Sandstorm is also an extremely security-oriented way of running packaged apps. It uses an advanced sandbox that has defeated many kernel zero-day vulnerabilitie

Sandstorm is also an extremely security-oriented way of running packaged apps. It uses an advanced sandbox that has defeated many kernel zero-day vulnerabilities. It utilizes the Cap'n Proto serialization + RPC protocol, another security-oriented project of Kenton. Security is critical for a platform for self-hosted apps. One vulnerable or malicious app shouldn't be able to compromise your entire platform. Docker-based solutions don't provide this.