25 ms·

Sandstorm: Open-source platform for self-hosting web apps

468 points by srgpqt 3y ago

explorer83 3y ago
I unfortunately don't have the availability to test their solution. But I love the vision. I hope they pull through.
- nunobrito 3y ago
  There's an online demo on their page. Just click and try out everyting.
srgpqt 3y ago
This project seems like just the thing to kickstart a new era of decentralization/federation for the social web, an answer to Reddit/Twitter/etc.
negative_zero 3y ago
Super cool idea but sadly seems to have been slowly dying over the last few years :( (unless something has changed recently?)
- zenhack 3y ago
  The biggest change lately is probably: https://zenhack.net/2023/01/06/introducing-tempest.html https://zenhack.net/2023/01/06/introducing-tempest.html But yeah, Sandstorm has been in a state of "not dead but not moving fast" basically since the company went under; things picked up a bit in 2020, and I got oriented-enough on the codebase during that time to keep it floating along, but, per the post, it's never been easy going. Anyway, I wish I were answering this question in 6 months time, when I'll be able to show off a variation of Tempest that is relatively usable and can do a few tricks that Sandstorm can't.
  - rapnie 3y ago
    Tempest [0] looks very interesting. What is the current state of the project? [0] https://github.com/zenhack/tempest https://github.com/zenhack/tempest
    - ocdtrekkie 3y ago
      Currently Tempest can run a lot of Sandstorm apps. However, a lot of functionality one would expect or need is not implemented yet. It will be a bit before it can replace a Sandstorm server. But it's architecturally different in some fundamental ways which will make implementing new features that Sandstorm never had much easier.
  - negative_zero 3y ago
    I've book marked Tempest :) Looks promising. Wish you luck!
  - tudorw 3y ago
    always interested in self hosted solutions, not tried sandstorm and up for giving it a go, however if I was starting a small fairly simple personal project with no need to scale can I get wheels on it with Tempest, or should I consider building on sandstorm then porting?
    - ocdtrekkie 3y ago
      All of the dev tools use Sandstorm, and Tempest is not at this point, "complete". But if you were to build something on Sandstorm today, you can be reasonably confident it will work with Tempest.
  - yoz 3y ago
    Just spent ten minutes delightedly reading your updates on this. It looks fantastic! I'm really excited to watch what happens next, and wish I had time to contribute. Are there primary areas in which contributions would be most valuable, especially from those without Golang experience/skills?
    - zenhack 3y ago
      I suppose that depends on what your skill set is. At some point the project would greatly benefit from some attention from a UI/UX specialist -- I'm doing my best, but it's not what I'm an expert at. Though right now I'm mostly focused on getting enough stuff to work for it to be of interest, and someone fussing with the UI might just be distracting. Doing app packaging for Sandstorm might be the most accessible way to help for someone who's not a Go dev -- Tempest will of course benefit from more apps when it's ready to run them, and it'd be a high impact thing for the community right now.
  - deleted 3y ago
    [deleted]
  - techempath9 3y ago
    You've told me about something totally new. I want to get involved with sandstorm. Exciting.
  - techempath9 3y ago
    Can you tell me how I can get involved with sandstorm
c0balt 3y ago
This looks exciting and definitely something to look out for as an option fkr self-hosting. Similiar and a little bit more mature is also YunoHost, https://yunohost.org/ https://yunohost.org/, or for professional environments, UCS https://www.univention.com/ https://www.univention.com/.
- fbartels 3y ago
  The one big plus for ucs is their samba server, but it's not the right choice if you are looking for an appstore to install apps from. My personal favorite is Cloudron, as they have an app concept that only needs minimal human maintenance. And you could even combine it with an LDAP server like ucs for the user management.
wiml 3y ago
I used this for a few years at a previous job and really liked it — it didn't get a ton of adoption by other people there, though, unfortunately. It had a bunch of cool ideas and seemed well implemented. I'm sad that it didn't work out as a commercial endeavor.
- rapnie 3y ago
  I like how they use capability-based security [0] and use Cap'n Proto protocol. This is another technology that is slow to get broad adoption, but has many things going for when compared to e.g. Protocol Buffers (Cap'n Proto is created by the primary author of Protobuf v2, Kenton Varda). [0] https://sandstorm.io/how-it-works#capabilities https://sandstorm.io/how-it-works#capabilities [1] https://capnproto.org https://capnproto.org
  - lrem 3y ago
    Cap'n Proto suffers from trying to improve upon something good enough. It's a real pity, have such a tech without org weight behind it.
    - ocdtrekkie 3y ago
      I mean, Cloudflare has some org weight. Just not Google monopoly weight.
      - hgsgm 3y ago
        Google doesn't have a monopoly on serialization formats.
  - Timon3 3y ago
    I recently evaluated different protocol libraries for inter-language IPC. The state of Cap'n Proto is sadly quite a bit worse than Protobuf. Many languages either don't have an implementation, or it hasn't been updated for several years. But it's such a good system, I wish we could use it.
apitman 3y ago
Sandstorm was (is?) way ahead of its time. Fortunately a lot of its ideas live on (a la capnproto). My understanding is the achilles heel is the amount of effort required to integrate and update apps, since each app needs to be rather invasively modified to work with the centralized authorization framework. Also the general difficulty of managing a VPS or port forwarding. But once integrated it's really slick and secure. The overall UX is very similar to my vision of the future of selfhosting. It should be as easy as installing an app on your phone, then going through a quick OAuth2 flow to set up a tunnel on a domain, and you're up and running.
- ocdtrekkie 3y ago
  I think the answer is that packaging apps for Sandstorm is a bad hack, as ripping out the auth system and design granularity is all hard for an existing application. The best Sandstorm apps are written for Sandstorm, and in those cases, the granularity and built-in authentication make it way easier to write an app. I wrote a Sandstorm-native app in less than an hour. But if you built your entire application assuming you're shipping it via Docker, untangling the sheer amount of redundant garbage you need to pare down to a single-document app that accepts outside authentication and security, ends up being a ton of work to package and then maintain it long-term. Ideally, I think having apps not made for Sandstorm originally is mostly just a strategy to get enough people operating on Sandstorm's model for people to build Sandstorm-specific apps in earnest.
  - robertlagrant 3y ago
