What should be the order to look for to install a GUI app?
I prefer flatpak; however, it is sometime unavailable, unofficial, or has issues (even with flatseal).
When to use bluefin-cli, BoxBuddy, or DevPod, and when is a package layering (rpm-ostree install) preferable, and when to fallback on toolbx/distrobox ?
There’s no good answer this project gives you a lot of options to cater to your workflow. In general they should be sandboxed and order doesn’t matter. Bluefin cli is pretty important even though I didn’t get it until I looked at the source. Basically everything through that. Theres a lot of hooks and workarounds it uses.
Personally I go cowboy and do what works and am ready to blow it away.
Thanks for your answer,
Do you have a general rule of thumb to give to someone that is not familiar (but is willing to commit learning) with this workflow yet (like me) ?
The order I like to do things in is Flatpak → distrobox → layering
I have a good answer. 
I only use Flatpaks, and if an app isn’t available in flatpak then I don’t use it. All the other stuff are workarounds for people who have to deal legacy apps.
My app installation order for GUI Apps: Flatpak, AppImage, Distrobox. Whereby distrobox is my last resort if i really need something for my work.
Well, yes, but sometimes I can’t not use it (or at the cost to lose some important features, such as good PWA integrations)
In that case, if a Flatpak is not suitable and you would need that GUI; do you have any advice or guidance ?
Can you help me understand the difference of use cases, preferability, and downsides (side-effects, no automatic updates) between bluefin-cli, BoxBuddy, DevPod, package layering, and toolbx/distrobox ?
And also, when is it a good idea to layer package; System-related only (such as drivers for example) ?
Not really just you’ll be happier running it off a VM with a windows or osx host. You break something no big deal. Here’s what I do dot files and got encrypted on push in a tar to s3. No reason to worry about secrets being leaked etc. I can rebuild fairly fast recreate images etc.
I use flatseal on my chromium browsers to enable PWAs: PWAs: This Flatpak does not have write access to - #2 by castrojo - Flathub Discourse
But that still doesn’t work right because of GNOME, we check on PWA support every once in a while to see if it’s getting better in Linux but the options are still not awesome, but none of that has anything to do with flatpaks. Here’s my list:
boxbuddy and distrobox are for when you need a traditional distro to do something. Like say there’s an app that only comes as a .deb or something and you’re stuck with or you’re helping a friend with something and need a disposable pet container. toolbx we purposely don’t recommend at all.
homebrew is for CLI apps. Some of the things I use are neovim, dysk, gh, glances, grype, helix, micro, ollama, spf, ranger, ripgrep, and yt-dlp.
bluefin-cli is a container designed to be only a distrobox but built on wolfi. The people who want this know they want this so if you’re not sure you don’t need it.
devpod is -dx only for developers who want to connect vscode to other clouds and get a github codespaces-like experience.
I only recommend layering for things like VPN clients, and even then I recommend to people to just use their VPN’s wireguard config and import that into network manager so that they don’t have to layer a package. Others are looser in the approach to this (Bazzite has things that have to be layered for example). But layering isn’t the end of the world, it’s an atomic system, you can always remove it. The downside is when upgrades happen you may end up with the same package conflicts as traditional distros, which is one of the major problems we’re trying to fix in the first place.
All of the options will auto update though, we wouldn’t ship anything that doesn’t auto update.
Sorry this got long lol. The entire point is to move to flatpaks and away from system packaging entirely without bringing any of the baggage with us. So I treat it as a clean slate, apps that don’t have a plan to work right via flatpaks won’t have a sustainable future in this ecosystem anyway so I got that out of the way early. 
For normal users, 95% of them will be served by the browser, brew covers the CLI apps just fine and usually has newer versions of distro packages anyway.
For developers there’s whatever container option they’re into, our out of the box recommendation is vscode/docker/devcontainers. But you can just podman or docker pull whatever you want from the container ecosystem.
Then there’s the pain points, apps like 1password won’t integrate right until there’s more portals, so that one’s a “browser plugin only” which isn’t as nice as the native app but having a working computer is more important to me so I got used to it. And then VPNs for people who can’t use tailscale/mullvad.
Thanks for your help @j0rge 
I don’t know much about those two, which one (between BoxBuddy and Distrobox) is better for which use-case ?
My knowledge stops to “one is a GUI” and “the other is a CLI”, so you’ll probably easily learn me something
Is there any rationale about that ?
The last time I’ve seen it mentioned, I had the impression it was nearly the same as Distrobox
What are the advantages against usual distroboxes ?
Which is not a problem if you ask me
That’s basically it!
We use distrobox because it has a ton more features and is more community driven.
Wolfi is great because it’s built out of github and they’re not a traditional distro, so we end up with smaller images with less security issues: WTF is a distroless container? — Chainguard Academy
WTF is a distroless container?
This was the exact thing I thought when you explained it
I will definitely check it out, thanks !