Install and Manage Flatpak Applications in Linux

Flatpak delivers desktop applications in a sandbox against shared runtimes, independent of whether your distribution shipped the app in its own RPM or DEB repository. The same flatpak commands work on Fedora, RHEL, Ubuntu, and other distributions once the flatpak package and at least one remote are configured.

What Is Flatpak?

Flatpak is an application packaging format for Linux desktops and workstations. Instead of mixing libraries into the host OS, each app runs against a shared runtime (a curated /usr tree) inside a sandbox that limits filesystem and device access.

Distribution packages from dnf or apt install files system-wide and depend on distro library versions. Flatpak applications run against a shared runtime containing common libraries and can bundle additional application-specific dependencies inside the app itself. They update from their remote and declare sandbox permissions explicitly. Many administrators use both: distro packages for servers and core tools, Flatpak for selected desktop software.

Flatpak Quick Reference

Install Flatpak

Install the flatpak package from your distribution, then configure remotes before flatpak install.

On RHEL, Rocky Linux, AlmaLinux, Oracle Linux, CentOS Stream, and Fedora:

sudo dnf install -y flatpak

When the package is already present, dnf reports nothing to do.

flatpak --version

Sample output:

Flatpak 1.16.0

On Ubuntu and Debian, use apt (full Flathub walkthrough: install Flatpak on Debian):

sudo apt update && sudo apt install -y flatpak

Fedora Workstation often ships Flatpak preconfigured with Flathub. On RHEL, the vendor rhel remote may already be present on graphical installs; Flathub remains optional and separate.

Understand Flatpak Remotes

A remote is a catalog of application and runtime refs. flatpak install pulls from a named remote, not from the distro package index.

List configured remotes with title and URL.

flatpak remotes --columns=name,title,url

Sample output on RHEL 10:

rhel	Red Hat Enterprise Linux	oci+https://flatpaks.redhat.io/rhel/

Inspect collection metadata and scope.

flatpak remote-list --show-details

Sample output:

rhel	Red Hat Enterprise Linux	oci+https://flatpaks.redhat.io/rhel/	com.redhat.Stable	-	-	1	system,oci,no-gpg-verify	Red Hat Enterprise Linux Flatpak applications and runtimes	This repository contains Flatpaks of applications built for Red Hat Enterprise Linux, along with the Red Hat Flatpak Runtime and SDK.	https://catalog.redhat.com/software/containers/explore	https://www.redhat.com/misc/favicon.ico

System remotes (default for sudo flatpak remote-add) apply to /var/lib/flatpak and all users. User remotes apply only when you pass --user and store data under ~/.local/share/flatpak.

Add a Flatpak Remote

Generic syntax:

flatpak remote-add --if-not-exists REMOTE_NAME URL_OR_REPOFILE

Flathub (community catalog, not vendor support):

flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

Flathub hosts thousands of apps (GIMP, Steam, many GNOME apps). Packages come from the Flathub project, not your distribution vendor. Use it when you need apps absent from vendor remotes and accept community packaging policies.

Red Hat Enterprise Linux — RHEL 10 graphical installations may already have the rhel remote because Firefox and Thunderbird are delivered as Flatpaks by default. On minimal or manually configured systems, verify with flatpak remotes; if rhel is absent, install the redhat-flatpak-repo package or add the Red Hat remote as documented by Red Hat. Subscribed systems authenticate to the vendor registry; unsubscribed hosts may see different results. The remote publishes Firefox, Thunderbird, and the Red Hat Platform runtime from flatpak.redhat.io.

Search for Flatpak Applications

Search across all configured remotes by name or keyword.

flatpak search firefox

Sample output:

Firefox	Web Browser	org.mozilla.firefox	140.13.0	stable	rhel

Columns are name, description, application ID, version, branch, and remote. Copy the application ID (org.mozilla.firefox) for install commands. If search returns no matches, the app may live only on a remote you have not added (common for Flathub-only apps on RHEL).

flatpak search gimp

Sample output on RHEL with only rhel configured:

No matches found

Install a Flatpak Application

Install by remote and application ID. System-wide installs (default with sudo) land in /var/lib/flatpak.

sudo flatpak install -y rhel org.mozilla.Thunderbird

Sample output:

Installing… ████████████████████ 100%  2.0 MB/s  00:00
Installation complete.

Verify the app list.

flatpak list --app

Sample output:

Thunderbird	org.mozilla.Thunderbird	140.13.0	stable	system
Firefox	org.mozilla.firefox	140.13.0	stable	system

Installation: system in flatpak info confirms a system-wide ref.

List Installed Flatpak Applications and Runtimes

Separate applications from runtimes.

flatpak list --app

flatpak list --runtime

Sample output:

Red Hat Platform	com.redhat.Platform	10	el10	system

Show origin remote per ref.

flatpak list --columns=application,version,origin

Sample output:

com.redhat.Platform	10	rhel
org.mozilla.firefox	140.13.0	rhel
org.mozilla.Thunderbird	140.13.0	rhel

flatpak info also reports installed size (for example Thunderbird at 336.6 MB on the test host).

Run Flatpak Applications

Launch from the CLI with the application ID.

flatpak run org.mozilla.Thunderbird --version

Sample output:

[2] Sandbox: CanCreateUserNamespace() clone() failure: EPERM
Mozilla Thunderbird 140.13.0esr

The version line confirms the binary ran. The sandbox warning appears on some lab VMs without user namespaces; desktop sessions usually do not show it. Graphical apps also appear in the desktop menu after install (flatpak creates launcher entries under /var/lib/flatpak/exports or the user export tree).

