Sandstorm.io - https://github.com/sandstorm-io/sandstorm/
I do all my group collaboration with it, and am no longer subject to Google's whims about my data. Sandstorm predates 2016, but has really accomplished a lot in 2016.
In Who’s on Your 2016 Web Development Thank You List?sandstorm-io
sandstorm
JavaScript2014–2026
sandstorm-io / sandstorm
sandstorm
Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
21Distinct people
53Mentions
0Explicit recommenders
7.1KGitHub stars
What to know before exploring
What it is
Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager.
GitHub
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 8:03:49 PM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year53 dated mentions
Observed mentions: 2014-06-29 18:44:23 UTC to 2026-09-06 13:44:51 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 11 | 0 | 11 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 12 | 0 | 12 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 10 | 0 | 10 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 5 | 1 | 4 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 1 | 0 | 1 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 4 | 0 | 4 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 0 | 0 | 0 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 2 | 0 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 1 | 0 | 1 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
Sandstorm
Sandstorm is a self-hostable web productivity suite. It's implemented as a security-hardened web app package manager. Sandstorm makes it easy to run your own server.
Use Sandstorm to install apps to create documents,
spreadsheets, blogs,
git repos, task lists, and
more as easily as you'd install apps on your
phone.
Sandstorm is open source and can be installed on any x86-64 Linux
system.
Read more at: https://sandstorm.io/
Try the demo: https://demo.sandstorm.io/
Documentation available at: https://docs.sandstorm.io/
Installing
See installation instructions in the Sandstorm documentation.
Using Sandstorm
See the overview in the Sandstorm documentation.
How It Works
See how it works and security practices in the Sandstorm documentation.
How to Package Apps
See the developer hub in the Sandstorm documentation.
Contribute
Want to help? Check out CONTRIBUTING.md. Also see our community page or get on our discussion group and let us know!
Read the full README on GitHubWhat Hacker News says
10 sourcesTrue, streaming is not a baked-in feature of Cap'n Proto. Streaming can, however, be implemented on top of capabilities, as with this ByteStream interface: https://github.com/sandstorm-io/sandstorm/blob/v0.197/src/sa...
In Fractalide: Simple Rust MicroservicesPackaging winds for sandstorm.io
https://github.com/GetStream/Winds
https://github.com/sandstorm-io/sandstorm
In Ask HN: What are you hacking on this weekend?> it was checking /etc/lsb-release instead of actually checking for that feature
No it wasn't. The install script ran a little program that actually attempted to invoke the system call to see if it failed:
https://github.com/sandstorm-io/sandstorm/blob/800d1c016c150...
We have never relied on /etc/lsb-release nor /proc/config.
> why cant you ship an application which runs as a normal user only
First, we're not shipping an application, we're shipping an application platform which includes a container engine.
On systems that have unprivileged user namespaces available, you actually can install and run Sandstorm as a regular user -- no root privileges at all.
Unfortunately, Arch explicitly turns off user namespaces in their kernel build.
Without user namespaces, we have no choice but to require root privileges, because the Linux system calls
Read the rest
for setting up containers require either root or user namespaces. (Note that Sandstorm is careful with its root privs -- most of the system runs as a regular user, calling out to a separate daemon for the specific operations that need root.)
If you don't want to give Sandstorm root -- which is perfectly understandable -- and you don't want to enable the kernel features that allow it to be non-root, then you'll need to run it in a dedicated VM.
> Last time I tried, you actually recommended curl shit | sudo bash.
We have never recommended that.
> it wants me to flip some sysctl about user namespaces or something
FWIW, this is no longer needed! Sandstorm has been updated to work without user namespaces and this installer script change will remove the check from the installer (will probably ship this week):
https://github.com/sandstorm-io/sandstorm/pull/2656
(You will need to let Sandstorm start as root if you don't want to flip the sysctl, though.)
In Webcams used to attack Reddit and Twitter recalledBozo here.
Specifics:
https://demo.sandstorm.io -- Try it. Takes 60 seconds.
https://github.com/sandstorm-io/sandstorm/ -- Source code.
https://apps.sandstorm.io/ -- Apps available today.
https://sandstorm.io/install -- Install it on your own server. Takes five minutes, including issuing free SSL certificate.
https://docs.sandstorm.io -- Documentation (for using, administering, developing, etc.)
https://docs.sandstorm.io/en/latest/using/security-non-event... -- List of actual app security bugs mitigated by Sandstorm.
What were you looking for, exactly?
In Decentralization is about diversityI think I disagree with almost all your points here (or that they are a reasonable criticism/list of things that should be changed with sandstorm) -- but I appreciate you taking the time to respond in such detail. (Modded your comment up FWIW).
Didn't realize that Sandstorm (currently) targets only AMD64 - for others interested, the rationale is here:
https://github.com/sandstorm-io/sandstorm/issues/94
I don't really see this as much of a problem - at a later point, if Sandstorm is packaged for something like Debian, it's likely people will work on porting it to Arm. As most of the software is already ported, this shouldn't be insurmountable.
In Sandstorm – An open source operating system for personal and private cloudsCap'n Proto isn't really the magic that makes everything work, it's just a communications layer that is designed to facilitate Sandstorm's security model -- namely, Capability-Based Security. Here's some relevant links:
https://sandstorm.io/how-it-works#capabilities
https://sandstorm.io/news/2014-12-15-capnproto-0.5
Note that Sandstorm does not require that apps store their data in Cap'n Proto format. Rather, the app communicates to the outside world via Cap'n Proto. Also note that many other protocols -- especially HTTP -- can be layered on top of Cap'n Proto, allowing apps that don't know anything about Cap'n Proto to operate. Here's how HTTP-over-Cap'n-Proto is defined, BTW:
https://github.com/sandstorm-io/sandstorm/blob/master/src/sa...
The key advantage of using Cap'n Proto is that it allows Sandstorm to be aware of all of the connec
Read the rest
tions that exist between apps, so that it can tell the user which apps are talking to which other apps and how those apps discovered each other, and give them the opportunity to revoke those connections.
Well...
* Oasis (managed hosting) was launched less than a year ago.
* That came together with a huge UI overhaul that introduced the sidebar / tabbed UI.
* It also came with the full app market, whereas before we only had a static HTML app list.
* We started offering free SSL certificates for self-hosted servers under sandcats.io.
* We introduced Sandstorm for Work, which integrates with LDAP / SAML (including Active Directory) for login, offers organizational user management features, etc.
* We added app signature verification via Keybase, proving that apps came from the twitter/github/HN user you expected.
* We implemented app update notifications with one-click updates.
* We added signature verification to the installation and update paths for Sandstorm itself.
* We enabled apps to serve WebDAV APIs, which enabled Davros (a file sync
Read the rest
app) and Radicale (a CalDAV calendar app).
* The community wrote / packaged 30 new apps, bringing the total to 58.
* We added the ability to link multiple login services to a single account.
* We implemented the Powerbox grain picker, which allows you to share a grain through another app. (This will begin being used in real apps in the next couple weeks.)
* We added unified notifications and read/unread indicators, so you can keep track of activity across your grains.
* Many other, smaller things. See: https://github.com/sandstorm-io/sandstorm/blob/master/CHANGE...
Not quite, but here's a pull request:
https://github.com/sandstorm-io/sandstorm/pull/1459
In Sandstorm App update: New open-source self-hostable apps