    I think making apps that have a very clean separation between external security code (e.g. "the claims in the JWT") and internal security code (e.g. "the app's own internal understanding of security, regardless of provider") is always a fantastic idea.
  - hanniabu 3y ago
    Why not just make it be a docker launcher instead?
    - 3y ago
evolve2k 3y ago
What’s involved to get additional open source “apps” into the store? I was considering Mattermost over Rocket Chat, but it’s not currently supported/listed.
- zenhack 3y ago
  Have a look at the packaging tutorial: https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tutorial/ https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tu...
mcint 3y ago
It's worth mentioning https://YUNoHost.org https://YUNoHost.org. I've done plenty of manual self-hosting. I explored sandstorm for a year or two in the mid 2010s. It worked as promised, but the complexity of integrations, fraying, showed. I switched to yunohost 6 years ago. I almost entirely don't think about it. I use a few services, wallabag and Uptime Kuma. Tried Nextcloud, HedgeDoc /HackMD/CodiMD, and Monica PRM because it was so painless to give them a go. My initial motivation for exploring it, came from the hope it could install NextCloud. My attempts at installing OpenCloud and NextCloud, with scripts that would make non-idempotent changes that fail on a second run after first pass fixes, left me sensing an unfriendly forced upsell environment. I have had to do some manual fixing to complete an upgrade or two, but it has workflows for backups, and some stringent, but fully automated configuration, sanity checking. I don't worry about the complexity.
- ocdtrekkie 3y ago
  My understanding is YunoHost makes absolutely no attempt to isolate apps from one another, it just helps you install stuff on a Linux box. Unfortunately that means a single flaw in a single app compromises your entire server.
  - rapnie 3y ago
    Yes, Yunohost makes installs very easy. But if something isn't working right then you got extra layers to deal with. I don't know how Sandstorm deals with this, but Yunohost taking care of the install and upgrade procedures means that you are bound to the Yunohost integration's version of the software. For instance when installing Discourse via Yunohost this version lags behind significantly. And also Yunohost disables the Discourse upgrade process, while it offers a superior experience.
  - Gigachad 3y ago
    It’s was designed predocker and is a pretty old school setup. I remember they had issues updating Debian because the new Debian had a new php version which caused issues for some apps.
  - navanchauhan 3y ago
RonnieOwnsLexus 3y ago
so essentially if i have a VM, i can just install the apps i require and then use them for my business. This sounds great but then I need to make sure i am monitoring and debugging it if something breaks ? Also how does sandstorm makes money then ?
- rapnie 3y ago
  > Also how does sandstorm makes money then ? It doesn't. It is an open source project. Originally Sandstorm was offered by a startup, but they stopped [0] in 2017. You can make donations though [1]. [0] https://sandstorm.io/news/2017-02-06-sandstorm-returning-to-community-roots https://sandstorm.io/news/2017-02-06-sandstorm-returning-to-... [1] https://sandstorm.io/news/2021-06-17-sandstorm-community-fundraising https://sandstorm.io/news/2021-06-17-sandstorm-community-fun...
arek_nawo 3y ago
This looks really interesting. Having the ability to self-host various open-source apps is great, though, for me at least, it's always a bit stressful. Without a lot of dev ops experience I'm not always confident in my setup and the upgrade process. Having a tool that simplifies self-hosting would certainly lower the "mental barrier" for more people to do it.
- Gigachad 3y ago
  Unfortunately you are probably still better off using commercial hosted services. None of these projects really seemed to have the resources to properly deal with the security you need for an internet hosted service
  - arek_nawo 3y ago
    After a closer look - I must agree. On the other hand, with more projects implementing bash scripts or using Docker for easier installation, maybe there's a way to make self-hosting easier without such dedicated apps. Hosted services will always offer more convenience. If the price is fair, they are likely better options in general.
- deleted 3y ago
  [deleted]
- anderspitman 3y ago
  This is, in my opinion, the biggest gap in the market. Selfhosting shouldn't be any more difficult or less secure than running an app on your phone.
  - arek_nawo 3y ago
    I'm a bit split on this. As an OSS enthusiast I'd certainly like for self-hosting installation and maintenance to be easier. However, from the business perspective, I also see this as just one less reason to use hosted services - which will degrade sustainability of many open source projects.
gitgud 3y ago
Happy to see this project still going. Loved the concept and tried it for a while, but building apps for it was very complicated at the time, which made it much less useful. Looking forward to giving it another shot.
- ocdtrekkie 3y ago
  Probably the biggest revolution in app packaging is there is now a tool that helps automate enabling an app to request outside network resources. It used to require you write some Cap'n Proto and all, now you just need to include powerbox-http-proxy in your app package, more or less.
cpa 3y ago
I've tried sandstorm and yunohost but those didn't make me confortable enough to use in a production setting. I've been using cloudron.io for a few years and it's great. Never had issues with data loss or updates.
- smartbit 3y ago
  12*15=$180/year/person for cloudron.io is not the cheapest. Have you considered or tried nextcloud?
  - cstork12 3y ago
    not "/person" but "/host", right?
  - cpa 3y ago
    I'm also using apps such as grafana, prometheus, gitlab… So nextcloud by itself wouldn't cut it. I'm willing to pay (it's $15/mo per server, not per user) because I want something reliable that I won't have to spend a lot of time on. And also because we're a company, not just a random enthusiast :)
asim 3y ago
When an idea like this strikes but doesn't take off there's definitely an element of "before it's time" but it's also really hard to get people to adopt opinionated development models unless it's part of a bigger language ecosystem or brand which can offer the scale of opportunity like an app store. There's been attempts to do this without the opinions e.g deploy docker containers but the reality is we do actually need a cohesive vision for the end user for anything like this to take off. Catering to the developers alone in the self hosted model is very hard. And I know Kenton tried hosting too. It's just a tough business all around.
tibbydudeza 3y ago
NextCloud and OwnCloud already exists.
- garganzol 3y ago
  NextCloud and OwnCloud are productivity suites (the analogy is Microsoft Office), while Sandstorm is an operating environment (the analogy is Microsoft Windows).
neets 3y ago
It's worth mention umbrel, https://umbrel.com/ https://umbrel.com/ Once umbrel is setup apps are are just as easy to update and install as an iPhone. I also appreciate how it has a dependency system so apps can build on one another. Umbrel is more for personal homelab rather than sharing with friends, there is no public endpoint you would want on the clearnet, you need to VPN in, but that also makes it more secure.
