4 ms·

Sounds a lot like sandcats (/sandstorm), albeit slightly less ambitious?

by zokier 5y ago

m3nu 5y ago
Sandstorm uses VM templates (Vagrant)[1], so pretty heavy and harder to update. I use Docker images, as provided by the upstream project. So you get the same experience as running it yourself, as well as quick updates. 1: https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tutorial/ https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tu...
- troyjfarrell 5y ago
  Sandstorm uses Vagrant as part of the app packaging (for developers) process. It is _not_ used in everyday use of Sandstorm. Instead, "Sandstorm implements fine-grained containers"[1], not VMs. 1: https://docs.sandstorm.io/en/latest/using/security-practices/ https://docs.sandstorm.io/en/latest/using/security-practices...
  - m3nu 5y ago
    I see. So it’s like Docker, but their own implementation? Can’t wrap my head around it right now.
    - ocdtrekkie 5y ago
      Sandstorm has a pretty unique sandboxing model, which makes it drastically more secure than Docker in practice, but the tradeoffs in terms of packaging differences can be significant. One of the biggest things is that Sandstorm prefers to sandbox individual documents versus applications, which mitigates a huge variety of security flaws in apps. In most cases vulnerabilities in apps on Sandstorm are not exploitable when run on Sandstorm. It also manages most authentication and authorization roles for apps in an integrated way, which requires more integration work than just spinning up a Docker container. Feel free to hit me up if you want to know more, though it would be a lot of work to make Sandstorm work for your business model at this point. It's cool seeing others in the "make open source web apps user-friendly to run" space though.
    - kentonv 5y ago
      See also this blog post: https://sandstorm.io/news/2014-08-19-why-not-run-docker-apps https://sandstorm.io/news/2014-08-19-why-not-run-docker-apps
      - m3nu 5y ago
        Thanks! Will read this later in detail and see if anything can be learnt. I do want to point out that this is from 2014 and we don't use Docker at PikaPods. We use Red Hat's stack, which integrates better with other Linux tools, like SELinux and Systemd.
ocdtrekkie 5y ago
Sandstorm is an open source platform, and this sounds like it is not. But Sandstorm used to offer managed hosting and no longer does, so they fill different niches. I can't run PikaPods in my house and you can't subscribe to Sandstorm right now for someone else to run. (Theoretically you can, but nobody is selling.) It'd be cool to see a service like PikaPods built around Sandstorm as the platform layer, but there's a LOT of work to do to make Sandstorm a good idea to run commercially, and since we aren't running it as such, nobody's really working on those things.
simplehuman 5y ago
More like elestio (managed) and cloudron (selfhosted)
- js4ever 5y ago
  I would say Elestio is more focused on enterprise /startups needs and PikaPods more focused on individuals users

Sounds a lot like sandcats (/sandstorm), albeit slightly less ambitious?

by zokier 5y ago

Sounds a lot like sandcats (/sandstorm), albeit slightly less ambitious?

m3nu 5y ago

Sandstorm uses VM templates (Vagrant)[1], so pretty heavy and harder to update. I use Docker images, as provided by the upstream project. So you get the same experience as running it yourself, as well as quick updates. 1: https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tutorial/ https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tu...

troyjfarrell 5y ago
Sandstorm uses Vagrant as part of the app packaging (for developers) process. It is _not_ used in everyday use of Sandstorm. Instead, "Sandstorm implements fine-grained containers"[1], not VMs. 1: https://docs.sandstorm.io/en/latest/using/security-practices/ https://docs.sandstorm.io/en/latest/using/security-practices...
- m3nu 5y ago
  I see. So it’s like Docker, but their own implementation? Can’t wrap my head around it right now.
  - ocdtrekkie 5y ago
    Sandstorm has a pretty unique sandboxing model, which makes it drastically more secure than Docker in practice, but the tradeoffs in terms of packaging differences can be significant. One of the biggest things is that Sandstorm prefers to sandbox individual documents versus applications, which mitigates a huge variety of security flaws in apps. In most cases vulnerabilities in apps on Sandstorm are not exploitable when run on Sandstorm. It also manages most authentication and authorization roles for apps in an integrated way, which requires more integration work than just spinning up a Docker container. Feel free to hit me up if you want to know more, though it would be a lot of work to make Sandstorm work for your business model at this point. It's cool seeing others in the "make open source web apps user-friendly to run" space though.
  - kentonv 5y ago
    See also this blog post: https://sandstorm.io/news/2014-08-19-why-not-run-docker-apps https://sandstorm.io/news/2014-08-19-why-not-run-docker-apps
    - m3nu 5y ago
      Thanks! Will read this later in detail and see if anything can be learnt. I do want to point out that this is from 2014 and we don't use Docker at PikaPods. We use Red Hat's stack, which integrates better with other Linux tools, like SELinux and Systemd.

ocdtrekkie 5y ago

Sandstorm is an open source platform, and this sounds like it is not. But Sandstorm used to offer managed hosting and no longer does, so they fill different niches. I can't run PikaPods in my house and you can't subscribe to Sandstorm right now for someone else to run. (Theoretically you can, but nobody is selling.) It'd be cool to see a service like PikaPods built around Sandstorm as the platform layer, but there's a LOT of work to do to make Sandstorm a good idea to run commercially, and since we aren't running it as such, nobody's really working on those things.

simplehuman 5y ago

More like elestio (managed) and cloudron (selfhosted)

js4ever 5y ago
I would say Elestio is more focused on enterprise /startups needs and PikaPods more focused on individuals users