Flatpak cannot invoke host's `podman` command

[krnhotwings]

What happened?
I tried installing and running this fork's flatpak from the 0.12.0 release, and it's unable to invoke the podman command. The error logs say that podman is not in $PATH. My configuration to get podman working in 0.7.0 flatpak is described here:

loft-sh#1869 (comment)

What did you expect to happen instead?
0.7.0 was able to invoke podman with the xdg-run/podman flatpak permission + passing in the socket. I'm not sure how it's invoked, but something changed between 0.7.0 and 0.12.0 such that my setup above no longer works.

How can we reproduce the bug? (as minimally and precisely as possible)
It's a lot of steps, but the link above describes the setup required.

Local Environment:

• DevPod Version: 0.12.0
• Operating System: linux
• ARCH of the OS: AMD64

DevPod Provider:

• Local/remote provider: docker

Anything else we need to know?
Running the latest stable image of Project Bluefin OS. I can post more specific details like log messages, etc. tomorrow. I'm just currently away from my work computer and am unable to provide more info.

Also, thank you for carrying the torch for this project!

[skevetter]

related #127

[skevetter]

For my knowledge, is there a reason driving the preference towards Flatpak versus the .deb package? As I understand, Flatpak applications are intended to be isolated runtime environments.

Notes:

• Flatpak Sandbox Permissions - Filesystem Access
• The xdg-run/path permission grants access to subdirectories of $XDG_RUNTIME_DIR/path (which expands to /run/user/$UID/path)
• For podman, this means --filesystem=xdg-run/podman grants access to /run/user/$UID/podman/podman.sock

Likely need to add this flag to the finish args. Uncertain on whether this would impact users without podman installed.

devpod/desktop/flatpak/sh.loft.devpod.yml

Lines 8 to 20 in d7226e6

	finish-args:
	- --socket=wayland # Permission needed to show the window
	- --socket=fallback-x11 # Permission needed to show the window
	- --device=dri # OpenGL, not necessary for all projects
	- --share=ipc
	- --share=network
	- --socket=ssh-auth
	- --socket=gpg-agent
	- --filesystem=home
	- --talk-name=org.freedesktop.Flatpak
	- --talk-name=org.freedesktop.Notifications
	- --talk-name=org.kde.StatusNotifierWatcher
	- --filesystem=xdg-run/keyring

[krnhotwings]

On conventional/traditional operating systems, deb/rpm installers write to system directories, pull in dependency packages, etc. Nowadays, however, there exists immutable operating systems where system files and directories cannot be written to. They're read-only and are atomic images very conceptually similiar to docker/OCI container images (and my understanding is that the technology is developing such that OCI images can be the operating system. Haven't read too much about it, though.)

Aside for sandboxing for security purposes, flatpaks provide a method of installing and running applications on immutable operating systems from specific writable directories. Another advantage (or disadvantage to some?) is that flatpaks allow the developer to package their application's dependencies into the flatpak rather than relying on the distro's package manager to pull in dependencies, so the developer wouldn't have to worry about supporting releases for, say, Ubuntu 20.04 vs 24.04, which may have different versions of whatever dependency packages.

Some immutable OS's include:

• Fedora Silverblue
• Bazzite
• Project Bluefin
• SteamOS

(Note: Sorry if I've provided any incorrect pieces of information; I'm merely a consumer and not a developer of these things. 😅 )