Skip to main content
Version: 5.31.0

Application Hosting - Introduction

What is Application Hosting?​

Application Hosting is a feature that allows users to deploy and run containerised applications directly within WeOS. It provides an isolated environment for applications while leveraging system resources such as networking, storage, and computing power. This approach ensures flexibility, security, and scalability for running third-party or custom applications alongside core system services.

What is an Application Image?​

An application image is a packaged representation of an application, including:

  • The executable binaries.
  • Required libraries and dependencies.
  • Configuration files and metadata.

Images follow the OCI (Open Container Initiative) specification, ensuring compatibility with standard container runtimes. They serve as the source for creating application containers.

What is an Application?​

An application in this context refers to the running instance of an application image inside a container. It operates in an isolated environment with its own:

  • Network namespace (dedicated interfaces and virtual Ethernet pairs). Alternatively it can share network namespace with the host operating system.
  • Filesystem paths (including access to external media for persistent storage).
  • Resource limits (CPU, memory, etc.).

Applications can be managed through CLI or Web interface, allowing configuration, lifecycle control, and monitoring.

Underlying Technology​

The Application Hosting feature is built on the OCI container model, which defines:

  • Standard image format for portability.
  • Runtime specification for consistent container execution.
  • Namespace and cgroup isolation for security and resource control.

Runtime Security Controls​

To help protect the host system and other applications, Application Hosting utilise kernel-enforced security controls seccomp and AppArmor.

Seccomp​

Application Hosting makes use of seccomp filtering to limit which Linux system calls an application can use. This reduces the risk of misuse if an application is compromised by blocking the execution of a set of system calls. Application hosting uses a white-list approach where seccomp profiles define a set of system calls that are explicitly allowed, and system calls that are not in the list will be denied.

AppArmor​

AppArmor enforces access rules for files, devices, and other system resources, so each application only uses what it is explicitly allowed to access. The privileges of an application will be restricted by an AppArmor profile. These profiles regulate allowed and denied actions for:

  • Various types of networking.
  • Capabilities.
  • Path permissions (i.e. read, write, executable, etc.).
  • Signals.
  • Shell commands.

Together with seccomp, these controls strengthen isolation, reduce attack surface, and provide an additional layer of security for containerised workloads running on WeOS.

What Can You Do with Applications? (Use Cases)​

  • Network Services: Host custom network services (e.g., DHCP, DNS, monitoring agents) within isolated containers.

  • Firewall: Give exclusive access to a port facing an unsafe network to filter ingress and egress traffic.

  • Data Processing: Run analytics or processing tools without interfering with the base OS. This could be as simple as measuring traffic flow or it could be running advanced machine learning algorithms for Deep Packet Inspection (DPI), Intrusion Detection Systems (IDS) or Intrusion Prevention Systems (IPS).

  • Third-Party Integrations: Deploy vendor-provided applications or tools in a controlled environment.