Self-hosted platform for internal tools

Deploy internal tools and team web apps on infrastructure you control.
Run on a VPS or Kubernetes with GitOps, RBAC, SSO, and audit logs built in.

QuickStart Teams Demo

Self-Hosted PaaS Alternative for Internal Tools

OpenRun is built for teams that deploy and operate internal tools, dashboards, automation interfaces and business web apps. It provides a Platform-as-a-Service (PaaS) style workflow while keeping application code, data and infrastructure under your organization's control.

Start on a Linux VPS or private server with Docker or Podman, then move the same declarative applications to Kubernetes when your team needs a distributed deployment. GitOps, SSO, RBAC, audit logs, service bindings, automatic TLS and scale-to-zero are built in.

What is OpenRun?

OpenRun is an open-source, self-hosted PaaS alternative for teams deploying internal tools and web apps. Run it on a VPS or private server with Docker/Podman, or on a Kubernetes cluster.

OpenRun adds the authentication, authorization and auditing features required for team use. Code-first apps get the platform capabilities usually found in enterprise low-code tools like Retool.

Motivation

OpenRun is built with these goals:

➣ Declarative deployments made simple
➣ Start on single-node, scale to Kubernetes if needed
➣ Make auth and RBAC easy for internal tools
➣ Easy SAML support without paying the SSO tax
➣ Run thousands of apps - zero idle resource usage

OpenRun Features

Some of the unique features of OpenRun are:
➣ Create and manage apps declaratively
➣ Easily upgrade from single-node to K8S
➣ Domain based or path based routing, with auto-TLS
➣ OAuth/OpenID/SAML/Cert auth, with RBAC
➣ Scales idle apps down to zero
➣ Staged deployment, for code and config changes
➣ Atomic (all or nothing) updates across apps
➣ Managed SQLite + Litestream replication to S3

Installation

Install OpenRun:

curl -sSL https://openrun.dev/install.sh | sh

Start OpenRun server (in a new window):

openrun server start &

GitOps in One Command

Schedule a sync:

openrun sync schedule --approve --promote \   github.com/openrundev/openrun/examples/utils.star

Starts a background sync which automatically creates new apps and updates existing apps, reading latest app config and code from Git.

Sample OpenRun Config

sample.star


# Set resource limits (optional)
limits = {"cpus": "1", "memory": "512m"}

# Streamlit App Declaration
app(path="/misc/streamlit_example", source="github.com/streamlit/streamlit-example",
    git_branch="master", spec="python-streamlit", container_opts=limits)
# FastHTML App Declaration
app(path="fasthtml.:", source="github.com/AnswerDotAI/fasthtml/examples",
    spec="python-fasthtml", params={"APP_MODULE":"basic_ws:app"}, container_opts=limits)
# This is the complete build and deployment config for two apps.

Container management

Build and deploy containerized web applications declaratively across Docker, Podman or Kubernetes using one consistent platform configuration.

Declarative GitOps

Manage staged deployments, versioned releases and preview environments through declarative GitOps workflows connected to GitHub or GitLab.

Scale down to zero

Initialize applications lazily on their first request, then automatically pause idle containers and reduce resource usage to zero.

PostgreSQL + MySQL Service Bindings

Automatically provision isolated PostgreSQL schemas and roles or MySQL databases and users, then inject unique application credentials securely.

SQLite + Litestream

Run stateful SQLite applications with persistent volumes, continuous Litestream replication to S3-compatible storage and automatic disaster recovery.

Flexible Auth

Protect every application with OAuth, OpenID Connect, SAML or client-certificate authentication plus flexible role-based access controls.

Comparison with self-hosted PaaS platforms

Compared with self-hosted PaaS platforms like Coolify, Kamal and Dokku, OpenRun provides:
➣ A declarative GitOps interface for application code and configuration
➣ Scale-to-zero for idle web apps
➣ Single-binary deployment to a VPS with Docker/Podman, or to Kubernetes
➣ Built-in OAuth/OIDC/SAML, RBAC and audit logs. Auth is done for apps also, not just the OpenRun console

OpenRun is a self-hosted PaaS alternative focused on web apps and internal tools. It does not deploy arbitrary databases or Docker Compose stacks like a full general-purpose PaaS. OpenRun instead supports service bindings which allows your apps to get easy access to a externally managed database/service.

Comparison with DIY on Kubernetes

Running OpenRun on Kubernetes gives you the benefits of Kubernetes without the pain. OpenRun provides:
➣ Unified interface as against glueing together services like Jenkins for builds, ArgoCD/FluxCD for CD, IDP for app management etc.
➣ Simple declarative config, no YAML files, no webserver DSLs.
➣ Support for setting up auth policies using RBAC.

Compared to Knative, OpenRun has a much simpler config without requiring YAML files. Resource usage is lower with OpenRun since apps are loaded lazily, on the first API call. OpenRun app versions are maintained in the metadata database, reducing Kubernetes resources created. Knative requires an external build system and does not support auth for apps.

Common use cases

OpenRun can be used by teams to:
➣ For operations teams to provide an easy on-ramp to Kubernetes for dev teams
➣ Deploy web apps with zero config required for most common frameworks like Streamlit/Gradio/FastHTML/NiceGUI etc.
➣ Replace Jenkins/Rundeck jobs, using OpenRun Actions for automating operational scripts
➣ Expose web apps for internal REST APIs, replacing manual curl commands

While the auth and auditing features of OpenRun are built for use by teams, OpenRun can also be used by individuals for:
➣ Zero-config dev env setup locally
➣ Host web apps shared with friends and family, using OAuth

Self-hosted platform for internal tools Hypermedia appsautomation scriptsinternal toolsAI appsStreamlit apps