Because services need to be unloaded when updating (either the services
themselves or its dependent libraries). I don't think .NET can support
hot-code swapping... I have seen such feature only in Erlang.

However, I don't want a sandbox, the use of AppDomain is just to help
services.

The directory structure will be that:

\bin -- put all services' main assemblies, they could be .dll or .exe,
and they may depend on other services. Each assembly here is
automatically launched, in its own AppDomain.

\lib -- put services' dependent assemblies.

\tmp -- put removed assemblies (in NTFS you can move but not delete an
in-use DLL)

There is only one command for the container - UPDATE:

First of all, the container create a snapshot of the \bin directory
(recording file names and last-update dates) and shut down services
that launched in previous UPDATE command but not exist in current
snapshot. Then, it finds out all of services' dependent assemblies
recursively (in \bin or \lib), and remove unused assemblies under \lib,
and restart services whose assemblies or dependent assemblies have been
updated. Now the container launch newly-added services under \bin..
Done!

Simple isn't it? :)