Desktop security / September 13, 2026
X11 apps get their own private display
Some Linux apps still need X11. cpak lets them open beside your other windows without placing them on the X11 display shared by the rest of your desktop.
X11 comes from a desktop where applications trusted one another. Two apps on the same display can have much more contact than their windows suggest, including access to input and other X11 windows.
A separate display for each cpak app
An X11 app in cpak receives a small private display. cpak presents its windows on your desktop, but the app never receives the connection used by your other X11 applications.
Launch the app as usual. Packages that declare displayX11 receive this setup automatically on both Wayland and X11 desktops.
Copy and paste stays under your control
A package asks separately before it can copy data into or out of its display. cpak passes supported text and images, while file lists stay on their original side.
The app still has its normal window, title, icon, resize and fullscreen behavior. File, device and network access continue to follow their own permissions.
How X11 access compares
This table compares the normal X11 path used by each format. Individual packages can always apply extra restrictions of their own.
| Format | What the app shares | Copy and paste |
|---|---|---|
| cpak | A private display made for that app | Allowed by direction, for text and images |
| Flatpak | Host X11 socket when X11 access is enabled | Shared with the same X11 display |
| Snap | Host X server through the X11 interface | Shared with the same X11 display |
| Native DEB or RPM | Host X11 display by default | Shared with the same X11 display |
