struggle with all this syntax, you can use Flatseal, a graphical tool focused on managing Flatpak application permissionsIt installs like any other app from Flathub and presents you with a list of applications with all their permissions neatly organized.

With Flatseal you can activate or deactivate specific permissions with a simple switchSee at a glance what each program is using, reset permissions to default values ​​if you've been tinkering with them, or simply check out how the most sensitive apps are configured. It's ideal for anyone who wants fine-tuned security control without having to remember complicated settings.

Warehouse: the graphic Swiss Army knife for your Flatpak

Beyond Flatseal, which focuses primarily on permissions, there is a tool that has carved out its own niche among Flatpak users: Warehouse, a GUI designed specifically to manage applications in this format, without distractions or irrelevant functions.

Warehouse is a Flatpak application with interface very much in the style of GNOMEMinimalist and clean, yet packed with a massive amount of features to control everything related to your packages. It's not meant to be a typical app store, but rather a clear, lightweight, and fast toolbox.

As soon as you open it, you find a list of all installed Flatpak applicationsOn the left are the names of the programs, and on the right you have information icons and context menus where the most important actions are concentrated: opening the application, uninstalling it, deleting user data, disabling updates, or managing snapshots, among other things.

The information section is quite comprehensive: Warehouse displays the size of the user data, the runtime used by the application, the full ID, the version, the origin, and the total package size. and other useful details. This lets you know which apps are bloating up your user folder or which runtimes you should purge if nobody needs them anymore.

One of the functions that shines brightest in Warehouse is the management of snapshots of user dataYou can create copies of the settings for one or more applications and then restore them on the same computer or a different one, which is great for migrating settings without going crazy looking for hidden folders. Although the option to "export" these snapshots to move them between machines doesn't appear as a direct function in the menu, it's relatively easy to locate these files and use them as backups.

In the upper right part of the interface you will see a checkmark that allows you to select multiple apps at onceFrom there you can apply batch actions, such as creating snapshots, deleting user data in bulk, or uninstalling multiple applications at once, which greatly speeds up maintenance when you've been accumulating software for a long time.

Next to this brand name appears a three-dot menu that provides access to global options, such as managing leftover data (remnants of configurations from already deleted applications), managing remotes or Flatpak stores, installing from a file .flatpakref or even launch installations from the web, integrating with Flathub and other repositories.

Warehouse also features Advanced features such as changing the version of a Flatpak to revert an update, fix runtimes or mask packages to prevent them from being updated, filter packages to quickly find what you're looking for, view current user data and remove unused remnants, add popular repositories with one click or add custom remotes when you need to.

To complete the picture, the interface is adaptable to large and small screensAnd because it doesn't carry unnecessary dependencies, it's noticeably faster compared to generic stores like GNOME Software or Discover, which try to cover too many formats at once.

In distros like DeepinWhere Flatpak plays a key role in application installation, Warehouse has become practically an indispensable tool. Once you have Flatpak up and running, you can install it with:

flatpak install flathub io.github.flattool.Warehouse

And if you want without restarting the user session, enough with:

flatpak run io.github.flattool.Warehouse

In general, Warehouse is the ideal option for those already familiar with Flatpak and they only need a clear and refined interface to manage it without depending on the terminal, but maintaining a level of control far superior to that of a simple "app store".

Advanced data management, backups, and performance in Flatpak

Beyond basic installation and uninstallation, Flatpak offers Powerful tools for managing user data, exporting applications, and optimizing disk spaceThis becomes key when you start accumulating software and runtimes.

Because each Flatpak application is relatively isolated, It is possible to apply fairly aggressive cleaning measures without fear of breaking the operating system.However, it's important to be aware that personal data in apps (settings, profiles, etc.) is, in many cases, more valuable than the system itself, so it's wise to carefully review what you delete.

Warehouse makes this task much easier by Allow deleting user data individually or in batchesas well as managing "leftover data" from uninstalled apps. It also lets you reinstall apps, clearly specifying which old settings will be reused, or start from scratch if you prefer.

For those who prefer the terminal, commands like flatpak uninstall --unused help to Remove runtimes and dependencies that are no longer neededAdditionally, you can export applications or back up entire installations using the advanced CLI options, which is useful in environments where you need to replicate the same set of programs across multiple machines.

In terms of performance, there are several best practices: Use Wayland instead of XWayland whenever possible To improve startup and integration, grant the permissions the application needs in advance to avoid overloading portals, try to use native runtimes for the desktop you use (GNOME apps in GNOME, KDE in KDE), and be cautious when relaxing the sandboxing of very sensitive applications.

For updates, a fairly effective option is Schedule recurring tasks using systemd timers or cron that they execute flatpak update in a controlled manner, for example once a week. This way you keep the applications up to date without having to constantly monitor them or depend on a daemon that takes care of it in the background without warning.

In terms of general security, Flatpak benefits greatly from several simple practices: Install only from trusted remotes like FlathubReview important permissions before installing or at least the first time you run an app, keep runtimes and applications reasonably up to date, and uninstall software you no longer use to reduce the attack surface.

Flatpak management from the terminal: a quick guide

For those who enjoy the power of the console, it's good to have A short cheat sheet with the most commonly used commands when managing FlatpakWith this, you can completely do without GUIs if you want.

If you would like to search for applications on Flathub without leaving the terminal:

flatpak search nombredelpaquete

To install apps from Flathub, specifying the remote and the app ID:

flatpak install flathub nombredelpaquete

If what you need is uninstall a specific app:

flatpak uninstall nombredelpaquete

Anytime clean all components that are no longer in use, including orphaned runtimes:

flatpak uninstall --unused

To update all installed applications and runtimes suddenly:

flatpak update

If you wish to launch an application directly with your Application ID:

flatpak run nombredelpaquete

When you need See everything you have installed, both apps and runtimes:

flatpak list

And if you are interested to know the details of a specific application (version, size, origin, effective permissions, etc.):

flatpak info nombredelpaquete

Keep in mind that many times It is necessary to use the full package namewhich usually follows the reverse DNS format and can be a bit long. It's probably the least comfortable part when you're starting out, but with There You get used to checking the correct ID from Flathub or with flatpak info.

If you also like searching for applications from your browser, remember that Flathub has a very convenient web search engineAnd if you use DuckDuckGo you can take advantage of the bang !flathub to go directly to the results within the store itself.

With all of the above, and combining terminal, Flatseal for permissions and Warehouse for advanced management, You have virtually everything you need to tame Flatpak packages on any modern Linux distributionEnjoying its advantages of isolation, compatibility and security without sacrificing a good user experience.