Is there a benefit to using a portable package like Flatpak over a package installed through APT?
Posted: Tue Oct 09, 2018 10:06 am
In case you have not seen this Q&A re: Flatpak/snap/appimage and the like. Enjoy. :lipsrsealed: Be advised: I do NOT have a dog in this fight. This not authored by me. :lipsrsealed:
Debating-package-formats asks: Is there a benefit to using a portable package like Flatpak over a package installed through APT? (see original article here: https://distrowatch.com/weekly.php?issue=20181008#qa)
DistroWatch answers: When we use a traditional package manager, such as the APT utilities, DNF or pacman, we are almost always using them to pull in packages which were provided by our distribution's developers. These packages were built specifically for our distribution and are built to work with the libraries and components of our operating system. This allows the individual packages to be small as they do not need extra support or compatibility tricks to make them work.
Flatpak packages, and other portable formats such as Snap and AppImage, bundle their dependencies together in one spot. This allows the Flatpak/Snap/AppImage package to run on virtually any version of any distribution which has the required framework (such as Flatpak) installed. This means the Flatpak package will likely be a lot larger as it needs to carry around its dependencies, but it means we should be able to transfer the package to another distribution and still have it work.
In short, portability is one of the main benefits, but there are some others. Distributions typically only ship one version of an application or library in their repositories. Sometimes trying to install an alternative version will break things on the system. Since portable packages bundle their dependencies and are kept separate from the rest of the operating system we can install any version of a Flatpak we like without breaking anything. This is especially useful if we are running a conservative distribution (such as CentOS or Debian) while wanting to run the latest version of an application that is not in the official repositories.
In other words, portable packages allow us to uncouple the end user application from the rest of the operating system and use a newer (or older) version of an application without upgrading or downgrading the entire distribution.
There are some potential downsides to portable packages. Apart from the size issue mentioned above, there are concerns about whether a package maintainer is keeping up with the security fixes in all the bundled dependencies. Official distribution repositories usually keep up with the latest bug fixes in shared libraries, but Flatpak bundles will also need to be updated with bug fixes separately. Users are at the mercy of portable package publishers to keep up to date with security fixes in all of a Flatpak's dependencies.
Finally, there is a question of vetting new software. Distribution packagers usually perform some basic tests on software to confirm it does what it says it will and does not introduce security holes. Portable packages often come pre-built from upstream publishers and the end-user must trust that the package behaves as expected without the benefit of any auditing.
Personally, I prefer to use the package provided by my distribution and only use a portable package if there is no suitable version available through the default software manager.
Debating-package-formats asks: Is there a benefit to using a portable package like Flatpak over a package installed through APT? (see original article here: https://distrowatch.com/weekly.php?issue=20181008#qa)
DistroWatch answers: When we use a traditional package manager, such as the APT utilities, DNF or pacman, we are almost always using them to pull in packages which were provided by our distribution's developers. These packages were built specifically for our distribution and are built to work with the libraries and components of our operating system. This allows the individual packages to be small as they do not need extra support or compatibility tricks to make them work.
Flatpak packages, and other portable formats such as Snap and AppImage, bundle their dependencies together in one spot. This allows the Flatpak/Snap/AppImage package to run on virtually any version of any distribution which has the required framework (such as Flatpak) installed. This means the Flatpak package will likely be a lot larger as it needs to carry around its dependencies, but it means we should be able to transfer the package to another distribution and still have it work.
In short, portability is one of the main benefits, but there are some others. Distributions typically only ship one version of an application or library in their repositories. Sometimes trying to install an alternative version will break things on the system. Since portable packages bundle their dependencies and are kept separate from the rest of the operating system we can install any version of a Flatpak we like without breaking anything. This is especially useful if we are running a conservative distribution (such as CentOS or Debian) while wanting to run the latest version of an application that is not in the official repositories.
In other words, portable packages allow us to uncouple the end user application from the rest of the operating system and use a newer (or older) version of an application without upgrading or downgrading the entire distribution.
There are some potential downsides to portable packages. Apart from the size issue mentioned above, there are concerns about whether a package maintainer is keeping up with the security fixes in all the bundled dependencies. Official distribution repositories usually keep up with the latest bug fixes in shared libraries, but Flatpak bundles will also need to be updated with bug fixes separately. Users are at the mercy of portable package publishers to keep up to date with security fixes in all of a Flatpak's dependencies.
Finally, there is a question of vetting new software. Distribution packagers usually perform some basic tests on software to confirm it does what it says it will and does not introduce security holes. Portable packages often come pre-built from upstream publishers and the end-user must trust that the package behaves as expected without the benefit of any auditing.
Personally, I prefer to use the package provided by my distribution and only use a portable package if there is no suitable version available through the default software manager.
