mirror of
https://github.com/flatpak/flatpak.git
synced 2026-03-27 03:14:04 -04:00
0493219ca5
Adapted from: https://github.com/flatpak/flatpak/pull/6125 In systemd v259, /run/host/root will be a documented location for bind mounting the host's root filesystem into a container. Ref: https://github.com/systemd/systemd/pull/38384 host-root is the sledgehammer permission for file browsers and similar apps that the user might want to give full access to. This works same as the existing host keywords by mounting into /run/host/root. applications will need adjustments to essentially treat that path as "root". Since this opens the door to all sorts of malicious software, the permission should be put under tight review in flatpak repositories. Resolves: #5723 Co-authored-by: Ryan Brue <ryanbrue.dev@gmail.com>
450 lines
19 KiB
XML
450 lines
19 KiB
XML
<?xml version='1.0'?> <!--*-nxml-*-->
|
|
<!DOCTYPE refentry PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
|
|
"http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd">
|
|
|
|
<refentry id="flatpak-build">
|
|
|
|
<refentryinfo>
|
|
<title>flatpak build</title>
|
|
<productname>flatpak</productname>
|
|
|
|
<authorgroup>
|
|
<author>
|
|
<contrib>Developer</contrib>
|
|
<firstname>Alexander</firstname>
|
|
<surname>Larsson</surname>
|
|
<email>alexl@redhat.com</email>
|
|
</author>
|
|
</authorgroup>
|
|
</refentryinfo>
|
|
|
|
<refmeta>
|
|
<refentrytitle>flatpak build</refentrytitle>
|
|
<manvolnum>1</manvolnum>
|
|
</refmeta>
|
|
|
|
<refnamediv>
|
|
<refname>flatpak-build</refname>
|
|
<refpurpose>Build in a directory</refpurpose>
|
|
</refnamediv>
|
|
|
|
<refsynopsisdiv>
|
|
<cmdsynopsis>
|
|
<command>flatpak build</command>
|
|
<arg choice="opt" rep="repeat">OPTION</arg>
|
|
<arg choice="plain">DIRECTORY</arg>
|
|
<arg choice="opt">COMMAND <arg choice="opt" rep="repeat">ARG</arg></arg>
|
|
</cmdsynopsis>
|
|
</refsynopsisdiv>
|
|
|
|
<refsect1>
|
|
<title>Description</title>
|
|
|
|
<para>
|
|
Runs a build command in a directory. <arg choice="plain">DIRECTORY</arg>
|
|
must have been initialized with <command>flatpak build-init</command>.
|
|
</para>
|
|
<para>
|
|
The sdk that is specified in the <filename>metadata</filename> file
|
|
in the directory is mounted at <filename>/usr</filename> and the
|
|
<filename>files</filename> and <filename>var</filename> subdirectories
|
|
are mounted at <filename>/app</filename> and <filename>/var</filename>,
|
|
respectively. They are writable, and their contents are preserved between
|
|
build commands, to allow accumulating build artifacts there.
|
|
</para>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Options</title>
|
|
|
|
<para>The following options are understood:</para>
|
|
|
|
<variablelist>
|
|
<varlistentry>
|
|
<term><option>-h</option></term>
|
|
<term><option>--help</option></term>
|
|
|
|
<listitem><para>
|
|
Show help options and exit.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-v</option></term>
|
|
<term><option>--verbose</option></term>
|
|
|
|
<listitem><para>
|
|
Print debug information during command processing.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--ostree-verbose</option></term>
|
|
|
|
<listitem><para>
|
|
Print OSTree debug information during command processing.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-r</option></term>
|
|
<term><option>--runtime</option></term>
|
|
|
|
<listitem><para>
|
|
Use the non-devel runtime that is specified in the application metadata instead of the devel runtime.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>-p</option></term>
|
|
<term><option>--die-with-parent</option></term>
|
|
|
|
<listitem><para>
|
|
Kill the build process and all children when the launching process dies.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--bind-mount=DEST=SOURCE</option></term>
|
|
|
|
<listitem><para>
|
|
Add a custom bind mount in the build namespace. Can be specified multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--build-dir=PATH</option></term>
|
|
|
|
<listitem><para>
|
|
Start the build in this directory (default is in the current directory).
