Application isolation

The sandbox itself is as good as any other unprivileged container based on namespaces: the sandboxed app has access to the kernel's (significant) attack surface, but with strict permissions it can't do much to interact with the rest of the system. On some kernel configurations (notably Debian and RHEL), bubblewrap normally needs to be setuid; on others (notably Fedora and Ubuntu), it can be unprivileged. (The difference is because by default Debian and RHEL kernels don't let unprivileged users create their own user namespaces, whereas Fedora and Ubuntu kernels do.)

The fine print is that to let an app do useful things (draw a window, play sounds, contact network services, load and save per-user preferences, etc.) it needs to have some permissions (gaps in the sandbox boundary), and at the moment many of those permissions are more coarse-grained than you might hope: for example, access to PulseAudio is currently a binary yes/no choice per app, and there's no way to say "this app can play sounds, but can't use PulseAudio's shared-memory transport, and can't record". This should get better with continued development, partly in Flatpak itself and partly in other projects adjacent to it.