Filesystem access not working for mounts outside of home

[JaneSmith]

Hello. I've been struggling a bit with the VS Code Flatpak today...

1. I've used Flatseal to disable host and home filesystem access, and added access to the following directory:

/var/home/username/Projects

This works just fine. I'm able to open files and folders in the ~/Projects directory.

Note that I'm testing this using drag+drop from my file manager into VS Code, and that seems to load the filepaths directly. If I use VS Code's open dialog, it seems to use portals, which end up giving me a /run/user/1000/doc/ path which is its own can of worms...

2. I then used Flatseal to add a second directory:

/var/mnt/Data/Projects

This one doesn't work. If I drag+drop anything from this directory into VS Code, the app says it can't find the file.

Note that /var/mnt/Data here is a separate hard drive, permanently mounted via fstab.

If I use a terminal in the app's sandbox, I can see that there is no /var/mnt/ directory in the sandbox. I tried looking around to see if it had been mounted anywhere else, and couldn't find it — and searching online, it seems Flatpak is supposed to always use the same mount path for simplicity.

3. I then tried putting a symlink into ~/Projects, like so:

/var/home/username/Projects/Test -> /var/mnt/Data/Projects/Test (symlink)

Again, this doesn't work. I can drag+drop files from Projects into VS Code just fine, but anything within the Test subfolder doesn't work.

If I use a terminal in the app's sandbox, I can see the Test symlink, but I can't follow it — because /var/mnt/ doesn't exist in the sandbox.

4. I then tried a bind mount instead of a symlink, like so:

/var/home/username/Projects/Test -> /var/mnt/Data/Projects/Test (bind mount)

This one works fine.

---

I'm left feeling quite confused. As far as I can tell, I can add filesystem access to anything under home, but something mounted outside of home won't work. I thought that perhaps /var/ might be a reserved directory (even though Flatseal didn't report any errors), but the Flatpak docs seem to suggest that you can override /var/.

What's going on here? If I'm doing something wrong, then why isn't Flatseal reporting any errors? If I'm not doing anything wrong, then why isn't it working as expected?