- RBAC with built-in and custom roles, groups, project access, SSO group mapping and scoped tokens.
- Secrets encrypted at rest with rotation, and an append-only audit log.
- Pluggable runtimes through a universal wrapper; C, Rust, Bash and Q examples.
- The runr CLI, a Terraform provider and a GitHub Action.
- Durable workflows with Python and TypeScript SDKs.
- Git deploy: git push, GitHub App, GitLab and Forgejo, and PR previews.
- Sandbox API on gVisor and Kata, with warm pools and SDKs.
- WebAssembly functions on Spin.
- Bindings: KV, object storage and Postgres.
- Supply chain: SBOM, scanning, signing, an admission gate and data residency.
- Observability v2: OpenTelemetry and Tempo, replay, uptime, status page and alerts.
- GPU workers, GPU CaaS and one-click Hugging Face models.
- An MCP server and hosted MCP servers.
- Image and .wasm uploads.
- White-label branding and self-signup.
- Billing that calculates usage and charges for an external billing system through an API and signed webhooks.

Upgrading from 0.4.x: see docs/upgrade.md.