- jesterson 3y ago
  Is it something operational or it's all on pre-order? Fancy website hints on prevalence of form over substance, although perhaps it's just me. People who are concerned about privacy and big corporations don't need fancy rotating boxes, rather clear and concise explanation of the matter. Just my 2 cents
  - garganzol 3y ago
    I installed Umbrel on a VM. It demonstrates a few interesting ideas, but at the same time a form over function is everywhere with nothing fundamental to compensate for that. So you are kind of right.
- sverhagen 3y ago
  That website is a very impressive piece of work, but it's also massive friction, if I may say so. "Get up and running in 30 seconds." Pf... can't even get to what they're "selling" in that time. Scroll, scroll, more scroll. A nice, to the point pitch would be nice. Same for Yuno, which people are touting in other threads here, no one seems to be getting to the point "any time soon" on these pages. Sandstorm is probably the best of the bunch at that, but even there I didn't quite get it until I came to the discussion here on HN.
  - nunobrito 3y ago
    Umbrel is OK. Worked good for me, indeed is relatively easy and a huge amount of apps for install. Mostly related to bitcoin.
  - 3y ago
the_common_man 3y ago
https://cloudron.io https://cloudron.io is a viable alternative.
sunshine-o 3y ago
I feel like we are always getting into the same trap with those self-hosting platforms. It is the same problem we faced with the Linux Desktop & Mobile. A lot of cool visions, but fragmented efforts, limited app ecosystem & low adoption. We already have Sandstorm, Umbrel, Start9, Yuno, etc. but none of them had the success they deserved. I'm wondering if taking something like Fedora CoreOS/IoT, Cockpit, linuxserver.io images & develop a nice GUI & documentation on top wouldn't have much greater chance to succeed. People who will try to self host & will most likely stick to it are already familiar with tech & willing to tinker anyway.
- prox 3y ago
  Engineers love engineering, they love their own engineering when it comes to open source/free time projects, and they tend to not like the legwork of publishing, polishing and making it ready for public consumption. (Which is a lot of work on its own) Engineers and QA/useability/marketing people tend not to mingle in these projects. I am broken record at this point, but Blender and Godot tackled this problem. Take sandstorm, it looks like a informative website but just looking at it I see a ton of friction installing it. Whether or not that is true, but the optics are against it.
  - orblivion 3y ago
    That's a useful bit of feedback. Indeed I would actually say that installation is quite simple as such things go. And maintenance is dead simple, it updates itself in the background.
  - kentonv 3y ago
    Sandstorm was actually a startup with product and marketing and we did spend a lot of time trying to make it as simple as possible to install. The only way to make Sandstorm easier to set up would be to partner with hosting providers to offer one-click installers. In the absence of that, Sandstorm's current install is about as easy as it could possibly be given the constraint of "should run on a generic Linux host". (Aside: People have always given Linux flak for being hard to install. But have you ever tried to install Windows from scratch? It's sooooo much harder. But no one cares because it's preinstalled on every PC you buy.) (Aside 2: How did Chrome become the most popular browser? Sure as hell not because it's so easy for people to install. Most people don't know what a browser is. It got there by Google paying a lot of people to bundle it. It's honestly amazing that Google pulled it off, against competitors who owned their respective operating systems.) Anyway, back in the day, Sandstorm actually offered its own hosting service, which you didn't need to be technical to sign up for. So it was actually quite easy then. But it was a first-party service. In retrospect I think building the first-party service was a mistake. It distracted too much engineering time away from actually building out the platform and ecosystem. It meant we could offer a better price point than a VPS provider would, but I think the people actually interested in the product at that point weren't so price-conscious. If I did it again I'd focus on partnerships.
brynjolf 3y ago
It is hard trying it figure out what path to choose. Do you just run Docker or do you combine it with Docker Compose? Do you instead opt for Proxmox in combination with Podman? Maybe you opt for something simpler like this tool; Sandstorm. Or even more complex of a setup with a K8 cluster with combined with Gitops. It is interesting and a lot of really good tools to chose from but it is not obvious to me.
madacol 3y ago
For me, the biggest blocker for using Sandstorm has been the inability to run on ARM https://github.com/sandstorm-io/sandstorm/issues/2083 https://github.com/sandstorm-io/sandstorm/issues/2083
- hgsgm 3y ago
  Sandstorm's value prop is such that if you wanted its benefits, a one time purchase of a low end micro PC shouldn't be the blocker.
monkeydust 3y ago
Looks like Caprover https://github.com/caprover/caprover https://github.com/caprover/caprover which has been around for a bit, have used in past. Any notable benefits over it?
- hgsgm 3y ago
  Fromctheb readme, Caprover is developers developers developers developers. Sandstorm is for users/admins to deploy many apps together.
xorcist 3y ago
I have used Sandstorm quite a bit in the past for smaller clients. It's remarkably sane and works as described. Sometimes it could be a little slow with getting updates, but I don't know if that's still a thing. The space of Linux distros specifically for self-hosting data has always been a little fragmented, which is a shame since it's really useful for the intended audience. A bit like Linux distros in general, perhaps. Maybe if one of the bigger distributions, like Debian or Fedora, got behind one system it would improve. But that's also how we ended up with Flatpak and Snap, so it could be either way really.
davidy123 3y ago
I saw "semantic model" and got excited, but that's at the "grain" level. The idea of applications has been stale for a long time, it just takes a long time for people to get there. Microsoft doesn't want it to happen quickly because they like selling Office as a package, but they're slowing decomposing it. OLE was a micro step, now with a cloud graph model and AI they're going much deeper. Ultimately, your "table" can be generated from data in a "spreadsheet" or "database." And your AI can interact with this data precisely. At a certain level, you really shouldn't need to care where something was generated or viewed. It's data. But the more strongly it's "typed," the more accurate everything becomes. Yes there's some hype over AI, but it is just incredibly useful, even the most basic and stumbling step of importing your documentation to an app or browser based AI to answer questions. Anything that doesn't include it as a first class consideration is last epoch, in the same category as Visicalc, 1979. Unfortunately, that includes the vast majority of Open Source. KDE was way ahead of this, but they stumbled. I hope they can catch up. Local, Open Source AI needs to leap ahead or computing is going to collapse. So the first step is to give all the data a schema, ideally a domain-relative one so it's interoperable. See Linked Data.
