RunR 0.5.7

RunR is an open-source, self-hosted serverless platform on Kubernetes and Knative: functions, containers, sandboxes, WebAssembly and durable workflows, with an API, a web console, the runr CLI, SDKs, a Terraform provider and a GitHub Action. You install it on infrastructure you operate, connected or air-gapped. It is developed by BRF Teknoloji and released under the MIT License.

0.5.7 is the first release published in this repository. It contains 0.5.0, the first open-source release, and the patch releases 0.5.1 to 0.5.7 (0.5.5 is a security release); the notes of each follow below, and CHANGELOG.md has the complete history. Downloads, the Terraform provider registry and the documentation are on runr.sh.

Install

• Kubernetes (Helm): the chart comes from BRF's public Helm repository, without credentials:

  helm repo add brf-tech https://helm.brf.sh
  helm upgrade --install runr brf-tech/runr --namespace runr --create-namespace --set domain=runr.example.com

  See the README; helm show values brf-tech/runr lists every value. A pinned install adds --version 0.5.7 --set api.image.tag=0.5.7 --set ui.image.tag=0.5.7.
• Single host (Docker Compose, also air-gapped): compose/README.md.
• CLI: curl -fsSL https://runr.sh/install.sh | sh on Linux and macOS. The archives of every platform are at runr.sh/dl (https://runr.sh/dl/cli/v0.5.7/) and attached below; check them against checksums.txt (docs/cli.md#install).
• Terraform / OpenTofu: source = "runr.sh/brf-tech/runr". runr.sh serves the provider registry protocol; terraform init checks the archive against SHA256SUMS, signed with the RunR release key (key ID 2588846B241BC095) (docs/terraform.md#install).
• GitHub Action: uses: brf-tech/runr/actions/deploy@v0.5.7; it downloads the CLI from runr.sh (docs/github-action.md).
• Images: every image is published under ghcr.io/brf-tech/runr and pulls anonymously.

The documentation is at runr.sh/docs and in the documentation index here.

Upgrading

Upgrade in place with helm upgrade of the running release; never uninstall and install again. Back up the database first and read docs/upgrade.md.

• From 0.4.x: read the upgrade notes of 0.5.0 in CHANGELOG.md (roles and permissions, secrets encrypted at rest with APP_KEY), and those of 0.5.1, 0.5.2 and 0.5.4 below.
• Sign-in sessions (0.5.5): a sign-in session now ends 30 days after the sign-in (auth.loginTokenTtlDays). Sessions older than that end with the upgrade and their users sign in again; API tokens keep the expiry they were created with. See the 0.5.5 notes below.
• From 0.5.0: the upgrade moves every stored image reference from ghcr.io/runrsh to ghcr.io/brf-tech/runr.
• Terraform: change the provider source to runr.sh/brf-tech/runr and move the state once: terraform state replace-provider registry.terraform.io/brf-tech/runr runr.sh/brf-tech/runr (from 0.5.1 to 0.5.6), or registry.terraform.io/runrsh/runr as the old address (0.5.0).

Highlights of 0.5.0

• Functions, containers and WebAssembly: pluggable runtimes (a runtime.yaml manifest plus an image, in http, exec or persistent mode) with C, Rust, Bash and Q examples; WebAssembly functions on the runwasi Spin shim; uploaded images and .wasm modules (docs/runtimes.md, docs/wasm.md, docs/images.md).
• Deploy: git push deploys with GitHub App, GitLab and Forgejo integration and pull request previews; the runr CLI with runr dev, the Terraform provider and the GitHub Action (docs/git-deploy.md, docs/cli.md, docs/terraform.md, docs/github-action.md).
• Data and workflows: bindings for KV (Redis ACL users), object storage (Garage or an external S3 endpoint) and Postgres (CloudNativePG); durable workflows with Python and TypeScript SDKs (docs/bindings.md, docs/workflows.md).
• AI: GPU workers and GPU CaaS, one-click Hugging Face models online, offline or air-gapped, a built-in MCP server and hosted MCP servers, and the Sandbox API on Kata or gVisor with warm pools (docs/ai.md, docs/huggingface.md, docs/mcp.md, docs/sandbox-api.md).
• Security: roles and permissions (built-in and custom roles, groups, project access, SSO group mapping, scoped tokens), secrets encrypted at rest with rotation, an append-only audit log, a software supply chain (SBOM, vulnerability scan, cosign signatures, admission policy) and data residency (docs/permissions.md, docs/security.md, docs/supply-chain.md).
• Operations: OpenTelemetry tracing with Grafana Tempo, replay, uptime checks, a status page and alerts; white-label branding and self-service signup; billing calculation per tenant, with invoicing and payment left to your own billing system (docs/observability.md, docs/white-label.md, docs/billing.md).

Changes in 0.5.7 (2026-10-17)

Changed

• The CLI downloads from runr.sh. curl -fsSL https://runr.sh/install.sh | sh installs the runr CLI on Linux and macOS (amd64, arm64): it reads the latest release from https://runr.sh/dl/cli/latest.txt (RUNR_VERSION pins one), checks the archive's SHA-256 against the release's checksums.txt and installs into /usr/local/bin when that is writable, else into ~/.local/bin (RUNR_INSTALL_DIR sets another directory). The archives of every platform, Windows included, are under https://runr.sh/dl/cli/<tag>/. runr version --check-update (and update_check: true) reads the latest release from that latest.txt (docs/cli.md).
• Terraform provider address runr.sh/brf-tech/runr. runr.sh serves Terraform's provider registry protocol: with source = "runr.sh/brf-tech/runr", terraform init downloads the archive for the platform and checks it against the release's SHA256SUMS, signed with the RunR release key (key ID 2588846B241BC095). A configuration that used brf-tech/runr changes source and moves its state once with terraform state replace-provider registry.terraform.io/brf-tech/runr runr.sh/brf-tech/runr (docs/terraform.md).
• The GitHub Action downloads the CLI from runr.sh. cli-base-url defaults to https://runr.sh/dl/cli and version: latest is the tag in <cli-base-url>/latest.txt; the github-token input is gone (a workflow that still sets it gets an "unexpected input" warning) (docs/github-action.md).
• Documentation on runr.sh. The documentation is published at https://runr.sh/docs/ and the security policy at https://runr.sh/security/.
• The Helm chart comes from BRF's public Helm repository. The chart runr is installed without credentials: helm repo add brf-tech https://helm.brf.sh, then helm upgrade --install runr brf-tech/runr --set domain=…; the install, upgrade, key rotation and white-label examples use the chart brf-tech/runr instead of ./helm of a repository checkout (README, docs/upgrade.md).

Changes in 0.5.6 (2026-10-17)

Changed

• The CLI's own API token expires. runr login --with-password created its runr-cli@<host> API token without an expiry. The token now expires 90 days after the login; --token-ttl sets another lifetime (30d, 720h; 0 or never keeps a token without expiry). runr login and runr whoami show when it expires (token_expires_at in their JSON output, and in the context of the config file); once it has expired, a command the API refuses says that the token of the context expired and to log in again, and runr logout no longer tries to revoke it. A new runr login into a context revokes the token an earlier runr login --with-password created for it, as runr logout does: logging in again replaces a token from an earlier release with...