Thanks for the detailed feedback. We used to list apps that we have got working ourselves but we decided it's not a great idea to try to support a bunch of third-party open source apps ourselves. We hope we can encourage the actual developers to let users load their app on Portal, it's pretty simple usually. We definitely need some examples though.
Each app is a separate KVM virtual machine. By default, apps only have access to data they've created, not the data of other apps. Apps can communicate over a private (virtual) "LAN" using private IPs. An app's LAN and Internet access can also be disabled.
Our idea for keeping apps up to date is to replace the entire operating system and app software every time the app VM starts up. For example, restarting an app based on "ubuntu14lts" loads the latest daily release of Ubuntu 14.04 LTS with all its security patches.
The only thing that survives an app restart is the /data drive, with the idea that not even a rootkit will be cleared by a simple restart.