RED HAT ENTERPRISE LINUX

Desktop Software
with Flatpak

Install, Upgrade & Manage Apps from the Red Hat Ecosystem Catalog

CIS126RH | RHEL System Administration 1
Mesa Collunity College

Learning Objectives

Understand Flatpak architecture

Learn how Flatpak sandboxes and distributes applications

Configure Flatpak remotes

Set up the Red Hat Ecosystem Catalog and other repositories

Install and manage applications

Search, install, update, and remove Flatpak apps

Manage permissions and security

Control application access to system resources

What is Flatpak?

Flatpak is a framework for distributing desktop applications across Linux distributions in a sandboxed, distribution-agnostic format.

🔒 Sandboxed

Applications run isolated from the system with controlled access to resources

📦 Self-Contained

Includes dependencies, avoiding version conflicts with system libraries

🔄 Universal

Same package works across different Linux distributions

⚡ Delta Updates

Only downloads changed portions, saving bandwidth

Flatpak is a modern application distribution framework designed to solve several long-standing challenges in Linux software management. First, it provides sandboxing - applications run in isolation from the system and each other, with explicit permissions for accessing resources. This improves security significantly compared to traditional packages. Second, Flatpak apps are self-contained, bundling their dependencies in what's called a runtime. This means you won't have conflicts between what an app needs and what's installed on your system. Third, Flatpak is universal - the same package works on RHEL, Fedora, Ubuntu, and other distributions. This makes it easier for software vendors to support Linux. Finally, Flatpak uses delta updates, downloading only the parts that changed rather than entire packages. This is especially valuable for large applications. For enterprise environments, these features translate to better security, easier maintenance, and more flexible software deployment.

Flatpak Architecture

Flatpak Application
LibreOffice, Firefox, GIMP, etc.

↓ uses ↓

Runtime
org.freedesktop.Platform, org.gnome.Platform

↓ runs on ↓

Host System (RHEL)
Kernel, display server, audio, filesystem

Runtimes provide shared libraries (GTK, Qt, etc.) used by multiple apps, reducing disk usage and ensuring consistency.

Let's look at how Flatpak is architected. At the top layer, we have the Flatpak applications themselves - these are the programs you actually use, like LibreOffice, Firefox, or GIMP. Each application is packaged with its specific dependencies and runs in its own sandbox. The middle layer is the runtime. Runtimes provide a standardized set of shared libraries that applications can depend on. The most common are org.freedesktop.Platform, which provides basic libraries, and org.gnome.Platform, which adds GNOME-specific libraries like GTK. Multiple applications can share the same runtime, which saves disk space. When you install your first Flatpak app, you'll notice it downloads a runtime - subsequent apps using the same runtime won't need to download it again. At the bottom is your host system - RHEL in our case. The Flatpak system provides controlled access to host resources like the display server, audio system, and filesystem. This layered architecture is what enables Flatpak's security model and portability across distributions.

Installing Flatpak on RHEL

# Install Flatpak (RHEL 8/9)
sudo dnf install flatpak

# Verify installation
flatpak --version
Flatpak 1.12.8

# Check current remotes
flatpak remotes
Name    Options
rhel    system

✓ RHEL 9: Flatpak is included by default in RHEL 9 workstation installations with the Red Hat remote pre-configured.

System vs User: Flatpak can install apps system-wide (requires sudo) or per-user (in ~/.local/share/flatpak).

Let's start by installing Flatpak on RHEL. On RHEL 8 and 9, you simply use dnf to install the flatpak package. After installation, verify it's working by checking the version. RHEL 9 workstation installations actually come with Flatpak pre-installed and pre-configured with the Red Hat remote. You can check what remotes are configured using flatpak remotes. An important concept is the distinction between system and user installations. System installations, which require sudo, install apps for all users and store data in /var/lib/flatpak. User installations don't require root access and store everything under your home directory in ~/.local/share/flatpak. Most desktop users will use system installations, but user installations are useful in environments where you don't have administrator access. The --user flag switches commands to user mode.

Red Hat Ecosystem Catalog

The Red Hat Ecosystem Catalog provides curated, tested Flatpak applications that are supported for use on RHEL systems.