openscript 3y ago
For the services at home I use https://www.runtipi.io/ https://www.runtipi.io/. I'm quite happy with it.
mawise 3y ago
On the other side of things, I've started using https://www.pikapods.com/ https://www.pikapods.com/ they follow the docker model but are a paid (~$2/mo) hosting provider focusing on open-source self-hostable apps. Seems to me like an easier path for getting non-techies to 'selfhost' their own apps.
- ssddanbrown 3y ago
  Pikapods have provided my software for a while. Have not had much feedback from users yet, but no bad feedback is a good sign I guess. The person behind PikaPods was very receptive to my concerns that their website mentioning of "upstream revenue share" could be misleading (didn't apply for my project), and they quickly took action to improve things.
antifa 3y ago
I've had pretty good experiences with https://yacht.sh/ https://yacht.sh/, which only does docker containers.
electroagenda 3y ago
Sorry for the silly question but I don't get it. Is this a remote server where you can install and use web apps from third parties? Or can you actually build a web app there so that users can employ it? Something similar to Digital Ocean.
- orblivion 3y ago
  It's a platform that you install on your own server, at home or on a VPS (Digital Ocean, etc). The installation is a few simple CLI steps. From there everything is in the browser, including the admin. Each user, once logged in, can install whatever apps they want from the app store. Or they can upload their own if they want. This is safe because everything is containerized. Apps have to be specially designed (or retrofitted) for Sandstorm, though.
kev_emu 3y ago
Another twist on self hosted web apps is peergos. Uses a capability based system for access and sharing. End-to-end encrypted and P2P. App Examples - github.com/peergos/example-apps API Docs - book.peergos.org/features/apps.html Disclaimer: I work on the project.
johackim 3y ago
There is an alternative : https://github.com/ethibox/ethibox https://github.com/ethibox/ethibox
haolez 3y ago
Suppose I'm willing to build an ecosystem of internal tools for my company. Can Sandstorm make my life easier in this kind of effort? Or is the added complexity simply not worth it? I'm curious about how I'd deal with data sharing in my enterprise if each user has a set of data "grains".
retrocryptid 3y ago
So... this is a company that sells a service that lets you run an app on 127.0.0.1?
- cstrahan 3y ago
  Nope. The service, like any other, is them hosting the software (Sandstorm) and the software/apps you choose to run therein. It’s also open source, so you can choose to host Sandstorm yourself, instead of using their service. You didn’t ask what Sandstorm is, so I’m assuming you already understand what it is.
  - retrocryptid 3y ago
    But you run it in your data center? Is it just some pre-configured apps you can run on a machine / vm / container wherever? I mean... that's not completely without merit. But isn't this just what we used to call "software" ??
    - kentonv 3y ago
      To clarify, Sandstorm does not sell any service today. It is an open source project that makes it much easier to self-host apps on your own server -- maybe in a datacenter, maybe on a device in your home. Once upon a time, years ago, Sandstorm was a startup, and that startup did offer a paid hosting service as an option. However, that startup shut down a while ago and the paid hosting service went away. But the open source project lives on. (I was the co-founder of said startup.)
    - cstrahan 3y ago
      > But isn't this just what we used to call "software" ?? By way of analogy: You could carry around a phone that has a simple Linux distro running on it. And while we're at it, what's the point of having a package repository? So we could get rid of that, and compile all our software from source. So the user experience is something like: SSH into your phone, curl down a source tarball for the calculator software you would like to run on your phone, and first make sure you have all of the build dependencies installed, and now make && sudo make install. So what's the point of Android or iPhones? Well, I'm very technically proficient, and yet I don't want to SSH into my phone and make && sudo make install. God help my non-techie family and friends. We all want to install software that has gone through at least some semblance of an audit, and we want to install it trivially, and we want that software to then run in a minimally privileged sandbox. While a "phone app" is technically "software", the distinguishing factor is that aforementioned features are implied when someone says "app". So recap of what it's like to use a phone app: - There's a distribution channel that makes it easy to search for and install the app of your choosing. - The apps run in a sandbox. Privileges/capabilities are surfaced through a common setting UI: don't want the app to be able to send you notifications? You can toggle that in a way that the app can't circumvent. Maybe you do or do not appreciate these features. But if you, like many, do appreciate these features, the a logical question is: is there anything like this but for software we want to use outside the context of our phones? And, well, if we're wanting this software to be accessibly not only on our phone, we should probably make this as maximally accessible as we can, and what could be more accessible than a browser based app -- now you're not limited to using it just from your phone (though that's possible too), you can access it from your laptop, or a friend's computer, or your gaming console's browser, or anywhere else where you can browse the web. So that's what Sandstorm is, more or less. Trivially installable apps, where you can completely own your own data (if you're hosting yourself), and even if someone else is hosting Sandstorm you can trivially export your data, the whole app is sandboxed, you have a common dashboard for controlling each app's capabilities, etc.
XCSme 3y ago
I am using Caprover, and I assume Sandstorm is similar. While the idea is good, and it works well, finding supported apps is hard. Many apps have to develop individually config files for each such platform and maintain them updated. Very few platforms do it. In the end, I find the LAMP stack the best for self-hosting, especially with an interface like cPanel. You can simply upload files and the app works (PHP), you can view the databases (PHPMyAdmin), most hosting companies support it, there are many apps built on it.
ptman 3y ago
Host for free in the cloud: https://paul.totterman.name/posts/free-clouds/ https://paul.totterman.name/posts/free-clouds/
yujian 3y ago
https://www.youtube.com/watch?v=y6120QOlsfU https://www.youtube.com/watch?v=y6120QOlsfU
giolekva 3y ago
[dead]

