> It's absolutely never "set it and forget it."

Have you tried Sandstorm? It is in fact designed to be "set it and forget it" -- that's a major goal of the project. Everything auto-updates, you never have to edit config files, it can configure DNS and fetch/renew SSL certificates automatically, installing new apps takes one click, etc.

(Disclosure: I'm the lead developer.)

The "How It works" wasn't bad. But nonetheless: does it distribute itself (and my data) to multiple VMs? If it needs a kernel patch, does it appropriately plan downtimes and/or shed load from that VM before applying the patch and rebooting the instance? Does it handle machine failure?

We actually have tools to do all of that -- high-availability / fault tolerance / load balancing, entirely transparent to users, admins, and apps -- which we use to run Sandstorm Oasis, our paid managed hosting service. We are working on productizing these tools to sell to "enterprise" customers.

For individual users and small companies, single-machine Sandstorm is pretty reliable, but it's true we don't automate kernel updates yet (which will require scheduling reboots for off-hours). We'll add that eventually.

(Sorry for all the vaporware.)

Sandstorm's updates are closer to Chrome's than regular open source software. Stick to the 'release' channel can you can be sure that you're always up to date. And Sandstorm locks its apps down so tightly that they often don't suffer from the same security vulnerabilities the same apps do outside Sandstorm.

That being said, to roll your own you'll need to run a box somewhere, select secure defaults, and keep on top of patching the box itself. It's not worth it unless you're really willing to spend the time to do it correctly.

Eh, honestly, if you're not running anything else on the box, you probably don't have to be overly proactive about maintaining it. Sandstorm handles updating its own dependencies and mitigating most kernel bugs. Maybe if you're leaving sshd open to the internet that's something to worry about, although if you read HN you'll surely know when that needs patching. :)

That said, we plan to build a "Sandstorm OS" that auto-updates everything including the kernel, and doesn't even have an SSH interface (wouldn't be useful anyway).