[GH-ISSUE #861] Support AppImage type 2 image format

gitea-mirror commented

2026-05-05 06:13:13 -06:00

Owner

Originally created by @probonopd on GitHub (Oct 16, 2016).
Original GitHub issue: https://github.com/netblue30/firejail/issues/861

Please support the AppImage type 2 image format. This is the next-generation format that is using squashfs instead of ISO9660, and enables features such as embedded GPG signatures and other new functionality.

It should be pretty straightforward to use type 2 images, loop-mount them using the kernel with -o,offset=xxxxx. The offset is the length of the ELF file in bytes. Appended to the ELF is the squashfs image.

Tools to work with type 2 images:
https://github.com/probonopd/appimagetool

Example type 2 image:
https://bintray.com/probono/AppImages/download_file?file_path=Leafpad-0.8.18.1.glibc2.4-x86_64.AppImage

Originally created by @probonopd on GitHub (Oct 16, 2016). Original GitHub issue: https://github.com/netblue30/firejail/issues/861 Please support the AppImage [type 2 image format](https://github.com/AppImage/AppImageSpec/blob/master/draft.md#type-2-image-format). This is the next-generation format that is using squashfs instead of ISO9660, and enables features such as embedded GPG signatures and other new functionality. It should be pretty straightforward to use type 2 images, loop-mount them using the kernel with `-o,offset=xxxxx`. The offset is the [length of the ELF file](https://gist.github.com/probonopd/a490ba3401b5ef7b881d5e603fa20c93) in bytes. Appended to the ELF is the squashfs image. Tools to work with type 2 images: https://github.com/probonopd/appimagetool Example type 2 image: https://bintray.com/probono/AppImages/download_file?file_path=Leafpad-0.8.18.1.glibc2.4-x86_64.AppImage

gitea-mirror

2026-05-05 06:13:13 -06:00

closed this issue
added the
enhancement
label

gitea-mirror commented

2026-05-05 06:13:19 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 16, 2016):

Will do!

@netblue30 commented on GitHub (Oct 16, 2016): Will do!

gitea-mirror commented

2026-05-05 06:13:22 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 23, 2016):

Looks pretty cool, you basically cut the size of the image in half! I have the support in, it will autodetect the type and mount iso or squashfs accordingly:

$ firejail --private --appimage appimage-name

For now use --private or a --profile command. I'll bring in support to pick up a profile automatically based on the application name.

@netblue30 commented on GitHub (Oct 23, 2016): Looks pretty cool, you basically cut the size of the image in half! I have the support in, it will autodetect the type and mount iso or squashfs accordingly: ``` $ firejail --private --appimage appimage-name ``` For now use --private or a --profile command. I'll bring in support to pick up a profile automatically based on the application name.

gitea-mirror commented

2026-05-05 06:13:25 -06:00

Author

Owner

@probonopd commented on GitHub (Oct 23, 2016):

Cool, thanks, will test asap.

@probonopd commented on GitHub (Oct 23, 2016): Cool, thanks, will test asap.

gitea-mirror commented

2026-05-05 06:13:28 -06:00

Author

Owner

@probonopd commented on GitHub (Oct 23, 2016):

Isn't it dangerous that the user can launch the app directly from /run/firejail/appimage/appimage-...?

@probonopd commented on GitHub (Oct 23, 2016): Isn't it dangerous that the user can launch the app directly from `/run/firejail/appimage/appimage-...`?

gitea-mirror commented

2026-05-05 06:13:30 -06:00

Author

Owner

@probonopd commented on GitHub (Oct 23, 2016):

Do we really need that many processes around?

24121 ?        S      0:00 firejail --private --appimage /home/me/Downloads/Code::Blocks_IDE-16.01.glibc2.14-x86_64.AppImage
24122 ?        S<     0:00 [loop6]
24125 ?        S      0:00 firejail --private --appimage /home/me/Downloads/Code::Blocks_IDE-16.01.glibc2.14-x86_64.AppImage
24127 ?        S      0:00 /bin/bash /run/firejail/appimage/appimage-24121/AppRun
24131 ?        Sl     0:01 /run/firejail/appimage/appimage-24121/usr/bin/codeblocks

@probonopd commented on GitHub (Oct 23, 2016): Do we really need that many processes around? ``` 24121 ? S 0:00 firejail --private --appimage /home/me/Downloads/Code::Blocks_IDE-16.01.glibc2.14-x86_64.AppImage 24122 ? S< 0:00 [loop6] 24125 ? S 0:00 firejail --private --appimage /home/me/Downloads/Code::Blocks_IDE-16.01.glibc2.14-x86_64.AppImage 24127 ? S 0:00 /bin/bash /run/firejail/appimage/appimage-24121/AppRun 24131 ? Sl 0:01 /run/firejail/appimage/appimage-24121/usr/bin/codeblocks ```

gitea-mirror commented

2026-05-05 06:13:34 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 23, 2016):

Do we really need that many processes around

You can get rid of 24127 if you use --shell=none. I don't know what that [loop6] process is.

Isn't it dangerous that the user can launch the app directly from /run/firejail/appimage/appimage-...?

The idea is to mount it under /run instead of /tmp because in /tmp everybody has write access, while in /run only root can write.

@netblue30 commented on GitHub (Oct 23, 2016): > Do we really need that many processes around You can get rid of 24127 if you use --shell=none. I don't know what that [loop6] process is. > Isn't it dangerous that the user can launch the app directly from /run/firejail/appimage/appimage-...? The idea is to mount it under /run instead of /tmp because in /tmp everybody has write access, while in /run only root can write.

gitea-mirror commented

2026-05-05 06:13:36 -06:00

Author

Owner

@probonopd commented on GitHub (Oct 23, 2016):

How can we avoid the artefact that file managers show a new disk for a fraction of a second during mounting and unmounting?

