Sandstorm

Full Definition

Sandstorm is an open-source platform for self-hosting web applications, providing OS-level isolation for each application instance (grain). Sails.to extends Sandstorm through Melusina OS to create the runtime environment where all platform grains execute. Each grain runs in its own security sandbox with its own storage, capabilities, and lifecycle.

Unlike container orchestration platforms that share kernels and require complex networking policies, Sandstorm enforces isolation at the supervisor level. Each grain gets a private filesystem, a restricted network namespace, and communicates exclusively through Cap'n Proto RPC. The Powerbox mediates all capability grants between grains, ensuring no ambient authority exists in the system.

Why It Matters

Sandstorm gives Sails.to true application isolation without containers or VMs. Each grain is a security boundary - compromise one, and the rest remain unaffected. This is not a policy enforced by configuration; it is a structural property of the runtime.

For regulated financial infrastructure, this isolation model is critical. Every investor's data, every offering's state, every compliance workflow runs in its own sandbox. Auditors can verify that access boundaries are enforced by architecture, not by access control lists that can be misconfigured or overridden.

Related Terms