468 points by srgpqt 3y ago

explorer83 3y ago

I unfortunately don't have the availability to test their solution. But I love the vision. I hope they pull through.

nunobrito 3y ago
There's an online demo on their page. Just click and try out everyting.

srgpqt 3y ago

This project seems like just the thing to kickstart a new era of decentralization/federation for the social web, an answer to Reddit/Twitter/etc.

negative_zero 3y ago

Super cool idea but sadly seems to have been slowly dying over the last few years :( (unless something has changed recently?)

zenhack 3y ago
The biggest change lately is probably: https://zenhack.net/2023/01/06/introducing-tempest.html https://zenhack.net/2023/01/06/introducing-tempest.html But yeah, Sandstorm has been in a state of "not dead but not moving fast" basically since the company went under; things picked up a bit in 2020, and I got oriented-enough on the codebase during that time to keep it floating along, but, per the post, it's never been easy going. Anyway, I wish I were answering this question in 6 months time, when I'll be able to show off a variation of Tempest that is relatively usable and can do a few tricks that Sandstorm can't.
- rapnie 3y ago
  Tempest [0] looks very interesting. What is the current state of the project? [0] https://github.com/zenhack/tempest https://github.com/zenhack/tempest
  - ocdtrekkie 3y ago
    Currently Tempest can run a lot of Sandstorm apps. However, a lot of functionality one would expect or need is not implemented yet. It will be a bit before it can replace a Sandstorm server. But it's architecturally different in some fundamental ways which will make implementing new features that Sandstorm never had much easier.
- negative_zero 3y ago
  I've book marked Tempest :) Looks promising. Wish you luck!
- tudorw 3y ago
  always interested in self hosted solutions, not tried sandstorm and up for giving it a go, however if I was starting a small fairly simple personal project with no need to scale can I get wheels on it with Tempest, or should I consider building on sandstorm then porting?
  - ocdtrekkie 3y ago
    All of the dev tools use Sandstorm, and Tempest is not at this point, "complete". But if you were to build something on Sandstorm today, you can be reasonably confident it will work with Tempest.
- yoz 3y ago
  Just spent ten minutes delightedly reading your updates on this. It looks fantastic! I'm really excited to watch what happens next, and wish I had time to contribute. Are there primary areas in which contributions would be most valuable, especially from those without Golang experience/skills?
  - zenhack 3y ago
    I suppose that depends on what your skill set is. At some point the project would greatly benefit from some attention from a UI/UX specialist -- I'm doing my best, but it's not what I'm an expert at. Though right now I'm mostly focused on getting enough stuff to work for it to be of interest, and someone fussing with the UI might just be distracting. Doing app packaging for Sandstorm might be the most accessible way to help for someone who's not a Go dev -- Tempest will of course benefit from more apps when it's ready to run them, and it'd be a high impact thing for the community right now.
- deleted 3y ago
  [deleted]
- techempath9 3y ago
  You've told me about something totally new. I want to get involved with sandstorm. Exciting.
- techempath9 3y ago
  Can you tell me how I can get involved with sandstorm

c0balt 3y ago

This looks exciting and definitely something to look out for as an option fkr self-hosting. Similiar and a little bit more mature is also YunoHost, https://yunohost.org/ https://yunohost.org/, or for professional environments, UCS https://www.univention.com/ https://www.univention.com/.

fbartels 3y ago
The one big plus for ucs is their samba server, but it's not the right choice if you are looking for an appstore to install apps from. My personal favorite is Cloudron, as they have an app concept that only needs minimal human maintenance. And you could even combine it with an LDAP server like ucs for the user management.

wiml 3y ago

I used this for a few years at a previous job and really liked it — it didn't get a ton of adoption by other people there, though, unfortunately. It had a bunch of cool ideas and seemed well implemented. I'm sad that it didn't work out as a commercial endeavor.

rapnie 3y ago
I like how they use capability-based security [0] and use Cap'n Proto protocol. This is another technology that is slow to get broad adoption, but has many things going for when compared to e.g. Protocol Buffers (Cap'n Proto is created by the primary author of Protobuf v2, Kenton Varda). [0] https://sandstorm.io/how-it-works#capabilities https://sandstorm.io/how-it-works#capabilities [1] https://capnproto.org https://capnproto.org
- lrem 3y ago
  Cap'n Proto suffers from trying to improve upon something good enough. It's a real pity, have such a tech without org weight behind it.
  - ocdtrekkie 3y ago
    I mean, Cloudflare has some org weight. Just not Google monopoly weight.
    - hgsgm 3y ago
      Google doesn't have a monopoly on serialization formats.
- Timon3 3y ago
  I recently evaluated different protocol libraries for inter-language IPC. The state of Cap'n Proto is sadly quite a bit worse than Protobuf. Many languages either don't have an implementation, or it hasn't been updated for several years. But it's such a good system, I wish we could use it.

apitman 3y ago

Sandstorm was (is?) way ahead of its time. Fortunately a lot of its ideas live on (a la capnproto). My understanding is the achilles heel is the amount of effort required to integrate and update apps, since each app needs to be rather invasively modified to work with the centralized authorization framework. Also the general difficulty of managing a VPS or port forwarding. But once integrated it's really slick and secure. The overall UX is very similar to my vision of the future of selfhosting. It should be as easy as installing an app on your phone, then going through a quick OAuth2 flow to set up a tunnel on a domain, and you're up and running.

ocdtrekkie 3y ago
I think the answer is that packaging apps for Sandstorm is a bad hack, as ripping out the auth system and design granularity is all hard for an existing application. The best Sandstorm apps are written for Sandstorm, and in those cases, the granularity and built-in authentication make it way easier to write an app. I wrote a Sandstorm-native app in less than an hour. But if you built your entire application assuming you're shipping it via Docker, untangling the sheer amount of redundant garbage you need to pare down to a single-document app that accepts outside authentication and security, ends up being a ton of work to package and then maintain it long-term. Ideally, I think having apps not made for Sandstorm originally is mostly just a strategy to get enough people operating on Sandstorm's model for people to build Sandstorm-specific apps in earnest.
- robertlagrant 3y ago
  I think making apps that have a very clean separation between external security code (e.g. "the claims in the JWT") and internal security code (e.g. "the app's own internal understanding of security, regardless of provider") is always a fantastic idea.
- hanniabu 3y ago
  Why not just make it be a docker launcher instead?
  - 3y ago

evolve2k 3y ago

What’s involved to get additional open source “apps” into the store? I was considering Mattermost over Rocket Chat, but it’s not currently supported/listed.

