You need an app that DNF does not carry
You installed Fedora and the system feels fast and clean. You need a specific tool. Maybe it is a proprietary audio editor, a game engine, or a creative suite that moves faster than the Fedora release cycle. You run dnf install and the package is missing, or the version is two years old. You need a way to get the current software without pulling in dependencies that conflict with your system libraries.
Flatpak solves this by sandboxing applications. It bundles the app with the libraries it needs, keeping the rest of your system untouched. Flathub is the central repository where most Flatpak apps live. Adding Flathub and installing an app takes two commands. The rest is managing permissions and updates.
Run the remote add command first. If you skip this, Flatpak will not know where to find the app.
What Flatpak actually does
Flatpak separates the application from the runtime. The runtime is a collection of shared libraries, like GTK, Qt, or GStreamer, that multiple apps can use. The app is the specific software you want to run. When you install a Flatpak, the system downloads the runtime once and shares it across all apps that need it. The app itself sits on top of that runtime in a sandbox.
This architecture prevents dependency conflicts. You can run GIMP 2.10 and GIMP 2.99 side by side because they use different runtimes. The sandbox restricts access to your home directory, network, and hardware unless you explicitly grant permissions. This isolation is why Flatpak apps sometimes cannot see your files or printers by default.
The Flatpak client lives in /usr/bin/flatpak. The installed apps and runtimes live in /var/lib/flatpak for system-wide installs or ~/.local/share/flatpak for user-only installs. Fedora Workstation usually enables system-wide installs by default. Check your setup before you start.
Verify your current Flatpak version before proceeding. Older clients may not support newer runtime features.
flatpak --version
# Check the client version to ensure it supports current Flathub runtimes
# Fedora 38 and newer ship with a client that handles modern permissions
Adding Flathub and installing apps
Flathub is not always added automatically on every Fedora spin. Server editions and minimal installs often require manual configuration. Even on Workstation, adding the remote explicitly ensures you have the correct URL and metadata.
Run the remote add command to register Flathub. The --if-not-exists flag prevents errors if you have already added the repository in the past.
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
# --if-not-exists avoids an error if Flathub is already configured
# This command downloads the repository metadata and trusts the source
Once the remote is added, you can install apps. You need the App ID. The App ID is a unique string that identifies the application. It usually follows reverse domain notation, like org.gimp.GIMP or com.spotify.Client.
Run the install command with the remote name and the App ID. Specifying the remote name ensures Flatpak pulls from Flathub and not a broken local cache.
flatpak install flathub org.gimp.GIMP
# Specify the remote name first to force the correct source
# The App ID must match exactly what Flathub expects
The command will prompt you to confirm the installation. It lists the runtime and the app size. Press y to proceed. Flatpak downloads the delta if you already have a similar runtime, or the full bundle if this is your first app using that runtime.
Check the App ID twice. A typo downloads the wrong package or fails immediately.
Finding the correct App ID
The App ID is the most common point of failure. You cannot install gimp. You must install org.gimp.GIMP. You cannot install spotify. You must install com.spotify.Client.
You can find the App ID on the Flathub website. Search for the app and look at the URL or the details page. The ID is listed clearly. You can also search from the terminal.
Run the search command to find available apps. This queries the Flathub metadata without downloading anything.
flatpak search gimp
# Query the remote repositories for apps matching the keyword
# The output lists the App ID, version, and branch
The output shows the App ID in the first column. Copy that exact string. Branches usually default to stable. If you need a development version, you can specify the branch with --branch=master or --branch=beta, but stick to stable unless you have a reason to test.
Use the App ID from the search output. Guessing the ID leads to Error: No matches messages.
Managing permissions and overrides
Flatpak apps run in a sandbox. They cannot access your home directory, your network, or your hardware by default. This is a feature, not a bug. It stops a compromised app from reading your passwords or installing background services.
Sometimes you need to grant access. Maybe you need the app to see files on your external drive, or you need it to access your printer. You can change permissions using flatpak override.
