OS: Ubuntu 22.04

I am not aware of Flatpak being able to perform mounts as this usually requires superuser privileges and would severely decrease the sandbox security. Also there doesn't seem to be any portal with such functionality: https://docs.flatpak.org/en/latest/portal-api-reference.html.

If you come up with a concept for an implementation, I am happy to reopen this issue.

I've tested Vorta from Flatpak, too, which can mount borg-backup repositories.
Maybe you could use that as a reference?

I'm not sure, but I think it is using FUSE which is a technology in Linux to mount without superuser privileges necessary.

Yes, Vorta is using FUSE with Flatpak: https://github.com/flathub/com.borgbase.Vorta/blob/master/com.borgbase.Vorta.json#L35

Thanks for the reference!

I think the important part is --device=host which is poking another giant hole into the sandbox and allows full access to all devices. I will think about it and reopen the issue.

You could try to add the device permission via Flatseal or some flatpak run argument in the meantime and see if this is the only missing bit.

In Flatseal, in Vortas settings I only find device=all and filesystem=host enabled, no device=host (neither enabled nor disabled)...

device=all does not enable mounting support.

filesystem=host is already enabled in default sandbox settings

My guess: At least the library for FUSE mounts has to be present inside of the sandbox environment, like in the link I shared before: https://github.com/flathub/com.borgbase.Vorta/blob/master/com.borgbase.Vorta.json#L35

If I disable device=all for Vorta, it can't mount anymore.
Error message:

fuse: device not found, try 'modprobe fuse' first

In /dev/, there is a /dev/fuse device.
Maybe it is possible to do something like device=fuse?

Thanks for your tests so far. I think device=all is similar to device=host. I have to do some more research on the differences.

My guess: At least the library for FUSE mounts has to be present inside of the sandbox environment, like in the link I shared before: https://github.com/flathub/com.borgbase.Vorta/blob/master/com.borgbase.Vorta.json#L35

Kopia is a golang app, which is usually built as static executable, meaning that it should already bundle everything required. While it is technically possible to check for assistance of libraries at runtime and adapt behavior, I would say this is unlikely. I guess we need more information about the actual fuse implementation of Kopia. Maybe you could create an issue in the actual project asking for this information and linking this issue?

If you have some no Flatpak version of Kopia, you could look here (https://unix.stackexchange.com/questions/120015/how-to-find-out-the-dynamic-libraries-executables-loads-when-run) how to find out which libraries are loaded while mounting.

The Flatpak basically just unpacks the .deb 😉

device=all disabled leads to [info] /usr/bin/fusermount: fuse device not found, try 'modprobe fuse' first in the logs.
device=all enabled leads to [info] /usr/bin/fusermount: mount failed: Operation not permitted in the logs.

Log dir: .var/app/io.kopia.KopiaUI/config/kopia-ui/logs/main.log

Vorta seems to use an fusermount wrapper: https://github.com/flathub/com.borgbase.Vorta/blob/538fea6543c2875eeb28e5f5a12f998b6ead6a12/dependencies/fusermount-wrapper.sh

https://github.com/flathub/com.borgbase.Vorta/blob/538fea6543c2875eeb28e5f5a12f998b6ead6a12/dependencies/host-command-wrapper.json

Maybe that's the solution?

For some reason mounting doesn't work for me at all. I don't even see the error messages, you posted.

I prepared a branch with the patches from Vorta in #30.

You can build and install the Flatpak via

flatpak-builder build io.kopia.KopiaUI.json --force-clean --ccache --user --install

and run it with device=all via

flatpak run --device=all io.kopia.KopiaUI//master

If it works, can you try if it also works when building without adding libfuse.json?

I have tested the version from testing branch: Click mounting does not do anything.

This time, logs are in ~/.var/app/io.kopia.KopiaUI/cache/kopia/cli-logs/kopia-<date and time>-server-start.0.log

<date and time>:16:41.976592Z INFO kopia/cli 
Server will allow connections from users whose accounts are stored in the repository.
User accounts can be added using 'kopia server user add'.

<date and time>:16:41.976766Z DEBUG kopia/server generated random auth cookie signing key: <SIGNING_KEY>
<date and time>:16:41.979130Z INFO kopia/cli Server will close when stdin is closed...
<date and time>:16:41.979786Z DEBUG tls generating new TLS certificate
<date and time>:16:43.935330Z DEBUG tls adding alternative IP to certificate: 127.0.0.1
<date and time>:16:43.954444Z INFO kopia/cli Open the address above in a web browser to use the UI.
<date and time>:18:28.572959Z DEBUG kopia/server mount controller for HEX_VALUE_WITH_LEN_OF_THIS_STRING not found, starting
<date and time>:18:54.556806Z DEBUG kopia/server mount controller for HEX_VALUE_WITH_LEN_OF_THIS_STRING not found, starting

, <SIGNING_KEY> and HEX_VALUE_WITH_LEN_OF_THIS_STRING are placeholders

This time, in ~/.var/app/io.kopia.KopiaUI/config/kopia-ui/logs/main.log mounting is not mentioned at all. My guess is that at least one error is fixed, but there seems to be another one stated in the ~/.var/app/io.kopia.KopiaUI/cache/kopia/cli-logs/kopia-<date and time>-server-start.0.log log...

I have no idea what is meant with "mount controller". Might make sense to report this issue upstream to get more info...