Containers

toolbox / distrobox

Keep locked /usr/bin/toolbox and distrobox* are wrappers until you opt in. podman stays (Flatpak needs it). A pet Fedora toolbox is a whole extra distro: packages, debug symbols, and habits that skip the host lockdown.

  1. Prefer not to

    CLI tools that exist as Flatpak or as a one-off in the house browser should stay there. Development that needs a fat userspace is the honest case for toolbox.

  2. Turn the real bins back on

    ujust set-toolbox on

    Then use toolbox/distrobox as on stock Atomic. User namespaces for unconfined stay off; Flatpak userns stays on. If a container fails, read their FAQ (userns / malloc) before disabling harden_userns — we keep that module on.

Full /usr/bin/toolbox is a bypass of the PATH stub. That is why the default is a wrapper, not a missing package. Off again: ujust set-toolbox off.