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--share=SUBSYSTEM</option></term>
|
|
|
|
<listitem><para>
|
|
Share a subsystem with the host session. This overrides
|
|
the Context section from the application metadata.
|
|
<arg choice="plain">SUBSYSTEM</arg> must be one of: network, ipc.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--unshare=SUBSYSTEM</option></term>
|
|
|
|
<listitem><para>
|
|
Don't share a subsystem with the host session. This overrides
|
|
the Context section from the application metadata.
|
|
<arg choice="plain">SUBSYSTEM</arg> must be one of: network, ipc.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--socket=SOCKET</option></term>
|
|
|
|
<listitem><para>
|
|
Expose a well-known socket to the application. This overrides to
|
|
the Context section from the application metadata.
|
|
<arg choice="plain">SOCKET</arg> must be one of: x11, wayland, fallback-x11, pulseaudio, system-bus, session-bus,
|
|
ssh-auth, pcsc, cups, gpg-agent, inherit-wayland-socket.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--nosocket=SOCKET</option></term>
|
|
|
|
<listitem><para>
|
|
Don't expose a well-known socket to the application. This overrides to
|
|
the Context section from the application metadata.
|
|
<arg choice="plain">SOCKET</arg> must be one of: x11, wayland, fallback-x11, pulseaudio, system-bus, session-bus,
|
|
ssh-auth, pcsc, cups, gpg-agent, inherit-wayland-socket.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--device=DEVICE</option></term>
|
|
|
|
<listitem><para>
|
|
Expose a device to the application. This overrides to
|
|
the Context section from the application metadata.
|
|
<arg choice="plain">DEVICE</arg> must be one of: dri, input, usb, kvm, shm, all.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--nodevice=DEVICE</option></term>
|
|
|
|
<listitem><para>
|
|
Don't expose a device to the application. This overrides to
|
|
the Context section from the application metadata.
|
|
<arg choice="plain">DEVICE</arg> must be one of: dri, input, usb, kvm, shm, all.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--allow=FEATURE</option></term>
|
|
|
|
<listitem><para>
|
|
Allow access to a specific feature. This updates
|
|
the [Context] group in the metadata.
|
|
<arg choice="plain">FEATURE</arg> must be one of:
|
|
devel, multiarch, bluetooth, canbus,
|
|
per-app-dev-shm.
|
|
This option can be used multiple times.
|
|
</para><para>
|
|
See <citerefentry><refentrytitle>flatpak-build-finish</refentrytitle><manvolnum>1</manvolnum></citerefentry>
|
|
for the meaning of the various features.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--disallow=FEATURE</option></term>
|
|
|
|
<listitem><para>
|
|
Disallow access to a specific feature. This updates
|
|
the [Context] group in the metadata.
|
|
<arg choice="plain">FEATURE</arg> must be one of:
|
|
devel, multiarch, bluetooth, canbus,
|
|
per-app-dev-shm.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--filesystem=FILESYSTEM[:ro|:create]</option></term>
|
|
|
|
<listitem><para>
|
|
Allow the application access to a subset of the filesystem.
|
|
This overrides to the Context section from the application metadata.
|
|
<arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, host-root, xdg-desktop, xdg-documents, xdg-download,
|
|
xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos, xdg-run,
|
|
xdg-config, xdg-cache, xdg-data, an absolute path, or a homedir-relative
|
|
path like ~/dir or paths relative to the xdg dirs, like xdg-download/subdir.
|
|
The optional :ro suffix indicates that the location will be read-only.
|
|
The optional :create suffix indicates that the location will be read-write and created if it doesn't exist.
|
|
This option can be used multiple times.
|
|
See the "[Context] filesystems" list in
|
|
<citerefentry><refentrytitle>flatpak-metadata</refentrytitle><manvolnum>5</manvolnum></citerefentry>
|
|
for details of the meanings of these filesystems.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--nofilesystem=FILESYSTEM</option></term>
|
|
|
|
<listitem><para>
|
|
Remove access to the specified subset of the filesystem from
|
|
the application. This overrides to the Context section from the
|
|
application metadata.
|
|
<arg choice="plain">FILESYSTEM</arg> can be one of: home, host, host-os, host-etc, host-root xdg-desktop, xdg-documents, xdg-download,
|
|
xdg-music, xdg-pictures, xdg-public-share, xdg-templates, xdg-videos,
|
|
an absolute path, or a homedir-relative path like ~/dir.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--with-appdir</option></term>
|
|
|
|
<listitem><para>
|
|
Expose and configure access to the per-app storage directory in <filename>$HOME/.var/app</filename>. This is
|
|
not normally useful when building, but helps when testing built apps.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--add-policy=SUBSYSTEM.KEY=VALUE</option></term>
|
|
|
|
<listitem><para>
|
|
Add generic policy option. For example, "--add-policy=subsystem.key=v1 --add-policy=subsystem.key=v2" would map to this metadata:
|
|
<programlisting>
|
|
[Policy subsystem]
|
|
key=v1;v2;
|
|
</programlisting>
|
|
</para><para>
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--remove-policy=SUBSYSTEM.KEY=VALUE</option></term>
|
|
|
|
<listitem><para>
|
|
Remove generic policy option. This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--env=VAR=VALUE</option></term>
|
|
|
|
<listitem><para>
|
|
Set an environment variable in the application.
