Deployment platform for internal tools

Deployment platform for teams to deploy internal tools.
Deploy internal tools securely with GitOps, RBAC, and auditing.

What is OpenRun?

OpenRun is a web app deployment platform for deploying internal tools. OpenRun is the easiest way to declaratively deploy web apps with GitOps, on a single-node or onto a Kubernetes cluster.

OpenRun adds the authn, authz and auditing features required by enterprises. OpenRun gives code-first apps the platform features usually found in low-code tools like Retool.

Motivation

OpenRun is built with these goals:

➣ Declarative deployments made simple
➣ Start on single-node, scale to Kubernetes if needed
➣ Make auth and RBAC easy for internal tools
➣ Easy SAML support without paying the SSO tax
➣ Run thousands of apps - zero idle resource usage

OpenRun Features

Some of the unique features of OpenRun are:
➣ Create and manage apps declaratively
➣ Easily upgrade from single-node to K8S
➣ Domain based or path based routing, with auto-TLS
➣ OAuth/OpenID/SAML/Cert auth, with RBAC
➣ Scales idle apps down to zero
➣ Staged deployment, for code and config changes
➣ Atomic (all or nothing) updates across apps
➣ Managed SQLite + Litestream replication to S3

Installation

Install OpenRun:

curl -sSL https://openrun.dev/install.sh | sh

Start OpenRun server (in a new window):

openrun server start &

GitOps in One Command

Schedule a sync:

openrun sync schedule --approve --promote \   github.com/openrundev/openrun/examples/utils.star

Starts a background sync which automatically creates new apps and updates existing apps, reading latest app config and code from Git.

Sample OpenRun Config

sample.star


# Set resource limits (optional)
limits = {"cpus": "1", "memory": "512m"}

# Streamlit App Declaration
app(path="/misc/streamlit_example", source="github.com/streamlit/streamlit-example",
    git_branch="master", spec="python-streamlit", container_opts=limits)
# FastHTML App Declaration
app(path="fasthtml.:", source="github.com/AnswerDotAI/fasthtml/examples",
    spec="python-fasthtml", params={"APP_MODULE":"basic_ws:app"}, container_opts=limits)
# This is the complete build and deployment config for two apps.

Container management

Build and deploy containerized web applications declaratively across Docker, Podman or Kubernetes using one consistent platform configuration.

Declarative GitOps

Manage staged deployments, versioned releases and preview environments through declarative GitOps workflows connected to GitHub or GitLab.

Scale down to zero

Initialize applications lazily on their first request, then automatically pause idle containers and reduce resource usage to zero.

PostgreSQL + MySQL Service Bindings

Automatically provision isolated PostgreSQL schemas and roles or MySQL databases and users, then inject unique application credentials securely.

SQLite + Litestream

Run stateful SQLite applications with persistent volumes, continuous Litestream replication to S3-compatible storage and automatic disaster recovery.

Flexible Auth

Protect every application with OAuth, OpenID Connect, SAML or client-certificate authentication plus flexible role-based access controls.

Comparison with other self-hosted solutions

Compared to solutions like Coolify, Kamal, Dokku etc, OpenRun has:
➣ Declarative GitOps interface, for code and for config. New apps can be added through config updates in git. No ClickOps, No manual deployments
➣ Scale idle apps down to zero
➣ Single binary, Docker/Podman or Kubernetes is only dependency, does not depend on a third party webserver like Traefik/Nginx

OpenRun supports enterprise features needed by teams, like OAuth/OIDC/SAML with RBAC and audit logs. OpenRun is built as a self-hosted Google Cloud Run/AWS App Runner alternative as against full PaaS solution. OpenRun does not support deploying auxiliary services like databases and there is no Docker Compose support.

Comparison with DIY on Kubernetes

Running OpenRun on Kubernetes gives you the benefits of Kubernetes without the pain. OpenRun provides:
➣ Unified interface as against glueing together services like Jenkins for builds, ArgoCD/FluxCD for CD, IDP for app management etc.
➣ Simple declarative config, no YAML files, no webserver DSLs.
➣ Support for setting up auth policies using RBAC.

Compared to Knative, OpenRun has a much simpler config without requiring YAML files. Resource usage is lower with OpenRun since apps are loaded lazily, on the first API call. OpenRun app versions are maintained in the metadata database, reducing Kubernetes resources created. Knative requires an external build system and does not support auth for apps.

Common use cases

OpenRun can be used by teams to:
➣ For operations teams to provide an easy on-ramp to Kubernetes for dev teams
➣ Deploy web apps with zero config required for most common frameworks like Streamlit/Gradio/FastHTML/NiceGUI etc.
➣ Replace Jenkins/Rundeck jobs, using OpenRun Actions for automating operational scripts
➣ Expose web apps for internal REST APIs, replacing manual curl commands

While the auth and auditing features of OpenRun are built for use by teams, OpenRun can also be used by individuals for:
➣ Zero-config dev env setup locally
➣ Host web apps shared with friends and family, using OAuth

Deployment platform for internal tools Hypermedia appsautomation scriptsinternal toolsAI appsStreamlit apps