Similarly, can it be that Firejail interferes (i.e., breaks) Startup Notifications? Note the two icons instead of one.

This is the relevant desktop file:

[Desktop Entry]
Name=Corebird
GenericName=Twitter Client
GenericName[ar]=عامل تويتر
GenericName[de]=Twitter Client
GenericName[es]=Cliente Twitter
GenericName[ja_JP]=Twitter Client
GenericName[nl]=Twitter-client
GenericName[pl]=Klient Twittera
Keywords=twitter;
Exec=firejail --env=DESKTOPINTEGRATION=appimaged --noprofile --appimage '/isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage'
Type=Application
Icon=appimagekit_b92e28fe0a4b822555a829fe44a719af_corebird
Categories=Network;GTK;
Comment=Use Twitter from within a normal desktop application
Comment[es]=Usa Twitter desde una aplicación de escritorio común
Comment[nl]=Twitter gebruiken vanuit een normaal desktop-programma
Comment[pl]=Korzystanie z Twittera w zwykłym programie
TryExec=/isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage
Actions=AppImageUpdate;
X-AppImage-Comment=Generated by appimaged a49019d
X-AppImage-Identifier=b92e28fe0a4b822555a829fe44a719af

[Desktop Action FirejailProfile]
Name=Run without sandbox profile
Exec=firejail --env=DESKTOPINTEGRATION=appimaged --private --appimage '/isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage'
TryExec=firejail

[Desktop Action AppImageUpdate]
Name=Update
Exec=AppImageUpdate /isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage
TryExec=AppImageUpdate

In case you wonder, these entries were generated by the appimaged daemon which now uses firejail if it is installed.

@probonopd commented on GitHub (Oct 23, 2016): How can we avoid the artefact that file managers show a new disk for a fraction of a second during mounting and unmounting? ![peek 2016-10-23 16-10](https://cloud.githubusercontent.com/assets/2480569/19626883/4f0f94fa-993b-11e6-8d28-5db903f41480.gif) Similarly, can it be that Firejail interferes (i.e., breaks) Startup Notifications? Note the two icons instead of one. ![peek 2016-10-23 16-49](https://cloud.githubusercontent.com/assets/2480569/19627151/bac00810-9940-11e6-89c8-4e3016b4537e.gif) This is the relevant desktop file: ``` [Desktop Entry] Name=Corebird GenericName=Twitter Client GenericName[ar]=عامل تويتر GenericName[de]=Twitter Client GenericName[es]=Cliente Twitter GenericName[ja_JP]=Twitter Client GenericName[nl]=Twitter-client GenericName[pl]=Klient Twittera Keywords=twitter; Exec=firejail --env=DESKTOPINTEGRATION=appimaged --noprofile --appimage '/isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage' Type=Application Icon=appimagekit_b92e28fe0a4b822555a829fe44a719af_corebird Categories=Network;GTK; Comment=Use Twitter from within a normal desktop application Comment[es]=Usa Twitter desde una aplicación de escritorio común Comment[nl]=Twitter gebruiken vanuit een normaal desktop-programma Comment[pl]=Korzystanie z Twittera w zwykłym programie TryExec=/isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage Actions=AppImageUpdate; X-AppImage-Comment=Generated by appimaged a49019d X-AppImage-Identifier=b92e28fe0a4b822555a829fe44a719af [Desktop Action FirejailProfile] Name=Run without sandbox profile Exec=firejail --env=DESKTOPINTEGRATION=appimaged --private --appimage '/isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage' TryExec=firejail [Desktop Action AppImageUpdate] Name=Update Exec=AppImageUpdate /isodevice/Applications/Corebird-0.9.glibc2.14-x86_64.AppImage TryExec=AppImageUpdate ``` In case you wonder, these entries were generated by the `appimaged` daemon [which now uses firejail](https://github.com/probonopd/appimagetool/commit/1e804b1631a2698dfc070e1d3c48a110e1d70c01) if it is installed.

gitea-mirror commented

2026-05-05 06:13:40 -06:00

Author

Owner

@probonopd commented on GitHub (Oct 23, 2016):

firejail --noprofile --shell=none --appimage ... results in Error: --shell=none configured, but no program specified

@probonopd commented on GitHub (Oct 23, 2016): `firejail --noprofile --shell=none --appimage ...` results in `Error: --shell=none configured, but no program specified`

gitea-mirror commented

2026-05-05 06:13:42 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 23, 2016):

I think by mounting to a mountpoint starting with "."

Done, grab the latest from git. I'll look into --shell=none, it looks like a bug on my side.

@netblue30 commented on GitHub (Oct 23, 2016): > I think by mounting to a mountpoint starting with "." Done, grab the latest from git. I'll look into --shell=none, it looks like a bug on my side.

gitea-mirror commented

2026-05-05 06:13:44 -06:00

Author

Owner

@probonopd commented on GitHub (Oct 23, 2016):

I think by mounting to a mountpoint starting with "."

Actually my mistake, having the mountpoint start with "." does not fix this. I currently don't know how to do this properly.

@probonopd commented on GitHub (Oct 23, 2016): > I think by mounting to a mountpoint starting with "." Actually my mistake, having the mountpoint start with "." does **not** fix this. I currently don't know how to do this properly.

gitea-mirror commented

2026-05-05 06:13:46 -06:00

Author

Owner

@netblue30 commented on GitHub (Oct 23, 2016):

No problem.

@netblue30 commented on GitHub (Oct 23, 2016): No problem.

gitea-mirror referenced this issue

2026-05-05 10:05:48 -06:00

[PR #584] [MERGED] Add profile for Firefox ESR #3674

Rows
Columns

[GH-ISSUE #861] Support AppImage type 2 image format #584