Catcrafts/Crafter.Review
Watch
2
0
Fork
You've already forked Crafter.Review
 0
Code Issues 7 Pull requests Projects Releases 3 Packages Wiki Activity Actions

flatpak: inside the sandbox /usr is the Sdk's, the host's at /run/host/usr

Browse source 
Inside the Flatpak the lenses see the host's filesystem with its /usr at
/run/host/usr - the sandbox's own /usr is the Sdk's - but not the user
and system Flatpak installations (~/.local/share/flatpak is empty inside,
/var/lib/flatpak absent), so a repository whose dependencies live in one
points its lens sections at the host's copies.
The commit-range lenses' common text (_common-repo.md) tells them where
the host's /usr is, a fact of the Flatpak rather than one repository's
convention; the kernel modes' _common.md, which says nothing of files
outside the working directory or of /usr, keeps the Python driver's
bytes. The README's sandbox notes name it, and the goldens' system text
follows.
This commit is contained in:
Jorijn van der Graaf 2026-11-01 02:36:07 +01:00
commit 1f0d6d9846
Signed by: jorijnvdgraaf
GPG key ID: 2937E59CDCC1BCFB
3 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -15,7 +15,7 @@ crafter-review's prompts, reuse keys, exit codes and shared files are pinned byt
## Install
crafter-review ships as a Flatpak with its own git, Node (for the Playwright MCP server) and ripgrep, so every machine reviews with the same tools:
crafter-review ships as a Flatpak with its own git, Node (for the Playwright MCP server) and ripgrep, so every machine reviews with the same tools. Inside it the lenses see the host's filesystem, with the host's `/usr` at `/run/host/usr`, but not the user and system Flatpak installations (`~/.local/share/flatpak` is empty in the sandbox, `/var/lib/flatpak` absent, by Flatpak's rule): a repository whose dependencies live in another Flatpak points its lens sections at the host's copies.
```bash
flatpak remote-add --if-not-exists catcrafts https://flatpak.catcrafts.net/catcrafts.flatpakrepo
@ -112,7 +112,7 @@ To stop a run, run `crafter-review stop <its scratch dir>`, or `crafter-review s
The sandbox gets the network, the whole host filesystem (`--filesystem=host`), the host's `/tmp` and gnupg's keyboxd socket. `--filesystem=host` is a convenience for a developer tool, **not an isolation boundary**: a lens's tool allowlist is what keeps a pass to its job, as it was outside the Flatpak.
The driver hands its children the host's XDG directories. git then reads `~/.config/git/config`, Playwright finds `~/.cache/ms-playwright`, and claude and npx behave as on the host. A pass's shell is bash. A few things do differ from a native run:
- a lens reading `/usr` sees the Sdk's;
- a lens reading `/usr` sees the Sdk's; the host's is at `/run/host/usr`, which the commit-range lenses' common text (`_common-repo.md`) tells them;
- git hooks run with the Sdk's tools;
- `FLATPAK_ID` reaches every child;
- a runtime update can change git between `freeze` and `--verify`, which the MISMATCH message then names.