Add flatpak support

[wiktorpyk]

Everything works except the .desktop icon. Haven't checked file associations yet

[Spoffy]

Hey @wiktorpyk - thanks for submitting this!

Everything looks good here in terms of the packaging - I had no issues creating and installing the .flatpak on my local system.

Two things that I did see that we need to sort:

• process identifier (PID) is undefined error when opening a document. Is this something you've seen in your testing?
• CI will need sorting in Github Actions to produce the flatpak. Would you up for doing that? Otherwise I'll see if we've got capacity to do it internally.

Once we've sorted those, I'll see if we can get this merged. Whether or not the .flatpak goes on Flathub or is just distributed on Github is something we'll need to decide to.

[wiktorpyk]

Hey, sorry for late reply. I'll be gone for two weeks but I'll look into those asap.

[wiktorpyk]

All seems to work now but the file access permission fix needs more work

[Spoffy]

Hey @wiktorpyk, apologies for the delay with this!

I've been investigating this, and still running into issues with PID not being defined. It looks like an issue with how Grist spawns sandboxes, conflicting with something flatpak's doing with PID namespaces.

This might be a major issue for supporting Flatpak officially, but I'll talk with the team and update you when I've got more info.

If you want to look into this more yourself, here's the error + stack trace I'm getting:

2025-11-03 23:44:15.814 - warn: ActiveDoc _finishInitialization stopped with Error: process identifier (PID) is undefined
    at new DirectProcessControl (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/SandboxControl.js:46:19)
    at Object.control (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/NSandbox.js:533:24)
    at new NSandbox (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/NSandbox.js:84:40)
    at NSandboxCreator.create (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/NSandbox.js:465:16)
    at createSandbox (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/NSandbox.js:925:28)
    at DesktopCreate.NSandbox (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/ICreate.js:76:45)
    at createSandbox (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/ActiveDoc.js:2961:26)
    at ActiveDoc._makeEngine (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/ActiveDoc.js:2671:16)
    at ActiveDoc._getEngine (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/ActiveDoc.js:2646:77)
    at ActiveDoc._rawPyCall (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/ActiveDoc.js:2618:39)
    at TableMetadataLoader.opCorePush (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/TableMetadataLoader.js:125:29)
    at async TableMetadataLoader._counted (/app/lib/com.getgrist.desktop/resources/app.asar/core/_build/app/server/lib/TableMetadataLoader.js:196:20)
    ```

[wiktorpyk]

Hey @Spoffy
How do I recreate that? Does reverting changes from 795e1ad fix it?

[Spoffy]

@wiktorpyk - Don't worry, we found the root cause in the end.

Electron builder uses zypak internally to make the Electron sandbox work with the Flatpak sandbox. Zypak monitors any new programs spawned/forked from the main process, and modifies the command in certain situations to wrap the new process in the Zypak/Flatpak sandbox.

One of those situations is when the process tries to re-invoke it's own binary (as decided by checking the inode numbers on Linux).

Normally, Grist works by spawning an "engine" for each document - this is a new process that handles all the Python.

By default, we use Pyodide to sandbox the engine. Pyodide sandboxes Python using web assembly... which executes inside a node process.

The result was this:

1. Grist desktop begins opening a document.
2. The document tries to start the Pyodide sandbox using process.fork(), which attempts to create a new Node process with the given script.
3. Zypak sees this as "calling itself", and modifies the fork() in a way that breaks the command.
4. Sandbox fails to spawn, so there's no process identifier (PID)... hence the error.

We've put a fix into grist-core, that allows us to pass an extra command to Zypak to bypass both the Electron sandbox (so it just spawns node) and its special process check.

That solves the PID issue and lets Flatpak work!

When we next update Grist Core in Grist Desktop, Flatpak should work as expected, as long as we pass a new environment variable that enables the bypass.