How to fix error: unable to access files outside of sandbox (flatpak) in Git

Before granting permissions, you need to find the exact Application ID of the Flatpak app causing the issue.

List all installed Flatpak applications:

flatpak list --app

Filter for a specific app (e.g., VS Code):

flatpak list --app | grep -i code
# Example output: Visual Studio Code   com.visualstudio.code   1.85.0   stable   flathub

Common Flatpak application IDs:
| Application | Flatpak ID |
|-------------|------------|
| VS Code | com.visualstudio.code |
| VS Code - OSS | com.visualstudio.code.oss |
| GitKraken | com.axosoft.GitKraken |
| GNOME Builder | org.gnome.Builder |
| JetBrains IDEs | com.jetbrains.* |

Note the full Application ID (like com.visualstudio.code) as you'll need it for the next steps.

Use the flatpak override command to permanently grant filesystem access to the application.

Grant access to your home directory:

# For user-installed Flatpak apps (most common)
flatpak override --user --filesystem=home com.visualstudio.code

# For system-wide Flatpak apps (requires sudo)
sudo flatpak override --filesystem=home com.visualstudio.code

Grant access to a specific directory:

# Access to a specific project folder
flatpak override --user --filesystem=/path/to/your/projects com.visualstudio.code

# Access to multiple directories
flatpak override --user --filesystem=~/projects com.visualstudio.code
flatpak override --user --filesystem=~/work com.visualstudio.code

Grant read-only access (more secure):

flatpak override --user --filesystem=~/projects:ro com.visualstudio.code

Grant access to SSH directory for Git authentication:

flatpak override --user --filesystem=~/.ssh:ro com.visualstudio.code
flatpak override --user --filesystem=~/.gitconfig:ro com.visualstudio.code

Important: After setting overrides, restart the Flatpak application for changes to take effect.

Flatseal is a graphical utility that makes managing Flatpak permissions much easier than command-line tools.

Install Flatseal:

flatpak install flathub com.github.tchx84.Flatseal

Use Flatseal to grant permissions:
1. Launch Flatseal: flatpak run com.github.tchx84.Flatseal
2. Select the problematic application from the left sidebar
3. Scroll down to the "Filesystem" section
4. Toggle on "All user files" for full home directory access, OR
5. Click "Other files" and add specific paths like:
- ~/projects
- ~/.ssh (for Git SSH authentication)
- ~/.gitconfig (for Git configuration)
6. Close Flatseal and restart the application

Benefits of Flatseal:
- Visual overview of all permissions
- Easy to see what access an app already has
- Reset button to restore default permissions
- No need to remember command-line syntax

If you want to grant permissions temporarily without making permanent changes, use the flatpak run command with permission flags.

Run with filesystem access:

# Run VS Code with home directory access
flatpak run --filesystem=home com.visualstudio.code

# Run with specific directory access
flatpak run --filesystem=/path/to/project com.visualstudio.code

# Run with multiple permissions
flatpak run --filesystem=home --filesystem=~/.ssh:ro com.visualstudio.code

Create a shell alias for convenience:

# Add to ~/.bashrc or ~/.zshrc
alias code='flatpak run --filesystem=home com.visualstudio.code'

Run with full host access (not recommended for security):

flatpak run --filesystem=host com.visualstudio.code

This method is useful for:
- Testing if permission is the issue
- One-time access without permanent changes
- Running with different permission sets

Git operations often require access to SSH keys and Git configuration files. Here's how to set up proper access:

Grant SSH directory access:

# Read-only access to SSH keys (recommended)
flatpak override --user --filesystem=~/.ssh:ro com.visualstudio.code

# Also grant access to SSH agent socket
flatpak override --user --socket=ssh-auth com.visualstudio.code

Grant Git configuration access:

# Access to global Git config
flatpak override --user --filesystem=~/.gitconfig:ro com.visualstudio.code

# If using XDG config directory
flatpak override --user --filesystem=~/.config/git:ro com.visualstudio.code

Use host Git commands via flatpak-spawn:
Some Flatpak apps support running host commands. In VS Code, you can configure the integrated terminal to use the host shell:

// settings.json
{
  "terminal.integrated.profiles.linux": {
    "host-bash": {
      "path": "/usr/bin/flatpak-spawn",
      "args": ["--host", "--env=TERM=xterm-256color", "bash"]
    }
  },
  "terminal.integrated.defaultProfile.linux": "host-bash"
}

This allows the terminal to run Git from the host system, bypassing sandbox restrictions.

After making changes, verify that permissions are correctly applied.

Check current overrides for an app:

flatpak override --show com.visualstudio.code

# Check user-level overrides
flatpak override --user --show com.visualstudio.code

View the app's declared permissions:

flatpak info --show-permissions com.visualstudio.code

Reset all overrides to defaults:

# Reset user overrides
flatpak override --user --reset com.visualstudio.code

# Reset system overrides (requires sudo)
sudo flatpak override --reset com.visualstudio.code

Test file access from within the Flatpak:

# Enter the Flatpak sandbox
flatpak run --command=bash com.visualstudio.code

# Check if you can access your files
ls ~/projects
cat ~/.gitconfig
ls ~/.ssh

Common troubleshooting steps:
1. Ensure you're using --user flag for user-installed apps
2. Restart the application after changing permissions
3. Check for typos in the Application ID (case-sensitive)
4. Verify the path exists and is spelled correctly

If Flatpak's sandbox restrictions are too limiting for your development workflow, consider alternative installation methods.

Use native packages instead:

# VS Code from Microsoft repository (Debian/Ubuntu)
wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > packages.microsoft.gpg
sudo install -o root -g root -m 644 packages.microsoft.gpg /etc/apt/trusted.gpg.d/
sudo sh -c 'echo "deb [arch=amd64] https://packages.microsoft.com/repos/code stable main" > /etc/apt/sources.list.d/vscode.list'
sudo apt update
sudo apt install code

# Or use snap (less sandboxed in classic mode)
sudo snap install code --classic

Use AppImage versions:
Many applications offer AppImage downloads that run without sandboxing:
1. Download the .AppImage file
2. Make it executable: chmod +x ./Application.AppImage
3. Run directly: ./Application.AppImage

Keep Flatpak for non-development apps:
You can have both installations:
- Use Flatpak for general applications (browsers, media players)
- Use native packages for development tools that need full system access

Remove the Flatpak version:

flatpak uninstall com.visualstudio.code
# Also remove unused runtimes
flatpak uninstall --unused