Pass arguments after the application ID the same way you would for the host binary. Environment variables and host paths outside the sandbox still follow Flatpak permission rules.

Update Flatpak Applications

Update everything configured on the system.

flatpak update -y

Sample output:

Updates complete.

Update one application.

flatpak update -y org.mozilla.Thunderbird

Sample output when already current:

Looking for updates…

Nothing to do.

List refs with pending updates on a remote (Flatpak 1.16 has no update --dry-run).

flatpak remote-ls --updates rhel

Sample output:

Firefox	org.mozilla.firefox	140.13.0	stable
Red Hat Platform	com.redhat.Platform	10	el10

Updating apps can also pull newer runtimes they depend on.

Manage Flatpak Remotes

Add (shown above), delete, or disable remotes when catalogs change.

flatpak remote-delete flathub

If Flatpak refuses because installed refs still depend on the remote, inspect those apps with flatpak list and uninstall or migrate them first. --force bypasses that protection and should only be used when you intentionally remove a remote while refs remain.

Deleting a remote does not remove installed apps from disk until you uninstall them, but you cannot update refs that only existed on that remote. Disable instead of delete when you want to block new installs temporarily:

flatpak remote-modify flathub --disable

flatpak remote-modify flathub --enable

Document remote changes on shared machines so teammates know which catalog an app came from.

Understand Flatpak Permissions

Sandboxed apps receive only the host access declared in their metadata. Inspect effective permissions:

flatpak info --show-permissions org.mozilla.Thunderbird

Sample output:

[Context]
shared=network;ipc;
sockets=x11;pulseaudio;pcsc;
devices=dri;
filesystems=~/.mozilla:create;home:ro;xdg-run/dconf;xdg-download;~/.config/dconf:ro;~/.cache/thunderbird:create;~/.thunderbird:create;

[Session Bus Policy]
org.freedesktop.Notifications=talk
ca.desrt.dconf=talk
org.a11y.*=talk

filesystems= entries show which host paths the app may read or create. Administrators can tighten or loosen rules per app with flatpak override (for example flatpak override --user APP_ID --filesystem=host). Overrides are policy decisions—this guide only introduces the command, not a full hardening model.

System vs User Flatpak Installation

User installs do not require root but only see remotes added for user scope. On RHEL, rhel is usually registered system-wide when the vendor remote is installed; a user-only install fails until you mirror the remote.

flatpak install --user -y rhel org.mozilla.Thunderbird

Sample output:

error: No remote refs found for ‘rhel’

Add flatpak remote-add --user … for Flathub on Debian-style setups, or use system installs when IT manages one shared catalog.

Remove Applications

Remove an application ref.

flatpak uninstall -y org.mozilla.Thunderbird

Sample output:

Uninstall complete.

Normal uninstall keeps the app's Flatpak data under ~/.var/app/APP_ID. Add --delete-data when you intentionally want Flatpak to remove that app-data directory and its stored permissions. Host directories exposed to the sandbox, such as ~/.thunderbird, are separate and should not be assumed to be deleted.

Remove runtimes no longer referenced by any app.

flatpak uninstall --unused -y

Sample output when nothing is orphaned:

Nothing unused to uninstall

Confirm remaining apps.

flatpak list --app

Troubleshoot Flatpak

Practical End-to-End Example

This workflow uses Thunderbird from the rhel remote on RHEL 10—the same commands apply on other distributions once the matching remote and application ID are configured.

Search and note the application ID and remote.

flatpak search thunderbird

Sample output:

Thunderbird	Thunderbird is a free and open source email, newsfeed, chat, and calendaring client	org.mozilla.Thunderbird	140.13.0	stable	rhel

Install system-wide.

sudo flatpak install -y rhel org.mozilla.Thunderbird

Inspect metadata and permissions.

flatpak info org.mozilla.Thunderbird

Sample output:

ID: org.mozilla.Thunderbird
         Ref: app/org.mozilla.Thunderbird/x86_64/stable
      Branch: stable
     Version: 140.13.0
      Origin: rhel
Installation: system
   Installed: 336.6 MB
     Runtime: com.redhat.Platform/x86_64/el10

Run a quick version check.

flatpak run org.mozilla.Thunderbird --version

Update if the remote publishes newer builds.

flatpak update -y org.mozilla.Thunderbird

Remove the app when you no longer need it.

flatpak uninstall -y org.mozilla.Thunderbird

flatpak list --app

Sample output:

Firefox	org.mozilla.firefox	140.13.0	stable	system

On Ubuntu or Debian with Flathub, replace rhel with flathub and the application ID from flatpak search. The Debian install guide covers apt and Flathub registration in full.

References

• Flatpak documentation — upstream CLI and concepts
• Flathub — community application catalog
• Red Hat — Flatpak applications — vendor remote on RHEL
• flatpak(1) — Linux man page

Summary

Flatpak installs sandboxed desktop software from named remotes instead of from the distribution package index alone. You configure remotes, search by keyword to learn the application ID, install with flatpak install REMOTE APP_ID, and manage lifecycle with list, run, update, and uninstall. Runtimes such as com.redhat.Platform are shared across multiple apps; removing one application does not necessarily remove its runtime.

Vendor remotes and Flathub are not interchangeable support sources. RHEL 10 graphical installs may already include rhel; minimal systems should verify with flatpak remotes before installing. System installs live under /var/lib/flatpak; user installs need matching user-scope remotes under ~/.local/share/flatpak.

When something fails, read the remote column from flatpak search, confirm sandbox permissions with flatpak info --show-permissions, and use flatpak remote-ls --updates instead of a nonexistent dry-run flag.