zenhack 3y ago
Have a look at the packaging tutorial: https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tutorial/ https://docs.sandstorm.io/en/latest/vagrant-spk/packaging-tu...

mcint 3y ago

It's worth mentioning https://YUNoHost.org https://YUNoHost.org. I've done plenty of manual self-hosting. I explored sandstorm for a year or two in the mid 2010s. It worked as promised, but the complexity of integrations, fraying, showed. I switched to yunohost 6 years ago. I almost entirely don't think about it. I use a few services, wallabag and Uptime Kuma. Tried Nextcloud, HedgeDoc /HackMD/CodiMD, and Monica PRM because it was so painless to give them a go. My initial motivation for exploring it, came from the hope it could install NextCloud. My attempts at installing OpenCloud and NextCloud, with scripts that would make non-idempotent changes that fail on a second run after first pass fixes, left me sensing an unfriendly forced upsell environment. I have had to do some manual fixing to complete an upgrade or two, but it has workflows for backups, and some stringent, but fully automated configuration, sanity checking. I don't worry about the complexity.

ocdtrekkie 3y ago
My understanding is YunoHost makes absolutely no attempt to isolate apps from one another, it just helps you install stuff on a Linux box. Unfortunately that means a single flaw in a single app compromises your entire server.
- rapnie 3y ago
  Yes, Yunohost makes installs very easy. But if something isn't working right then you got extra layers to deal with. I don't know how Sandstorm deals with this, but Yunohost taking care of the install and upgrade procedures means that you are bound to the Yunohost integration's version of the software. For instance when installing Discourse via Yunohost this version lags behind significantly. And also Yunohost disables the Discourse upgrade process, while it offers a superior experience.
- Gigachad 3y ago
  It’s was designed predocker and is a pretty old school setup. I remember they had issues updating Debian because the new Debian had a new php version which caused issues for some apps.
- navanchauhan 3y ago

RonnieOwnsLexus 3y ago

so essentially if i have a VM, i can just install the apps i require and then use them for my business. This sounds great but then I need to make sure i am monitoring and debugging it if something breaks ? Also how does sandstorm makes money then ?

rapnie 3y ago
> Also how does sandstorm makes money then ? It doesn't. It is an open source project. Originally Sandstorm was offered by a startup, but they stopped [0] in 2017. You can make donations though [1]. [0] https://sandstorm.io/news/2017-02-06-sandstorm-returning-to-community-roots https://sandstorm.io/news/2017-02-06-sandstorm-returning-to-... [1] https://sandstorm.io/news/2021-06-17-sandstorm-community-fundraising https://sandstorm.io/news/2021-06-17-sandstorm-community-fun...

arek_nawo 3y ago

This looks really interesting. Having the ability to self-host various open-source apps is great, though, for me at least, it's always a bit stressful. Without a lot of dev ops experience I'm not always confident in my setup and the upgrade process. Having a tool that simplifies self-hosting would certainly lower the "mental barrier" for more people to do it.

Gigachad 3y ago
Unfortunately you are probably still better off using commercial hosted services. None of these projects really seemed to have the resources to properly deal with the security you need for an internet hosted service
- arek_nawo 3y ago
  After a closer look - I must agree. On the other hand, with more projects implementing bash scripts or using Docker for easier installation, maybe there's a way to make self-hosting easier without such dedicated apps. Hosted services will always offer more convenience. If the price is fair, they are likely better options in general.
deleted 3y ago
[deleted]
anderspitman 3y ago
This is, in my opinion, the biggest gap in the market. Selfhosting shouldn't be any more difficult or less secure than running an app on your phone.
- arek_nawo 3y ago
  I'm a bit split on this. As an OSS enthusiast I'd certainly like for self-hosting installation and maintenance to be easier. However, from the business perspective, I also see this as just one less reason to use hosted services - which will degrade sustainability of many open source projects.

gitgud 3y ago

Happy to see this project still going. Loved the concept and tried it for a while, but building apps for it was very complicated at the time, which made it much less useful. Looking forward to giving it another shot.

ocdtrekkie 3y ago
Probably the biggest revolution in app packaging is there is now a tool that helps automate enabling an app to request outside network resources. It used to require you write some Cap'n Proto and all, now you just need to include powerbox-http-proxy in your app package, more or less.

cpa 3y ago

I've tried sandstorm and yunohost but those didn't make me confortable enough to use in a production setting. I've been using cloudron.io for a few years and it's great. Never had issues with data loss or updates.

smartbit 3y ago
12*15=$180/year/person for cloudron.io is not the cheapest. Have you considered or tried nextcloud?
- cstork12 3y ago
  not "/person" but "/host", right?
- cpa 3y ago
  I'm also using apps such as grafana, prometheus, gitlab… So nextcloud by itself wouldn't cut it. I'm willing to pay (it's $15/mo per server, not per user) because I want something reliable that I won't have to spend a lot of time on. And also because we're a company, not just a random enthusiast :)

asim 3y ago

When an idea like this strikes but doesn't take off there's definitely an element of "before it's time" but it's also really hard to get people to adopt opinionated development models unless it's part of a bigger language ecosystem or brand which can offer the scale of opportunity like an app store. There's been attempts to do this without the opinions e.g deploy docker containers but the reality is we do actually need a cohesive vision for the end user for anything like this to take off. Catering to the developers alone in the self hosted model is very hard. And I know Kenton tried hosting too. It's just a tough business all around.

tibbydudeza 3y ago

NextCloud and OwnCloud already exists.

garganzol 3y ago
NextCloud and OwnCloud are productivity suites (the analogy is Microsoft Office), while Sandstorm is an operating environment (the analogy is Microsoft Windows).

