Photo by Mateusz Klein on Unsplash

Secure collaboration

Productivity Storm

Article from ADMIN 75/2023

By Matthias Wübbeling

Sandstorm lets you self-host web-based productivity apps, apply individual permissions, and isolate documents for security with no effect on productivity.

Sharing files is an important topic in team productivity. All employees need reliable access to required information for successful collaboration. Sandstorm is a security-hardened web app package manager built by a community of volunteers to run open source web applications [1]. Sandstorm's server-side sandboxing lets you isolate documents securely with little to no effect on productivity.

Security Risks in Modern Collaboration

The trend in IT has been toward microservices. Ever since hardware virtualization became widespread, individual services have run separately on different virtual machines. Although hard disk space has always been comparatively affordable, virtualization comes at the price of memory overhead for a full-fledged operating system that gives you access to the physical resources of the computer through paravirtualized drivers.

Modern platforms with container technology, such as Kubernetes, further optimize resource consumption, especially in terms of memory consumption for microservices. Namespaces in the Linux kernel mean that it is no longer necessary to provide an operating system to isolate a piece of software from other running programs or specific files on the filesystem. It is solely a matter of a program's immediate runtime environment (i.e., the shared dynamic system libraries). Calls to the program and library kernel functions can even be processed by a single kernel.

The architecture described here leads to each individual application (e.g., software for cooperative document editing or calendar systems) running in its own container without direct access to the resources of other processes. A database connected on the back end also runs in its own environment, and communication then takes place over a private network that is virtualized in the kernel. Standard tools have been developed for

...

Use Express-Checkout link below to read the full article (PDF).