Investigate chromium --no-sandbox

[MoralCode]

I'm also a bit concerned about running anything Chromium-based with --no-sandbox. Chromium Flatpak apps do not get access to unprivileged user namespaces, or the chrome-sandbox SUID binary (one of these two is necessary for Chromium's Layer 1 sandbox to work correctly), and are instead expected to use Flatpak's sub-sandbox API. Currently, Chromium doesn't support this API. The only real solution right now is to use Zypak which works around this issue.

source: futo-org/Grayjay.Desktop#14 (comment)

[MoralCode]

If i understand correctly, all that would be needed would be to use https://docs.flatpak.org/en/latest/electron.html#launching-the-app to launch the app to resolve the sandboxing issues? or would this need to be done in combination with removing --no-sandbox from the app itself (specifically for flatpak builds)

Maybe its worth going through the git logs to see why --no-sandbox was added in the first place

[MoralCode]

futo-org/Grayjay.Desktop#416 upstream issue

[MoralCode]

closing since this is filed upstream and is not a flatpak-only issue.