For those who think this sounds like Docker: in a way, it's similar, but while Docker is mostly designed for packaging and running regular Linux server software, Sandstorm provides a common framework (particularly around authentication, authorization, configuration and upgrading), which makes the whole user experience much more unified, and requires less fiddling with configuration files or terminal commands, while exposing a smaller attack surface, even if the attacker manages to exploit a particular app (there are various levels of isolation, even between different documents of the same app).

https://sandstorm.io/news/2014-08-19-why-not-run-docker-apps