|
|
This overrides to the Context section from the application metadata.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--unset-env=VAR</option></term>
|
|
|
|
<listitem><para>
|
|
Unset an environment variable in the application.
|
|
This overrides the unset-environment entry in the [Context]
|
|
group of the metadata, and the [Environment] group.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--env-fd=<replaceable>FD</replaceable></option></term>
|
|
|
|
<listitem><para>
|
|
Read environment variables from the file descriptor
|
|
<replaceable>FD</replaceable>, and set them as if
|
|
via <option>--env</option>. This can be used to avoid
|
|
environment variables and their values becoming visible
|
|
to other users.
|
|
</para><para>
|
|
Each environment variable is in the form
|
|
<replaceable>VAR</replaceable>=<replaceable>VALUE</replaceable>
|
|
followed by a zero byte. This is the same format used by
|
|
<literal>env -0</literal> and
|
|
<filename>/proc/*/environ</filename>.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--own-name=NAME</option></term>
|
|
|
|
<listitem><para>
|
|
Allow the application to own the well-known name NAME on the session bus.
|
|
This overrides to the Context section from the application metadata.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--talk-name=NAME</option></term>
|
|
|
|
<listitem><para>
|
|
Allow the application to talk to the well-known name NAME on the session bus.
|
|
This overrides to the Context section from the application metadata.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--system-own-name=NAME</option></term>
|
|
|
|
<listitem><para>
|
|
Allow the application to own the well-known name NAME on the system bus.
|
|
This overrides to the Context section from the application metadata.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--system-talk-name=NAME</option></term>
|
|
|
|
<listitem><para>
|
|
Allow the application to talk to the well-known name NAME on the system bus.
|
|
This overrides to the Context section from the application metadata.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--persist=FILENAME</option></term>
|
|
|
|
<listitem><para>
|
|
If the application doesn't have access to the real homedir, make the (homedir-relative) path
|
|
<arg choice="plain">FILENAME</arg> a bind mount to the corresponding path in the per-application directory,
|
|
allowing that location to be used for persistent data.
|
|
This overrides to the Context section from the application metadata.
|
|
This option can be used multiple times.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--sdk-dir=DIR</option></term>
|
|
|
|
<listitem><para>
|
|
Normally if there is a <filename>usr</filename> directory in the build dir, this is used
|
|
for the runtime files (this can be created by <option>--writable-sdk</option> or <option>--type=runtime</option> arguments
|
|
to build-init). If you specify <option>--sdk-dir</option>, this directory will be used instead.
|
|
Use this if you passed <option>--sdk-dir</option> to build-init.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--readonly</option></term>
|
|
|
|
<listitem><para>
|
|
Mount the normally writable destination directories read-only. This can
|
|
be useful if you want to run something in the sandbox but guarantee that
|
|
it doesn't affect the build results. For example tests.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--metadata=FILE</option></term>
|
|
|
|
<listitem><para>
|
|
Use the specified filename as metadata in the exported app instead of
|
|
the default file (called <filename>metadata</filename>). This is useful
|
|
if you build multiple things from a single build tree (such as both a
|
|
platform and a sdk).
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--log-session-bus</option></term>
|
|
|
|
<listitem><para>
|
|
Log session bus traffic. This can be useful to see what access you need to allow in
|
|
your D-Bus policy.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
<varlistentry>
|
|
<term><option>--log-system-bus</option></term>
|
|
|
|
<listitem><para>
|
|
Log system bus traffic. This can be useful to see what access you need to allow in
|
|
your D-Bus policy.
|
|
</para></listitem>
|
|
</varlistentry>
|
|
|
|
</variablelist>
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>Examples</title>
|
|
|
|
<para>
|
|
<command>$ flatpak build /build/my-app rpmbuild my-app.src.rpm</command>
|
|
</para>
|
|
|
|
</refsect1>
|
|
|
|
<refsect1>
|
|
<title>See also</title>
|
|
|
|
<para>
|
|
<citerefentry><refentrytitle>flatpak</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>flatpak-build-init</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>flatpak-build-finish</refentrytitle><manvolnum>1</manvolnum></citerefentry>,
|
|
<citerefentry><refentrytitle>flatpak-build-export</refentrytitle><manvolnum>1</manvolnum></citerefentry>
|
|
</para>
|
|
|
|
</refsect1>
|
|
|
|
</refentry>
|