Flatsonar

Boxi

by Allison Karlitskaya

Terminal emulator for Toolbox

Dangerous permissions Verified creator GPL-3.0+ v6.1
Screenshot 1 of Boxi Screenshot 2 of Boxi Screenshot 3 of Boxi

About

This is a thought-experiment app based around the idea of having a terminal emulator running in a separate container from the session inside of it, with the kernel as the only intermediary.

This is accomplished by means of file descriptor passing of the pseudo-terminal device from a small "agent" program running on the other side of a container boundary. The agent is started using the usual container tools (flatpak-spawn, toolbox, podman), but creating a session is done purely via sockets.

Boxi uses different application identifiers when it is run for different containers. This allows creating individual launcher icons for each container.

Permissions

2 permissions weaken the sandbox. Flatsonar asks before installing.

  • sandbox escape: can run commands on the host via flatpak-spawn
    --talk-name=org.freedesktop.Flatpak
  • X11 display: X11 lets apps read input and windows of other apps
    --socket=x11
  • inter-process communication (needed for X11)
    --share=ipc
  • Wayland display
    --socket=wayland
  • X11 display, only when Wayland is unavailable
    --socket=fallback-x11
  • GPU acceleration
    --device=dri

Who publishes this

The creator demonstrably controls this app id: Flathub verification, the hosting account owns the namespace, or a well-known file on their domain.

  • verified on Flathub: the developer proved they control this app id
    publisher:flathub

Maintenance

Recent activity on the upstream repository, or built and reviewed by Flathub.

No staleness signals: recent activity, or built and reviewed by Flathub.