Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. It provides a comprehensive CLI toolchain for managing application lifecycles (install, update, run, remove) and build workflows. The architecture combines a frontend CLI (`app/flatpak-main.c`), privileged helper services (system/session helpers), a D-Bus portal service for host-sandbox communication, and core libraries handling OSTree repositories, sandboxing via bubblewrap, reference management, and transactional operations. Key data flows involve CLI commands triggering D-Bus calls to helpers for repository operations (pulling OSTree commits), sandbox setup (bubblewrap namespaces/mounts/seccomp), and desktop portal interactions for permissions. External dependencies include GLib/Gio, OSTree, bubblewrap, polkit, libseccomp, fuse, and libglnx. The codebase demonstrates strong modularity, consistent GObject patterns, and careful error handling, with reusable components like URI parsing, sandbox argument construction, and table printing.