Benefits:

Applications tested with RHEL
Security updates from Red Hat
Enterprise support available
Signed packages for integrity

Available Apps Include:

LibreOffice productivity suite
Firefox web browser
GIMP image editor
And many more...

# The Red Hat remote is typically pre-configured
flatpak remotes
Name    Options
rhel    system,oci

The Red Hat Ecosystem Catalog is Red Hat's official repository of Flatpak applications. Unlike third-party repositories, applications in this catalog are tested for compatibility with RHEL and receive security updates through Red Hat's processes. This is important for enterprise environments where you need assurance that software has been validated and is supported. The catalog includes popular productivity applications like LibreOffice, web browsers like Firefox, creative tools like GIMP, and various utilities. The Red Hat remote is typically pre-configured on RHEL 9 workstation installations. You can verify it's present using flatpak remotes. The 'oci' in the options indicates it uses OCI container format, which is Red Hat's preferred distribution method. For production RHEL systems, using the Red Hat remote ensures you're getting applications that meet Red Hat's quality and security standards.

Managing Remotes

# List configured remotes
flatpak remotes --show-details

# Add Flathub remote (largest third-party repo)
flatpak remote-add --if-not-exists flathub \
  https://dl.flathub.org/repo/flathub.flatpakrepo

# Add remote for current user only
flatpak remote-add --user --if-not-exists flathub \
  https://dl.flathub.org/repo/flathub.flatpakrepo

# Remove a remote
flatpak remote-delete flathub

# Disable a remote temporarily
flatpak remote-modify --disable flathub

⚠ Enterprise Note: Third-party remotes like Flathub may not be approved for use in your organization. Always follow your security policies.

While the Red Hat remote provides the primary source for enterprise applications, you should understand how to manage remotes. The flatpak remotes command with --show-details gives complete information about each remote. To add a new remote, use flatpak remote-add. The --if-not-exists flag prevents errors if the remote is already configured. Flathub is the largest third-party Flatpak repository with thousands of applications, but it's important to note that these applications aren't vetted by Red Hat. In enterprise environments, you should check with your security team before adding third-party remotes. You can add remotes at the user level with --user if you don't have root access or want personal remotes separate from system-wide ones. To remove a remote, use remote-delete. If you need to temporarily disable a remote without removing it, use remote-modify with --disable. This can be useful for troubleshooting or temporarily restricting where applications come from.

Searching for Applications

# Search all configured remotes
flatpak search firefox
Name       Description                        Application ID              
Firefox    Fast, Private & Safe Web Browser   org.mozilla.firefox

# Search with more details
flatpak search --columns=all libreoffice

# List all available apps from a specific remote
flatpak remote-ls rhel --app

# Show app info before installing
flatpak remote-info rhel org.mozilla.firefox

Application IDs: Flatpak uses reverse-DNS naming (e.g., org.mozilla.firefox). You'll need this ID for install/run commands.

Before installing applications, you'll want to search for what's available. The flatpak search command searches all configured remotes for applications matching your query. The output shows the application name, description, and importantly, the Application ID. Flatpak uses reverse-DNS naming for application IDs - like org.mozilla.firefox for Firefox. You'll need this ID when installing or running applications. Use --columns=all to see more detailed search results including version numbers and remotes. The flatpak remote-ls command lists everything available from a specific remote. Add --app to show only applications, excluding runtimes. Before installing, you might want to see detailed information about an app using flatpak remote-info. This shows the version, required runtime, permissions, and download size. This is especially useful to understand what an application will have access to before you install it.

Installing Applications

# Install from default remote
flatpak install org.mozilla.firefox

# Install from specific remote
flatpak install rhel org.libreoffice.LibreOffice

# Install without prompts (scripting)
flatpak install -y rhel org.gimp.GIMP

# Install for current user only
flatpak install --user flathub org.videolan.VLC

# Install a specific version/branch
flatpak install rhel org.mozilla.firefox//stable

First Install: The first app you install will also download the required runtime. Subsequent apps using the same runtime won't need to re-download it.

