Sandstorm - Weather alerts & updates

Sandstorm is your ultimate destination for discovering and customizing the latest trending memes. Share hilarious memes with your loved ones after editing them with a variety of tools such as drawing, color adjustments, stickers, and different text overlays featuring numerous font options. Unleash your creativity by using your own pictures or selecting from over 100,000 diverse templates available. Don't let this opportunity slip away - start creating memes now! Sandstorm boasts a collection of the most renowned memes including characters from Naruto, Minecraft, Spiderman, Spongebob, Among Us, Five Nights at Freddy's, and more.

What's new

Find the most trending memes over the internet

Take pictures and add them to your creation

Share your creations with family and friends

Guided tour of Sandstorm, including install

Format: Self-driven hands-on tutorial

If you have 15 minutes and want to learn more about Sandstorm, enjoy this hands-on tour. After you work through it, you will:

Understand how installing apps and creating documents/instances works in Sandstorm.

Understand how app instance sharing works in Sandstorm.

Understand the current limits of Sandstorm, and where the project is headed in the future.

(If desired) have a free-of-cost virtual machine, hosted by Amazon, to run Sandstorm on for a year, or at DigitalOcean with a coupon code.

How It Works

Sandstorm's server-side sandboxing is based on the same underlying Linux kernel features as LXC and Docker. We use the system calls directly for finer-grained control.

The kernel attack surface is reduced using seccomp-bpf to block system calls.

procfs, sysfs, etc. are not mounted in the sandbox, and only a minimal set of devices are available.

(Planned) On the client side, apps run in a sandboxed iframe employing the Content-Security-Policy header to prevent them from sending any kind of network communication to any server other than their own.

All communication between the sandboxed server and the outside world takes place through a single Cap'n Proto RPC socket which the app's root process receives as file descriptor. We've provided a program, sandstorm-http-bridge, which can receive HTTP-over-RPC requests on this socket and proxy them to a regular HTTP server running in the sandbox.

Every object (e.g., each document) that you create with an application runs in a separate isolated sandbox. We sandbox per-object rather than per-app so that it is easy and safe to share one object without also sharing everything created using the same app.

An application package (.spk file) is essentially an archive containing an entire chroot environment in which the application runs.

The application runs with the contents of its package mounted read-only, so that multiple instances of the same app can share disk space for the package.

The application may store persistent state in the /var directory.

App servers are aggressively killed off as soon as the user closes the browser tab, then restarted when the user returns later.

Packages are cryptographically signed. Packages signed with the same key represent versions of the same app, and are thus allowed to replace older versions -- although the user must still confirm these upgrades.