Starting flatpak under cage?

Hi I’m using cage as DE on my HTPC, and want to start the flatpak rocks.shy.VacuumTube.

Now this is the first time I’m using flatpak so I might be doing things wrong.

I have the following config for cage and audio:

  users = {
    users = {
      htpc = {
        uid = variables.users.htpc.id;
        isNormalUser = true;
        extraGroups = [
          # allow htcp access to keyboards
          "input"
          "dialout"
          "video"
          "render"
          "audio"
        ];
        group = "htpc";
        packages =  with pkgs; [
          xterm
          flex-launcher
        ];
      };
    };
    groups.htpc = {
      gid = variables.users.htpc.id;
    };
  };
  users.extraUsers.htpc.isNormalUser = true;

  services.pulseaudio.enable = false;
  services.pipewire.enable = false;
  services.cage = {
    enable = true;
    user = "htpc";
    program = "${pkgs.flex-launcher}/bin/flex-launcher"; # add -d for debugging
    extraArguments = [ "-d" ]; # add -D for debugging
    environment = {
      SDL_VIDEODRIVER = "wayland";
      SDL_VIDEO_DRIVER = "wayland";
      SDL_AUDIO_DRIVER = "alsa";
      SDL_AUDIODRIVER = "alsa";
      SDL_AUDIO_ALSA_DEFAULT_PLAYBACK_DEVICE = "hdmi:CARD=PCH,DEV=0";
      ML_AUDIO = "sdl";
      AUDIODEV = "hdmi:CARD=PCH,DEV=0";
      QT_SCALE_FACTOR = "3";
    };
  };

For flatpak I have the following but I’m not 100% sure the xdg part is correct.

  services.flatpak.enable = true;
  xdg.portal.enable = true;
  xdg.portal.extraPortals = [ pkgs.xdg-desktop-portal-gtk ];
  xdg.portal.config.common.default = "gtk";

  systemd.services.flatpak-repo = {
    wantedBy = [ "multi-user.target" ];
    path = [ pkgs.flatpak ];
    script = ''
      flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
    '';
  };
}

I have also tried to add the following

  environment.systemPackages = with pkgs; [
    flatpak
    bubblewrap
  ];

But when I try to run flatpak run rocks.shy.VacuumTube I get the error

bwrap: Unexpected capabilities but not setuid, old file caps config
error: ldconfig failed, exit status 256

This is when I run it from a xterm session not using ssh but a keyboard attached to the HTPC.