neets 3y ago

It's worth mention umbrel, https://umbrel.com/ https://umbrel.com/ Once umbrel is setup apps are are just as easy to update and install as an iPhone. I also appreciate how it has a dependency system so apps can build on one another. Umbrel is more for personal homelab rather than sharing with friends, there is no public endpoint you would want on the clearnet, you need to VPN in, but that also makes it more secure.

jesterson 3y ago
Is it something operational or it's all on pre-order? Fancy website hints on prevalence of form over substance, although perhaps it's just me. People who are concerned about privacy and big corporations don't need fancy rotating boxes, rather clear and concise explanation of the matter. Just my 2 cents
- garganzol 3y ago
  I installed Umbrel on a VM. It demonstrates a few interesting ideas, but at the same time a form over function is everywhere with nothing fundamental to compensate for that. So you are kind of right.
sverhagen 3y ago
That website is a very impressive piece of work, but it's also massive friction, if I may say so. "Get up and running in 30 seconds." Pf... can't even get to what they're "selling" in that time. Scroll, scroll, more scroll. A nice, to the point pitch would be nice. Same for Yuno, which people are touting in other threads here, no one seems to be getting to the point "any time soon" on these pages. Sandstorm is probably the best of the bunch at that, but even there I didn't quite get it until I came to the discussion here on HN.
- nunobrito 3y ago
  Umbrel is OK. Worked good for me, indeed is relatively easy and a huge amount of apps for install. Mostly related to bitcoin.
- 3y ago

the_common_man 3y ago

https://cloudron.io https://cloudron.io is a viable alternative.

sunshine-o 3y ago

I feel like we are always getting into the same trap with those self-hosting platforms. It is the same problem we faced with the Linux Desktop & Mobile. A lot of cool visions, but fragmented efforts, limited app ecosystem & low adoption. We already have Sandstorm, Umbrel, Start9, Yuno, etc. but none of them had the success they deserved. I'm wondering if taking something like Fedora CoreOS/IoT, Cockpit, linuxserver.io images & develop a nice GUI & documentation on top wouldn't have much greater chance to succeed. People who will try to self host & will most likely stick to it are already familiar with tech & willing to tinker anyway.

prox 3y ago
Engineers love engineering, they love their own engineering when it comes to open source/free time projects, and they tend to not like the legwork of publishing, polishing and making it ready for public consumption. (Which is a lot of work on its own) Engineers and QA/useability/marketing people tend not to mingle in these projects. I am broken record at this point, but Blender and Godot tackled this problem. Take sandstorm, it looks like a informative website but just looking at it I see a ton of friction installing it. Whether or not that is true, but the optics are against it.
- orblivion 3y ago
  That's a useful bit of feedback. Indeed I would actually say that installation is quite simple as such things go. And maintenance is dead simple, it updates itself in the background.
- kentonv 3y ago
  Sandstorm was actually a startup with product and marketing and we did spend a lot of time trying to make it as simple as possible to install. The only way to make Sandstorm easier to set up would be to partner with hosting providers to offer one-click installers. In the absence of that, Sandstorm's current install is about as easy as it could possibly be given the constraint of "should run on a generic Linux host". (Aside: People have always given Linux flak for being hard to install. But have you ever tried to install Windows from scratch? It's sooooo much harder. But no one cares because it's preinstalled on every PC you buy.) (Aside 2: How did Chrome become the most popular browser? Sure as hell not because it's so easy for people to install. Most people don't know what a browser is. It got there by Google paying a lot of people to bundle it. It's honestly amazing that Google pulled it off, against competitors who owned their respective operating systems.) Anyway, back in the day, Sandstorm actually offered its own hosting service, which you didn't need to be technical to sign up for. So it was actually quite easy then. But it was a first-party service. In retrospect I think building the first-party service was a mistake. It distracted too much engineering time away from actually building out the platform and ecosystem. It meant we could offer a better price point than a VPS provider would, but I think the people actually interested in the product at that point weren't so price-conscious. If I did it again I'd focus on partnerships.

brynjolf 3y ago

It is hard trying it figure out what path to choose. Do you just run Docker or do you combine it with Docker Compose? Do you instead opt for Proxmox in combination with Podman? Maybe you opt for something simpler like this tool; Sandstorm. Or even more complex of a setup with a K8 cluster with combined with Gitops. It is interesting and a lot of really good tools to chose from but it is not obvious to me.

madacol 3y ago

For me, the biggest blocker for using Sandstorm has been the inability to run on ARM https://github.com/sandstorm-io/sandstorm/issues/2083 https://github.com/sandstorm-io/sandstorm/issues/2083

hgsgm 3y ago
Sandstorm's value prop is such that if you wanted its benefits, a one time purchase of a low end micro PC shouldn't be the blocker.

monkeydust 3y ago

Looks like Caprover https://github.com/caprover/caprover https://github.com/caprover/caprover which has been around for a bit, have used in past. Any notable benefits over it?

hgsgm 3y ago
Fromctheb readme, Caprover is developers developers developers developers. Sandstorm is for users/admins to deploy many apps together.

xorcist 3y ago

I have used Sandstorm quite a bit in the past for smaller clients. It's remarkably sane and works as described. Sometimes it could be a little slow with getting updates, but I don't know if that's still a thing. The space of Linux distros specifically for self-hosting data has always been a little fragmented, which is a shame since it's really useful for the intended audience. A bit like Linux distros in general, perhaps. Maybe if one of the bigger distributions, like Debian or Fedora, got behind one system it would improve. But that's also how we ended up with Flatpak and Snap, so it could be either way really.

davidy123 3y ago

I saw "semantic model" and got excited, but that's at the "grain" level. The idea of applications has been stale for a long time, it just takes a long time for people to get there. Microsoft doesn't want it to happen quickly because they like selling Office as a package, but they're slowing decomposing it. OLE was a micro step, now with a cloud graph model and AI they're going much deeper. Ultimately, your "table" can be generated from data in a "spreadsheet" or "database." And your AI can interact with this data precisely. At a certain level, you really shouldn't need to care where something was generated or viewed. It's data. But the more strongly it's "typed," the more accurate everything becomes. Yes there's some hype over AI, but it is just incredibly useful, even the most basic and stumbling step of importing your documentation to an app or browser based AI to answer questions. Anything that doesn't include it as a first class consideration is last epoch, in the same category as Visicalc, 1979. Unfortunately, that includes the vast majority of Open Source. KDE was way ahead of this, but they stumbled. I hope they can catch up. Local, Open Source AI needs to leap ahead or computing is going to collapse. So the first step is to give all the data a schema, ideally a domain-relative one so it's interoperable. See Linked Data.