Installing Flatpak applications is straightforward. The basic syntax is flatpak install followed by the application ID. If you have multiple remotes, Flatpak will ask which one to use, or you can specify the remote explicitly. For automated scripts or when you don't want confirmation prompts, use the -y flag. The --user flag installs to your home directory instead of system-wide, useful when you don't have root access. You can also specify a branch or version using the double-slash syntax. When you install your first Flatpak application, you'll notice it downloads a runtime - this can be several hundred megabytes. Don't be alarmed; this is normal and only happens once. Future applications that use the same runtime will share it. The install command shows you exactly what will be downloaded and installed, including any dependencies, before proceeding. Always review this information, especially in production environments.

Running Applications

# Run an installed application
flatpak run org.mozilla.firefox

# Run with environment variable
flatpak run --env=GTK_THEME=Adwaita:dark org.gimp.GIMP

# Run specific version
flatpak run org.mozilla.firefox//stable

# Run with additional permissions
flatpak run --filesystem=/media org.videolan.VLC

Desktop Integration:

Flatpak apps appear in your application menu automatically and can be launched like any other app.

Command-Line Launch:

flatpak run is useful for troubleshooting, passing options, or running in scripts.

Once installed, Flatpak applications integrate with your desktop environment. They appear in your application menu and can be launched normally by clicking their icon. However, you can also run them from the command line using flatpak run followed by the application ID. This is useful for troubleshooting or when you need to pass special options. You can set environment variables for the application using --env. This is helpful for things like forcing a dark theme or setting application-specific variables. The run command also lets you grant additional permissions temporarily using flags like --filesystem to give access to specific directories. This is a one-time override that doesn't change the app's permanent permissions. Understanding both graphical and command-line launching is important because sometimes you'll need to troubleshoot why an app isn't working, and seeing its console output requires launching it from a terminal.

Updating Applications

# Update all installed applications
flatpak update

# Update a specific application
flatpak update org.mozilla.firefox

# Update without prompts
flatpak update -y

# Check what would be updated (dry run)
flatpak update --no-deploy

# Update user installations only
flatpak update --user

Automatic Updates: GNOME Software can automatically update Flatpak apps. Check Settings → Software Updates for options.

✓ Delta Updates: Flatpak only downloads changed data, making updates fast and bandwidth-efficient.

Keeping applications updated is crucial for security, and Flatpak makes this easy. The flatpak update command without arguments checks and updates all installed applications and runtimes. You can also update specific applications by providing their ID. Like install, use -y to skip confirmation prompts for scripted updates. The --no-deploy flag performs a dry run, showing what would be updated without actually making changes. This is useful for checking if updates are available before committing to them. On RHEL with GNOME, the Software application can handle Flatpak updates graphically and even automatically. Check your system settings for automatic update options. One of Flatpak's advantages is delta updates - it only downloads the parts of an application that have changed, not the entire package. This means even large applications update quickly after the initial install. For enterprise environments, you might want to test updates before deploying them widely.

Managing Installed Apps

# List all installed applications
flatpak list --app
Name          Application ID              Version   Branch  Origin
Firefox       org.mozilla.firefox         120.0     stable  rhel
LibreOffice   org.libreoffice.LibreOffice 7.6.3     stable  rhel

# List installed runtimes too
flatpak list --runtime

# Show detailed info about installed app
flatpak info org.mozilla.firefox

# Show disk usage
flatpak list --app --columns=name,size

# Find unused runtimes
flatpak uninstall --unused

Managing installed applications is a key administrative task. The flatpak list command shows what's installed. Use --app to show only applications, or --runtime to see the underlying runtimes. The output shows the application name, ID, version, branch, and which remote it came from. For detailed information about a specific app, use flatpak info. This shows everything from the installed version to the permissions it has. You can customize the list output with --columns to show specific information like disk space usage - useful when you need to free up space. Over time, you may accumulate unused runtimes - old versions that no apps need anymore. The flatpak uninstall --unused command finds and removes these orphaned runtimes, reclaiming disk space. This is good housekeeping to run periodically, especially after removing applications or updating runtimes.

Removing Applications

# Remove an application
flatpak uninstall org.gimp.GIMP

# Remove and delete app data
flatpak uninstall --delete-data org.gimp.GIMP

# Remove without prompts
flatpak uninstall -y org.videolan.VLC

# Remove unused runtimes (cleanup)
flatpak uninstall --unused

# Remove all from a specific remote
flatpak uninstall --all --from=flathub

⚠ Data Persistence: By default, uninstall keeps application data (~/.var/app/). Use --delete-data to remove everything.

