openRun 0.3.1

Try it without installing anything: openrun-demo.fly.dev signs you in as Sam, a runner in a run club. It resets every night.

New

• Host it on Fly.io. No server of your own? docs/FLY.md and a ready-made fly.toml run openRun as one small always-on machine with your data on a volume, for a few dollars a month.
• No coffee cut-off. Coffee orders can now stay open after the run, until three hours after the start. It's the default for new runs; the other cut-offs are still there. People going still get a reminder before the start.

Fixed

• Forms say what's missing. On Firefox for Android, pressing a button with a required field empty seemed to do nothing. Now the field comes into view, is outlined in red, and a message says what to fill in.
• Sync now fetches every waiting run in one go, instead of 25 per press.

Security

• openRun now sends security headers:
  • Content-Security-Policy: only openRun's own scripts can run.
  • No framing: other sites can't embed it, which prevents clickjacking.
  • HSTS: over HTTPS, browsers are told to stay on HTTPS.

Upgrading

Back up first (how), then:

docker compose pull
docker compose up -d

No database changes. If you pinned ghcr.io/stretch0/openrun:0.3, you get this with the pull.

openRun 0.3.0

Try it without installing anything: openrun-demo.fly.dev signs you in as Sam, a runner in a run club. It resets every night.

Fixed

• Runs that turn out to be another sport are removed. If a watch records a bike ride as a run and you correct it on intervals.icu, the next sync removes it from openRun, along with its best efforts and any club shares. Race predictions no longer count it. If it's changed back to a run, the next sync imports it again. Uploads and runs added by hand are never touched. The sync log shows how many were removed.
• Sign out says "Signing out…" and explains why if it fails, instead of appearing to do nothing.
• The sign-in page no longer scrolls on Firefox for Android when the address bar is at the bottom.

Changed

• Club page: Manage sits on the same row as the back link, and the club's logo and name line up.
• Joining with a code is now a small "Have a code? Join a club" link, since most people join from an invite link. If you're not in any clubs yet, the form still shows straight away.
• Back links draw their arrow as an icon, so it lines up with the text.

Upgrading

Back up first (how), then:

docker compose pull
docker compose up -d

One database update (the sync log's removal count) is applied when openRun starts. If you pinned the release line in docker-compose.yml, change ghcr.io/stretch0/openrun:0.2 to :0.3.

To check the image:

gh attestation verify oci://ghcr.io/stretch0/openrun:0.3.0 -R stretch0/openRun

openRun 0.2.0

Try it without installing anything: openrun-demo.fly.dev signs you in as Sam, a runner in a run club. It resets every night.

New

• Club logos. Organisers can upload a logo and pick the square to keep, or fit the whole image. Clubs without one get a logo generated from their initials.
• Light or dark mode. Choose in Settings → This device, or keep following the device.
• A new look. The brand colour is now teal.
• Demo mode. DEMO_MODE=true turns an instance into a public demo: sample data, a shared login, and a reset every night. It replaces everything in the database, so never use it on a real instance. See docs/DEMO.md.

Security

• Updated dependencies with known vulnerabilities, including sharp (image handling, with its bundled libvips) and React Router (an open redirect in links).

• The Docker image no longer contains npm, corepack or Yarn. Nothing used them at runtime, and they made up most of the image's vulnerability reports.

• Node base images are pinned by digest, and every GitHub Action by commit.

• Images on GHCR carry signed build provenance, and each release includes a signed source archive. To check an image:

  gh attestation verify oci://ghcr.io/stretch0/openrun:0.2.0 -R stretch0/openRun

• CodeQL, dependency review, Trivy image scans and OpenSSF Scorecard run on every change. Vulnerabilities can be reported privately.

Upgrading

Back up first (how), then:

docker compose pull
docker compose up -d

One database update (club logos) is applied when openRun starts. If you pinned the release line in docker-compose.yml, change ghcr.io/stretch0/openrun:0.1 to :0.2.

openRun 0.1.0

The first release of openRun: a self-hosted running app for you and your run club. Your runs stay private unless you choose to share them.

What's in it

Accounts and setup

• One Docker image with SQLite; database updates apply on start
• Passkeys or email and password; the first account becomes the admin; optional invite-only sign-up
• Installable PWA that works offline from its cache

Run log

• Import FIT and GPX files (several at once, gzipped too) or add runs by hand; original files are kept
• Maps, splits, laps, pace, heart rate and elevation charts
• Best efforts and PBs, weekly and monthly totals, a year heatmap, race predictions, shoe mileage
• Export everything as JSON or CSV

Privacy

• Runs are private by default; you choose what each club sees
• Privacy zones trim shared maps near home or work
• No admin password resets or impersonation; a "who can see what" page

Run clubs

• Repeating and one-off runs, meeting points, RSVPs, weather forecasts
• Coffee after the run: a café menu, orders with a saved usual, and an order list to show at the counter
• Push reminders and change notices, per-club mute
• Share a run with a club as a copy, and take it back any time
• Attendance highlights (streaks, milestones, runs in the rain), never speed rankings
• Owners can hand a club to another member

Watch sync

• Runs from Garmin, Coros, Polar, Suunto and Wahoo arrive through intervals.icu every 30 minutes, as the original files
• Backfill from a chosen date; duplicates and deleted runs are skipped

Install

curl -O https://raw.githubusercontent.com/stretch0/openRun/main/docker-compose.yml
curl -o .env https://raw.githubusercontent.com/stretch0/openRun/main/.env.example

Set BETTER_AUTH_SECRET and ORIGIN in .env, then docker compose up -d. To stay on this release line, use ghcr.io/stretch0/openrun:0.1 in docker-compose.yml. The README covers HTTPS, upgrades and backups.

Not in this release

Training plans and an MCP server were dropped from v0.1, because Garmin MCP servers already build plans and put workouts on your watch. See ROADMAP.md for what's next.