Apps

Stock installers, asked on Unwoke

Asked, not silent Same command names as stock. Their scripts would skip overlay locks (Flathub off, lockdown, toolbox stubs, temp noexec). We intercept them. Compose renames theirs to NAME-stock. Vendor yum-repos (Proton, IVPN, Mullvad, Tailscale) are watched and healed. Nothing auto-unlocks.

Secure default. If you never install these, leave the locks. Typing the stock command still opens our wizard.

  1. Steam

    ujust install-steam

    Flatpak (unfiltered Flathub) or Distrobox steambox. Asks Flathub/lockdown/temp/mic/BT or toolbox+userns. Steam tutorial.

  2. VPN

    ujust install-vpn

    Does not run stock’s layerer (that can disable Unbound). Menu: Proton / IVPN / Mullvad (WireGuard first) or Tailscale (asked extra repo). Same as ujust install-proton and friends.

  3. Docker

    ujust install-docker

    Intercepted. Prefers podman (already installed). Docker CE is a root-equivalent daemon. Asks leftover container userns first. Undo: leftover ujust uninstall-docker.

  4. Dangerzone

    ujust enable-dangerzone

    Asks leftover container userns + ptrace, then stock’s helper. Podman is not stubbed.

  5. Distrobox / toolbox assemble

    ujust set-toolbox on
ujust distrobox-assemble

    Our /usr/bin/distrobox is a stub until the wrapper is on. Assemble asks that first, then leftover container userns.

  6. Unfiltered Flathub

    ujust set-flathub full

    Stock set-flathub-unfiltered on is mapped onto that so the stamp survives reboot. Prefer verified unless you need Steam-class unverified apps.

Not app installers (leave leftover stock): Secure Boot key, kargs, USBGuard, audit, cups, xwayland, ptrace, brew (our ujust set-brew), rebase-secureblue (that leaves Unwoke — do not run it).