Flatpak Hardware Acceleration#

The Flatpak sandbox isolates applications from the host system — GPU and hardware media decode access must be explicitly bridged. Bluefin implements full automation for NVIDIA GPU runtime extensions and provides a Firefox-only browser pref for hardware video decoding. For non-NVIDIA VA-API (Intel and other hardware), no equivalent automation exists; that gap is a known limitation.

NVIDIA: Automated GL Runtime Extension Sync#

Flatpak apps using GPU acceleration require an org.freedesktop.Platform.GL.nvidia-<version> extension whose version exactly matches the loaded kernel driver. Without it, GPU-accelerated Flatpaks silently fall back to software rendering. This is a known upstream Flatpak limitation (see flatpak/flatpak#3907), and Bluefin works around it with a dedicated sync service.

The Script: ublue-nvidia-flatpak-runtime-sync#

ublue-nvidia-flatpak-runtime-sync reads the running driver version from /sys/module/nvidia/version and converts it to Flatpak's dot-to-dash naming convention (e.g., 570.153.02 → 570-153-02) 1.

It has two modes 2:

• check — exits 0 if either GL or GL32 extension is missing (sync needed), exits 1 if both are already installed (no-op).
• sync — installs org.freedesktop.Platform.GL.nvidia-<ver> and org.freedesktop.Platform.GL32.nvidia-<ver> from Flathub, then runs flatpak update --system --noninteractive to bring all system Flatpaks current in the same pass.

The Service: ublue-nvidia-flatpak-runtime-sync.service#

ublue-nvidia-flatpak-runtime-sync.service wires the script into boot:

The service runs on every boot but the check pre-condition short-circuits if the correct extension is already installed, making it a no-op after the first successful sync 4.

VA-API / Hardware Video Decoding: Current State#

There is no VA-API sync service or Flatpak override equivalent to the NVIDIA GL mechanism. The common repository contains no LIBVA_DRIVER_NAME, intel-media-driver, or libva configuration under system_files/.

Firefox Exception#

Firefox (Flatpak) has hardware video decoding forced on at the browser pref level via 01-bluefin-global.js:

media.hardware-video-decoding.force-enabled = true
gfx.webrender.all = true

This works when the host VA-API stack is functional (e.g., intel-media-driver or Mesa's radeonsi backend is present), but it is a browser preference, not a Flatpak sandbox permission grant. Firefox's Flatpak sandbox already has device access configured upstream on Flathub.

Other Flatpak Apps#

For any other Flatpak app that needs VA-API (e.g., video editors, media players), users must manually grant device access:

# Grant DRI device access to a specific app
flatpak override --user --device=dri com.example.App

# Or use Flatseal (GUI) — installed by default on Bluefin

There is no system-wide VA-API Flatpak override pre-configured in Bluefin. Users needing hardware decode in media applications outside Firefox should verify the app's Flathub permissions and use Flatseal to inspect or add --device=dri.

Flatpak Overrides Architecture#

Bluefin ships Flatpak permission overrides through two paths 5:

• System-level (/usr/share/ublue-os/flatpak-overrides/): Symlinked at runtime via tmpfiles.d to /var/lib/flatpak/overrides/. Currently only Bazaar has a system override (grants host-etc filesystem access) 6. No hardware device grants are pre-configured here.
• User-level (/etc/skel/.local/share/flatpak/overrides/): Seeded for new user accounts. Currently covers VS Code (Wayland socket + Podman socket) and Chrome (local app/icon paths) 7 8. No hardware device grants here either.

Neither override path includes --device=dri or any VA-API-related permissions for media applications. GPU hardware access in Flatpak apps — beyond NVIDIA's automated GL extension sync and Firefox's built-in pref — requires user action.

Key Source References#