This runs VMs, Sandstorm runs OS containers. Apps for Sandstorm might need a little work to integrate with Sandstorm's model for users and permissions, but apps in Portal won't have a built-in mechanism for sharing documents/data and will each have individual authentication, I assume.