Sandboxed Solution Considerations
Sandboxed solutions are a feature in Microsoft SharePoint 2010 that enables site collection users to upload their own custom code solutions. A common sandboxed solution is users uploading their own Web Parts.
A sandboxed SharePoint application runs in a secure, monitored process that has access to a limited part of the Web farm. Microsoft SharePoint 2010 uses a combination of features, solution galleries, solution monitoring, and a validation framework to enable sandboxed solutions.
Specifying Project Trust Level
Visual Studio supports sandboxed solutions through a Boolean project property called Sandboxed Solution. This property can be set at any time in the project, or it can be specified when you create the project in the SharePoint Customization Wizard.
Note
Changing the Sandboxed Solution property of a project after it is created may cause validation errors.
The solution is considered a farm-scoped solution if the Sandboxed Solution property is set to false or you choose the Deploy as a farm solution option. However, the solution is treated differently from a farm solution if the Sandboxed Solution property is set to true or you choose the Deploy as a sandboxed solution option in the wizard.
SharePoint Site Hierarchy
To understand how sandboxed solutions work, it helps to know that SharePoint sites are hierarchical in scope. The top element is known as the Web farm, and other elements are subordinate to it:
Web Farm
Web Application A
Site Collection A1
Site A1a
Web Application B
Site Collection B1
Site B1a
Site B1b
Site Collection B2
Site B2a
As you can see, Web farms can contain one or more Web applications, which in turn can contain one or more site collections, which can have subsites, and so on. Changes made to one site collection affect only that site collection and no other. However, changes made at the Web farm level affect all site collections on the farm.
Windows SharePoint Services (WSS) 3.0 allows you to deploy solutions only to the farm level, but Microsoft SharePoint Foundation 2010 allows you to deploy to either the farm level (farm solution) or the site collection level (sandboxed solution).
Why Sandboxed Solutions?
In WSS 3.0, solutions could be deployed only to the farm level. This meant that potentially harmful or destabilizing solutions could be deployed that affected the whole Web farm and all of the other site collections and applications that run under it. However, by using sandboxed solutions, you can deploy your solutions to a subarea of the farm, a specific site collection. To provide additional protection, the solution’s assembly is not loaded into the main IIS process (w3wp.exe). Instead, it is loaded into a separate process (SPUCWorkerProcess.exe). This process is monitored and implements quotas and throttling to protect the farm from sandboxed solutions that perform harmful activities, such as running tight loops that consume CPU cycles.
Site Collection Solution Gallery
Windows SharePoint Services 2010 has a feature that's known as the "site collection solution gallery." You can access this feature from the SharePoint 2010 Central Administration page or by opening the Site Actions menu, choosing Site Settings, and then choosing the Solutions link under ** Galleries** in the SharePoint site. Solution galleries are repositories of solutions that enable site collection administrators to manage solutions in their site collections.
The solution gallery is a document library stored in the root Web of the SharePoint site. The solution gallery replaces site templates and supports solution packages. When a SharePoint solution package (.wsp) file is uploaded, it is processed as a sandboxed solution.
Sandboxed Solution Limitations
When a sandboxed solution is deployed, the array of SharePoint functionality available to it is limited to help reduce any security vulnerabilities it may have. Some of these limitations include the following:
Sandboxed solutions have a restricted subset of deployable solution elements available to them. Potentially vulnerable SharePoint project templates, such as site definitions and workflows, are not available.
SharePoint runs sandboxed solution code in a process (SPUCWorkerProcess.exe) separate from the main IIS application pool (w3wp.exe) process.
Mapped folders cannot be added to the project.
Types in the Microsoft SharePoint Server 2010 assembly Microsoft.Office.Server cannot be used in sandboxed solutions. Also, only types in the Microsoft SharePoint Foundation 2010 assembly Microsoft.SharePoint can be used in sandboxed solutions.
It is important to note that specifying a SharePoint solution as a sandboxed solution has no affect on SharePoint server; it only determines how the SharePoint project is deployed to SharePoint from Visual Studio and what assemblies it binds to. It does not affect the generated .wsp file, and the .wsp file has no data that directly correlates to the Sandboxed Solution property.
Capabilities and Elements in Sandboxed Solutions
Sandboxed solutions support the following capabilities and elements:
Content Types/Fields
Custom actions
Declarative workflows
Event receivers
Feature callouts
List Definitions
List Instances
Module/files
Navigation
Onet.xml
SPItemEventReceiver
SPListEventReceiver
SPWebEventReceiver
Support for all Web Parts that derive from System.Web.UI.WebControls.WebParts.WebPart
Web Parts
WebTemplate feature elements (instead of Webtemp.xml)
Visual Web Parts
Sandboxed solutions do not support the following capabilities and elements:
Application Pages
Custom Action Group
Farm-scoped features
HideCustomAction element
Web Application-scoped features
Workflows with code
See Also
Concepts
Differences Between Sandboxed and Farm Solutions