Finally Embracing Flatpak
I know, I'm late as fuck to the party.
The thing is, I'm not a fan of Flatpak, or Snap, or even Dockerizing things for the sake of using containers. I like to stick as close to the system's package manager as possible.
This is why I like Arch Linux and more specifically the AUR (Arch User Repository).
Having access to any and everything I ever could need, from my system's native package manager is great. Without the AUR running Arch is effectively same shit, different package manager compared to running any other Linux distribution.
I used to use Arch, BTW
While this isn't secretly a post bashing Arch Linux, I do need to touch on how it's been failing me as of late. I'm partially to blame as I'm running it on a pretty dated system (XPS 15 from 2019) which reminded me of this gem of a post from a dozen or so years ago.
Recent issues I've faced that have really ground my gears include:
- Boot partition that's served me well for years getting filled up
- Feeling more and more RAM starved even though I still run the same few apps
- More frequent encounters with abandoned packages
- Way too frequent "this package replaces that package" notices
- Fucking Qt and/or Electron apps needing hours to update
- RAM starved updates locking me up to the point of no return
These are all technical issues, all of which will be remedied with a new desktop rig I have coming in the first week of the year. Easy peasy.
Now I'm not saying Arch has gotten any worse recently. I'd argue that the exact opposite is true, as I barely ever seem to blog about weird crap Arch has done to me lately these days. That's a good thing.
My trust in the AUR is waning
So what hasn't been easy peasy for me to get over, is my growing anxiety around security. It's felt like every other day a few times this year where there was some major incident with packages. Meanwhile I'm over here trusting that the AUR is largely free of bad actors.
If you have the time to review every PKGBUILD file for the 100+ updates a week, good for you. I just want to wrangle code and push pixels and have the system do it's thing.
I'm also not saying the AUR is insecure, but I am saying incidents are feeling more and more inevitable as the frequency of them increases. I'm also unsure if the Arch community has anything in place to make sure shoddy genAI slop isn't making it into the AUR. Maybe they do, but a quick search didn't yield anything.
All roads lead back to Debian
I had a buddy years ago tell me that I'll eventually be back on Debian.
Not only was he right, he's been right quite a few times now. I make this switch every few years, usually around the time of a new Debian release. Trixie (Debian 13) dropped this year, so it was about time.
I also have been running Debian on my servers exclusively for some time now. Debian is stable, and stable is good.
That is, until it isn't. Usually after switching to Debian, all will be well and then I'll see the shiny new GNOME release and I'll bounce my ass back into the loving arms of Arch Linux.
That's assuming I didn't bail sooner because I was sick of trying to get some
package installed via apt. This insistence on doing "all the things" with my
distro's package manager has led me to Flatpak.
Switching my mental model
If I strip away the AUR from Arch, Debian ends up being the package leader. This is great, except that Debian's official repository lacks some critical software I use, in addition to packages being outdated if I choose to stay on stable.
This is where Flatpak comes in, effectively utilizing it as a gap fill for when the official Debian repository can't provide me with the version I want or need or when the package doesn't exist at all.
No more wondering if the Ubuntu flavored DEB file is going to work. No more
adding an apt source only to find out it doesn't support the latest stable
release. No more compiling from source.
My security anxiety still exists, but limiting myself to using packages from Flathub, and the fact that apps are sandboxed, I feel a bit more at ease.
Yeah, but isn't Flatpak dead?
As mentioned, I'm very late to the party on this one. If I had made this decision at the top of the year, it would have seemed like a bad one. Fast forward to today, it's seeming like things are in a better place.
With all that said, this decision is less about Flatpak and more about my shift in ideology. While I wouldn't touch Snaps cause of Canonical, I'm not ruling out jumping on a different / better technology if it presents itself.
I'm aware of other options out there, but since Debian actually has a page about Flatpak, it was the logical choice at the moment.