Flatpak runs desktop apps inside a sandbox, a boundary that limits what each app can access on the host system. For one selected file, a portal can grant access to that item; for ongoing access, a narrowly scoped filesystem permission is the better fit. App data and Flatpak installations also live in different places.
Flatpak’s default boundary
By default, an app can access its runtime, its own files, its own ~/.var/app/$FLATPAK_ID directory, and its own runtime directory. Only the app-specific data and runtime directories are writable. Network and device-node access are denied by default, while process and D-Bus access is limited. Flatpak’s sandbox documentation describes these boundaries.
A portal mediates access to a resource after a user action. For example, choosing a document in an app’s file picker can grant access to that file without opening up an entire directory. Portal support varies by implementation and toolkit.
A filesystem override works differently: it gives an app persistent access to a specified path. Flatpak recommends keeping that path narrow and using read-only access when the app does not need to change files. The :ro suffix marks a read-only permission.
Grant access to the selected file when that is enough; for repeated access, choose the smallest suitable directory and make it read-only if the app only needs to read.
Choose a permission route that fits the task
| Task | Approach | Scope |
| Open one selected file | Use a portal request through the app | The selected resource |
| Read files in a directory repeatedly | Grant access to that specific path; use :ro if writing is unnecessary | The chosen directory, persistently |
| Give an app access to the home directory | Use the home permission only when the app needs that broader scope | Home access excludes ~/.var/app; ~/.local/share/flatpak requires a separate permission |
Flatseal provides a graphical way to manage an app’s persistent sandbox overrides. Keep the change tied to the app that needs it, and use its reset control to restore default permissions if you want to undo a change. The English-language walkthrough from Chris Titus Tech demonstrates Flatseal’s filesystem controls and reset behavior.
Find the right Flatpak storage location
Flatpak uses separate directories for application data and installed deployments:
- Per-app user data:
~/.var/app/$FLATPAK_ID - Per-user Flatpak installations:
$HOME/.local/share/flatpak/ - Default system-wide installation:
/var/lib/flatpak/
The Flatpak command reference identifies the per-user and system-wide installation locations; the sandbox documentation describes per-app data. Removing an app’s leftover data and removing installed Flatpak runtimes or deployments are different cleanup tasks, because they concern different directories.
Clean up app data with Warehouse
Warehouse is suited to managing app data, including unused data left after an app is uninstalled. Its Flathub listing also describes snapshots and other Flatpak management features. If you are trying to recover space, first identify whether the target is a particular app’s data under ~/.var/app/ or an installation under one of the Flatpak deployment directories; Warehouse’s Flathub listing describes its app-data cleanup features.