openscript 3y ago

For the services at home I use https://www.runtipi.io/ https://www.runtipi.io/. I'm quite happy with it.

mawise 3y ago

On the other side of things, I've started using https://www.pikapods.com/ https://www.pikapods.com/ they follow the docker model but are a paid (~$2/mo) hosting provider focusing on open-source self-hostable apps. Seems to me like an easier path for getting non-techies to 'selfhost' their own apps.

ssddanbrown 3y ago
Pikapods have provided my software for a while. Have not had much feedback from users yet, but no bad feedback is a good sign I guess. The person behind PikaPods was very receptive to my concerns that their website mentioning of "upstream revenue share" could be misleading (didn't apply for my project), and they quickly took action to improve things.

antifa 3y ago

I've had pretty good experiences with https://yacht.sh/ https://yacht.sh/, which only does docker containers.

electroagenda 3y ago

Sorry for the silly question but I don't get it. Is this a remote server where you can install and use web apps from third parties? Or can you actually build a web app there so that users can employ it? Something similar to Digital Ocean.

orblivion 3y ago
It's a platform that you install on your own server, at home or on a VPS (Digital Ocean, etc). The installation is a few simple CLI steps. From there everything is in the browser, including the admin. Each user, once logged in, can install whatever apps they want from the app store. Or they can upload their own if they want. This is safe because everything is containerized. Apps have to be specially designed (or retrofitted) for Sandstorm, though.

kev_emu 3y ago

Another twist on self hosted web apps is peergos. Uses a capability based system for access and sharing. End-to-end encrypted and P2P. App Examples - github.com/peergos/example-apps API Docs - book.peergos.org/features/apps.html Disclaimer: I work on the project.

johackim 3y ago

There is an alternative : https://github.com/ethibox/ethibox https://github.com/ethibox/ethibox

haolez 3y ago

Suppose I'm willing to build an ecosystem of internal tools for my company. Can Sandstorm make my life easier in this kind of effort? Or is the added complexity simply not worth it? I'm curious about how I'd deal with data sharing in my enterprise if each user has a set of data "grains".

retrocryptid 3y ago

So... this is a company that sells a service that lets you run an app on 127.0.0.1?

cstrahan 3y ago
Nope. The service, like any other, is them hosting the software (Sandstorm) and the software/apps you choose to run therein. It’s also open source, so you can choose to host Sandstorm yourself, instead of using their service. You didn’t ask what Sandstorm is, so I’m assuming you already understand what it is.
- retrocryptid 3y ago
  But you run it in your data center? Is it just some pre-configured apps you can run on a machine / vm / container wherever? I mean... that's not completely without merit. But isn't this just what we used to call "software" ??
  - kentonv 3y ago
    To clarify, Sandstorm does not sell any service today. It is an open source project that makes it much easier to self-host apps on your own server -- maybe in a datacenter, maybe on a device in your home. Once upon a time, years ago, Sandstorm was a startup, and that startup did offer a paid hosting service as an option. However, that startup shut down a while ago and the paid hosting service went away. But the open source project lives on. (I was the co-founder of said startup.)
  - cstrahan 3y ago
    > But isn't this just what we used to call "software" ?? By way of analogy: You could carry around a phone that has a simple Linux distro running on it. And while we're at it, what's the point of having a package repository? So we could get rid of that, and compile all our software from source. So the user experience is something like: SSH into your phone, curl down a source tarball for the calculator software you would like to run on your phone, and first make sure you have all of the build dependencies installed, and now make && sudo make install. So what's the point of Android or iPhones? Well, I'm very technically proficient, and yet I don't want to SSH into my phone and make && sudo make install. God help my non-techie family and friends. We all want to install software that has gone through at least some semblance of an audit, and we want to install it trivially, and we want that software to then run in a minimally privileged sandbox. While a "phone app" is technically "software", the distinguishing factor is that aforementioned features are implied when someone says "app". So recap of what it's like to use a phone app: - There's a distribution channel that makes it easy to search for and install the app of your choosing. - The apps run in a sandbox. Privileges/capabilities are surfaced through a common setting UI: don't want the app to be able to send you notifications? You can toggle that in a way that the app can't circumvent. Maybe you do or do not appreciate these features. But if you, like many, do appreciate these features, the a logical question is: is there anything like this but for software we want to use outside the context of our phones? And, well, if we're wanting this software to be accessibly not only on our phone, we should probably make this as maximally accessible as we can, and what could be more accessible than a browser based app -- now you're not limited to using it just from your phone (though that's possible too), you can access it from your laptop, or a friend's computer, or your gaming console's browser, or anywhere else where you can browse the web. So that's what Sandstorm is, more or less. Trivially installable apps, where you can completely own your own data (if you're hosting yourself), and even if someone else is hosting Sandstorm you can trivially export your data, the whole app is sandboxed, you have a common dashboard for controlling each app's capabilities, etc.

XCSme 3y ago

I am using Caprover, and I assume Sandstorm is similar. While the idea is good, and it works well, finding supported apps is hard. Many apps have to develop individually config files for each such platform and maintain them updated. Very few platforms do it. In the end, I find the LAMP stack the best for self-hosting, especially with an interface like cPanel. You can simply upload files and the app works (PHP), you can view the databases (PHPMyAdmin), most hosting companies support it, there are many apps built on it.

ptman 3y ago

Host for free in the cloud: https://paul.totterman.name/posts/free-clouds/ https://paul.totterman.name/posts/free-clouds/

yujian 3y ago

https://www.youtube.com/watch?v=y6120QOlsfU https://www.youtube.com/watch?v=y6120QOlsfU

giolekva 3y ago

[dead]