The VS Code Flatpak is useless

If I need VS Code, I reach for VSCodium. https://vscodium.com/

I guess you can't really blame VSCode for this, but the flatpak system in general, if it doesn't allow normal filesystem access.

That said...

   > There is a philosophical argument that you should avoid VS Code because it is controlled by Microsoft [...]

is to me not a mere philosophical argument, but one of harsh practical reality. Your team uses vscode, your boss might think MS actually cares about developers instead of using them as a means to an end (selling shit to the c suite)... Just say no. GoLand is the better IDE anyway.

On the subject of containers for security:

I’ve been learning Mac app development for fun and one interesting part to me is that apps by default can only read and write files inside a “app sandbox” in ~/Library/Containers/com.your.app.Name

But the process to request access to files is totally seamless to the user. If you present an “open” or “save” dialog, they can pick any file or directory and the system returns a URL object with a capability attached that allows R/W access to that URL. Then you need to save the URL+Capability in app storage if you want to access the file or directory again without prompting.

The system will also pop up authorization dialogs if you use syscalls to look around at the desktop, etc saying “AppName is requesting access to the desktop” etc. For those grants to well-known paths I don’t think you need to explicitly save a capability; the “App Sandbox” is seamlessly extended.

I haven’t needed to interact much with $PATH and subprocesses but it seems like you can spawn subprocesses from $PATH, and they inherit the app container permissions.

I looked at Flatpak and it seems like they do a similar thing with file open dialogs seamlessly granting access, but maybe totally ban executing process paths outside the flatpak container? Or maybe flatpak always runs in a chroot which makes it awkward to make subprocess spawns work because the subprocess would have unexpected stuff where it expects to find its support files?

I don’t think VS Code is a sandbox app on Mac either but I wonder if it’s more workable than Flatpak

It's indeed an inconvenience with developing with Flatpak, but assuming someone still wants to do it, here's what one can do to make it practical (as far as it can be):

Get your development tools as a flatpak runtime extensions

Try to do everything inside the flatpak'ed tool (so e.g. with VSCode, use the terminal built in it, rather than a separate one)

If you need some tooling from the host, you can bind-mount them in. Just note that they probably have to be somewhere outside /usr because that's where Flatpak mounts its usual runtime

You can't fix the problems they're talking about with Flatseal?

Most tools that benefit from your current environment are lacking in flatpak. Basically any IDE is going to feel awful without the proper tools. I can't run c++ in CLion without the proper tools, and good luck installing them.