Coldbrew package manager

2026-04-20 23:07 UTC

Coldbrew is a “brew” style package manager for Linux distributions that offers the full power of the Alpine Linux aports repository with no root access required Coldbrew is a bit of a mix of flatpak and homebrew. It uses a very lightweight sandbox (bubblewrap) mainly as a means of isolating dependencies and aims to server a similar goal as homebrew, but without the PATH issues homebrew brings (see: invent.kde.org/kde-linux/kde-linux/-/…/408)

Replies (2)

@Oinks@lemmy.blahaj.zone 2026-04-21 06:50

This is interesting, but I’m not convinced I would consider this to be anywhere close to Flatpak. From what I can see the only purpose of using bubblewrap here is the dependency isolation (without having to recompile the world ala Nix), but it feels misleading to even call it a sandbox. This mounts /home and /run into the sandbox chroot, which means that “sandboxed” applications can do things like reading your SSH keys, dumping your keyring or writing to .bashrc (a.k.a. most of the attacks you’d want to prevent). This is presumably done because /home access you wouldn’t be able to write to the filesystem and without /run access you can’t even display a graphical window, which would make the packages quite useless. XDG Desktop Portal solves this by allowing filtered dbus access controlled by package metadata (/.flatpak-info), and then having sandboxed applications use portals to access files, secrets and other resources. That’s a major flaw in Flatpaks design (note that the most popular Flatpaks all want /home access), but it’s also what allows Flatpak to be useful.

Open ##1484289
@mecen@lemmy.ca 2026-04-25 11:40

Why not just use nix? It also can be sandboxed using bwrap. In my opinion focus should be on GUI for nix, brew.

Open ##1661004