Removing applications is just as important as installing them. The basic uninstall command removes an application but preserves its data by default. This data is stored in ~/.var/app/ under the application ID. If you want a complete removal, add --delete-data to remove the configuration and data files as well. Use -y for unattended removal in scripts. An important maintenance task is cleaning up unused runtimes with --unused. When you remove an application, its runtime might become orphaned if no other apps use it. Running uninstall --unused periodically keeps your system clean. If you've added a third-party remote and want to remove everything from it, you can use --all --from=remotename. This is useful if you decide to stop using a particular remote and want to clean up all associated applications. Always be careful with --delete-data as it removes all application settings and saved data permanently.

Permissions & Security

# View app permissions
flatpak info --show-permissions org.mozilla.firefox

# Override permissions (grant filesystem access)
flatpak override --filesystem=/mnt/data org.videolan.VLC

# Override for user only
flatpak override --user --filesystem=home org.gimp.GIMP

# Remove an override
flatpak override --reset org.videolan.VLC

# List current overrides
flatpak override --show org.mozilla.firefox

Common Permissions: --filesystem, --device, --socket, --share=network

One of Flatpak's key security features is its permission system. Applications run sandboxed and must request access to system resources. You can view an app's permissions using flatpak info --show-permissions. This shows what the app can access - filesystems, devices, network, and more. Sometimes an app needs additional permissions not in its defaults. Use flatpak override to grant or revoke permissions. For example, if a media player needs to access files on a mounted drive, you can grant filesystem access to that path. Overrides can be system-wide or per-user with --user. To see what overrides are currently in place, use override --show. If you want to return to the application's default permissions, use override --reset. For graphical permission management, consider installing Flatseal, which provides a user-friendly interface for managing Flatpak permissions. Understanding this permission model is important for both security hardening and troubleshooting applications that can't access needed resources.

Flatpak vs RPM

Aspect	Flatpak	RPM (dnf)
Sandboxing	Yes, by default	No (full system access)
Dependencies	Bundled in runtimes	Shared system libraries
Updates	Independent of OS	Tied to OS version
Root required	Optional (--user)	Yes (system packages)
Best for	Desktop applications	System tools, servers, CLI

Recommendation: Use RPM for system software and CLI tools. Use Flatpak for desktop applications where sandboxing and latest versions are beneficial.

It's important to understand when to use Flatpak versus traditional RPM packages. Flatpak provides sandboxing by default, improving security for desktop apps. RPM packages have full system access unless additional confinement like SELinux is applied. Dependencies work differently - Flatpak bundles dependencies in runtimes, while RPM uses shared system libraries. This means Flatpak apps can have newer library versions than your base OS provides. Flatpak apps update independently of the OS release cycle, so you can get the latest Firefox even on an older RHEL version. RPM packages are tied to your OS version. Flatpak allows user installations without root, which is useful in managed environments. However, RPM remains the right choice for system software, command-line tools, servers, and anything that needs deep system integration. Desktop applications like browsers, office suites, and creative tools are ideal Flatpak candidates. In practice, most RHEL systems use both - RPM for the base system and Flatpak for user-facing applications.

Key Takeaways

Flatpak provides sandboxed, distribution-agnostic desktop applications

The Red Hat Ecosystem Catalog offers tested, supported apps for RHEL

Key commands: search install update list uninstall

Use override to manage application permissions and access

Let's summarize what we've learned. Flatpak is a modern application distribution system that provides sandboxed, self-contained applications that work across Linux distributions. It's ideal for desktop software where security isolation and access to the latest versions are important. The Red Hat Ecosystem Catalog is Red Hat's curated repository of Flatpak applications that are tested and supported for RHEL. Using this catalog ensures compatibility and gives you access to Red Hat's support resources. The core commands you need to remember are: flatpak search to find apps, install to add them, update to keep them current, list to see what's installed, and uninstall to remove them. The override command lets you fine-tune application permissions when needed. Any questions before we move to the lab?

Graded Lab

Install Firefox and LibreOffice from the Red Hat remote
Search for and compare applications across remotes
Practice updating and managing installed applications
Examine and modify permissions for an installed app
Clean up unused runtimes with flatpak uninstall --unused

Next: Accessing Removable Media