Gnome SDK A better way to ship apps Alexander Larsson Red Hat, Inc February 7, 2015

Interest in application deployment/distribution Glick Glick2 Bundler Updatinator Docker Atomic OSTree “Linux Apps”

What is an application?

What is an OS?

Is a distribution an OS?

Importance of the App/OS split

Solution: Bundling?

Idea: Runtimes

Idea: Sandboxing

Introducing: xdg-app

Introducing: Gnome SDK

Demo time!

Fucking Apps, how do they work?

Application structure ├── metadata ├── files │   ├── bin │   │    └── gedit │   ├── lib │   │   ├── libgtksourceview-3.0.so.1.3.0 │   │   └── ... │   └── share │   └── ... └── export    └── share    ├── applications    ├── icons    └── dbus-1

Metadata: [Application] runtime=org.gnome.Platform/x86_64/3.16 sdk=org.gnome.Sdk/x86_64/3.16 command=gedit [Environment] x11=true wayland=true ipc=true pulseaudio=true system-dbus=true session-dbus=true network=true host-fs=true homedir=true

Runtime structure ├── metadata └── files    ├── bin    │   └── bash    ├── lib    │   ├── libgtk3.so.0    │   └── ...    ├── share    │ └── ...    └── etc    └── ...

sandbox structure / – private tmpfs instance ├── usr – bindmount to runtime files ├── self – bindmount to app files ├── var – bindmount to per-app/user data ├── home/user -> /var/home ├── etc -> usr/etc ├── bin -> usr/bin ├── lib -> usr/lib ├── tmp ├── proc – procfs mount └── dev – minimal device set

/var/xdg-app, ~/.local/share/xdg-app ├── repo – ostree repo ├── runtime/org.gnome.Platform/x86_64/3.16 │ ├── 84ea50980... - hardlinked ostree checkout │ └── active -> 84ea50980... ├── app/org.gnome.Gedit │   ├── x86_64/master │   │ ├── 175f30f22... - hardlinked ostree checkout │   │ └── active -> 175f30f22... │   └── data – per app/user writable data └── exports/share    ├── applications    │    └── org.gnome.gedit.desktop -> ...    ├── dbus-1/services    │   └── org.gnome.gedit.service -> ...    └── icons/hicolor       └── ...

New complexities Runtime prerequisites Kernel Services IPC compatibility

Creating an app bundle Choose a base runtime It comes with a corresponding devel runtime Build using xdg-app: xdg-app build-init build-dir org.gnome.Sdk org.gnome.Platform 3.16 cd src/my-app xdg-app build build-dir ./configure --prefix=/self xdg-app build build-dir make xdg-app build build-dir make install xdg-app build-finish --command=myapp –allow=x11 \ --allow=host-fs --allow=session-bus build-dir xdg-app build-export /repos/my-app build-dir org.foo.MyApp Alternatively, Gnome SDK contains rpm/rpmbuild Configured to build rpms into /self

The future: Sandboxing Wayland Kdbus Selinux Cgroups Use more namespaces Portal DBus APIs for sandboxed apps

References Project page: https://wiki.gnome.org/Projects/SandboxedApps Mailing list: https://mail.gnome.org/mailman/listinfo/gnome-os-list Xdg-app: https://github.com/alexlarsson/xdg-app Gnome SDK: https://github.com/alexlarsson/gnome-sdk-images Feedback http://devconf.cz/f/4

Questions?