Flatpak: A security nightmare – two years later
I strongly believe that both flatpak and docker both went about the wrong way of building images.<p>they should have leveraged the package model that linux distributions already have and viewed them as mix and matchable layers much like packages are mix and matchable. with full dependency resolution.  i.e. creating an &quot;apache&quot; container image should be as easy as &quot;apt-get install apache&quot; but without actually installing anything.  just creating a manifest that references the packages&#x2F;layers that are needed.<p>simple upgrades a container image is then just upgrading the set of layers in the container image, and unlike docker where even if 2 layers are exactly the same content, if a layer &quot;above&quot; them is different, they are different layers, in a package -&gt; layer concept that&#x27;s unnecessary.<p>In fact, this is what I published and created the notion of container images that are defined by a file system that is created by composing a set of shared layers together, but Docker took the easy way out and punted on that.<p>this would also make it simple(r) to do security analysis on container images as well as compose multiple images together.<p><a href="https:&#x2F;&#x2F;www.usenix.org&#x2F;legacy&#x2F;events&#x2F;atc10&#x2F;tech&#x2F;tech.html#Potter" rel="nofollow">https:&#x2F;&#x2F;www.usenix.org&#x2F;legacy&#x2F;events&#x2F;atc10&#x2F;tech&#x2F;tech.html#Po...</a><p><a href="https:&#x2F;&#x2F;www.usenix.org&#x2F;legacy&#x2F;events&#x2F;lisa11&#x2F;tech&#x2F;#Potter" rel="nofollow">https:&#x2F;&#x2F;www.usenix.org&#x2F;legacy&#x2F;events&#x2F;lisa11&#x2F;tech&#x2F;#Potter</a><p>(which also goes to my in joke that I&#x27;m the only one who can get a job that requires 10+ years of docker experience ;) )