Run the override command to grant filesystem access. The --filesystem flag controls what the app can see.
flatpak override --user --filesystem=home org.gimp.GIMP
# --user applies the override only for your user account
# --filesystem=home grants read-write access to your entire home directory
You can also grant access to specific paths. This is safer than granting access to the whole home directory.
flatpak override --user --filesystem=/run/media/user/external-drive org.gimp.GIMP
# Grant access to a specific mount point instead of the whole filesystem
# Replace the path with your actual mount point
To remove an override, use the --reset flag. This returns the app to its default permissions.
flatpak override --user --reset org.gimp.GIMP
# --reset removes all custom overrides for this app
# The app returns to its default sandbox configuration
Always check the app's manifest on Flathub. Many apps request specific permissions by default. You only need to override if the default behavior blocks your workflow.
Grant the minimum access required. Wide open permissions defeat the purpose of sandboxing.
Updating and cleaning up
Flatpak apps do not update with dnf upgrade. They have their own update cycle. You must run flatpak update separately. This is a common oversight. Your system packages get updated, but your Flatpak apps stay stale.
Run the update command to refresh all installed Flatpaks. This checks for new app versions and runtime updates.
flatpak update
# Check for updates for all installed apps and runtimes
# This command runs independently of dnf system-upgrade
The command lists available updates. Press y to apply them. Runtimes update less frequently than apps. When a runtime updates, all apps using that runtime restart with the new libraries. This can sometimes break an app if the runtime changes significantly, but Flathub usually tests for compatibility.
You can also update a single app. This is useful if you want to test an update without touching everything else.
flatpak update org.gimp.GIMP
# Update only the specified app and its dependencies
# Useful for targeted testing or avoiding large downloads
Over time, you accumulate unused runtimes. If you uninstall an app, the runtime might stay installed if another app uses it. If no app uses it, you can remove it.
Run the uninstall command to remove an app. This removes the app data but leaves the runtime if other apps need it.
flatpak uninstall org.gimp.GIMP
# Remove the app and its user data
# The runtime remains if other apps depend on it
To remove unused runtimes, use the --unused flag. This frees disk space.
flatpak uninstall --unused
# Remove runtimes that are not used by any installed app
# This reclaims disk space in /var/lib/flatpak or ~/.local/share/flatpak
Run flatpak update weekly. Runtimes drift, and apps break when the base libraries become too old.
Common errors and fixes
Flatpak errors are usually straightforward. They point to missing remotes, wrong IDs, or permission denials.
If you see Error: No matches, the App ID is wrong or the remote is missing. Check the spelling. Check if Flathub is added.
Error: No matches
This error means Flatpak searched the configured remotes and found nothing. Verify the remote exists.
flatpak remotes
# List all configured remotes
# Ensure 'flathub' appears in the output
If you see Error: Runtimes not found, the runtime is missing or the remote is broken. Re-add the remote.
Error: Runtimes not found
This error means the app requires a runtime that is not installed and cannot be downloaded. The remote might be offline or misconfigured. Re-add Flathub.
flatpak remote-modify flathub https://flathub.org/repo/flathub.flatpakrepo
# --modify updates the existing remote URL and metadata
# This fixes broken or outdated remote configurations
If an app fails to launch with a permission error, check the override. The app might need access to a specific path.
Flatpak failed to start: Permission denied
This error usually means the app tried to access a file or device outside the sandbox. Grant the necessary permission with flatpak override.
Read the error message. It tells you exactly what is missing.
Choosing your package format
Fedora supports multiple package formats. Each has a place. Use the right tool for the job.
Use Flatpak when you want a sandboxed app with the latest version and no dependency conflicts. Use RPM when you need a system tool that integrates deeply with the OS and follows the Fedora release cycle. Use source compilation when you need a specific patch or a version that is not available in any repository.
Stay on Flatpak for creative tools, games, and proprietary clients. Stay on RPM for system utilities, libraries, and core services. Compile from source only when you cannot avoid it.
Trust the package manager. Manual file edits drift, snapshots stay.