Hacker News Reader

Comment by yrro | Hacker News Reader

I am profoundly uninterested in a third-party package manager that does not provide any sandboxing features. xdg-app has them, but AppImage does not mention sandboxing on its web site or in its README.

View on HN

Well, first of all AppImageKit is not a package manager. For a comparison with xdg-app and other systems, see https://github.com/probonopd/AppImageKit/wiki/Similar-projec...

As for sandboxing, this is definitely an area which we would like to add to AppImageKit, e.g., see https://github.com/probonopd/AppImageKit/issues/77 - thoughts and pull requests welcome!

Why are you not using containers for sandboxing?

Probably just because I haven't had the time to investigate them yet. Can containers be used without the need for root access? Pull requests welcome.

I agree, sandboxing is a must-have feature. xdg-app has a system of runtime so it can run on any distro as long as you have installed the runtime needed by the app. Also GNOME and Papyros will have it while KDE seems interested in it also so it should have quite a lot of support.

xdg-app looks good, but I think we're still at least a couple of years away from the point where a developer can use xdg-app to reach the majority of desktop Linux users. That's a long time in software development terms.

You're surely right, but to me the important aspect is not only to make a package that run everywhere but also bring the mobile security scheme to desktop ie have apps that are sandboxed and run on top of a well-defined runtime with well-defined APIs. In that sense Xdg-Apps have a bigger mission that AppImage so maybe we can't really compare them

You can ship xdg-app + your app in the meantime? Consider it a 'polyfill'. Some best practices around this would be great.

Reply on news.ycombinator.com