Release pkg/binding/v0.19.1

Changelog

Other

• 067d999: Pin SDK modules to v0.19.1 for release (@akclace)
• d4f03a3: Update govulncheck version (@akclace)

Release pkg/plugin/v0.19.1

Release v0.19.1 Latest

Latest

Compare

Choose a tag to compare

Release pkg/binding/v0.19.0

Changelog

Other

• 9606f9d: Add health check api for service bindings (@akclace)
• 0a8dafb: Added cache control config for static root files (@akclace)
• a019410: Added support for dynamically loaded plugins using same go-plugin mechanism as used for bindings (@akclace)
• aa83e0f: Fix data race during app reload (@akclace)
• 19dc86a: Fix panic during dir walk (@akclace)
• 5017b82: Pin SDK modules to v0.19.0 for release (@akclace)
• 2b35f07: Update actions tagging and Makefile (@akclace)
• 3b34bad: Update changelog (@akclace)
• 67f5f29: Update changelog (@akclace)
• 902351a: Update db secret key setting for kubernetes (@akclace)
• 80b2eb6: Update grpc module version (@akclace)
• f8f6585: Update grpc module version in test (@akclace)
• 904f05a: Update images (@akclace)
• a44272f: Update links (@akclace)
• bda90b3: Update readme (@akclace)
• c1907d4: Updated styling for action apps (@akclace)
• 573db2d: Updated to Schibsted Grotesk font (@akclace)

Release pkg/plugin/v0.19.0

Added

• Added support for dynamically loaded plugins using same go-plugin mechanism as used for bindings
• Added the static_root_cache_control app config property: sets the Cache-Control header value for files served from an app's static_root directory (favicons and other stable-named root files). Default is empty, no header. The built-in list_apps app sets public, max-age=3600.

Release v0.19.0

Compare

Choose a tag to compare

Changelog

Other

• 2b47842: Add usage checks for service and binding deletes (@akclace)

Release pkg/binding/v0.18.20

Release v0.18.20

Compare

Choose a tag to compare

Changelog

Other

• db49bd8: Added export and diff apis (@akclace)
• 5d29712: Refs #104: Added timeouts for git operations and health checks for metadata db (@akclace)
• e9a53d4: Update go version (@akclace)
• 1b275c5: Update go version (@akclace)
• 17ba0ef: Update to plugin verify options (@akclace)

Release v0.18.19

Compare

Choose a tag to compare

Changelog

Other

• e76ce1c: Add support for setting app config in app definition (@akclace)
• a7cbadb: Add support for starlark module load (@akclace)
• 45adea7: Added product comparison pages (@akclace)
• 63169f4: Added server status related apis (@akclace)
• 62d985b: Added use case docs (@akclace)
• 239a2b5: Bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#102) (@dependabot[bot])
• a532ba3: Fix #103: Added secret_reveal plugin function in openrun_admin (@akclace)
• 15d947a: Fix build issues (@akclace)
• 02e8c37: Fix cleanup (@akclace)
• 44aa63b: Fix demo link (@akclace)
• 9a7ddd6: Fix gen file creation for structured templates (@akclace)
• 7abc620: Fix static disk to work based on app settings. (@akclace)
• 5538f8a: Move sections (@akclace)
• cba133d: Moved redis binding to be builtin instead of dynamic loaded (@akclace)
• f155ce5: Support secrets for service config (@akclace)
• 7a86d69: Update icons (@akclace)
• d387cac: Update index intro descriptions (@akclace)
• 559264f: Update index page to add word wheel (@akclace)
• 932f6b7: Update landing page (@akclace)
• 82d1c08: Update links to docs (@akclace)
• b31549a: Update readme (@akclace)
• 5ef09f0: Update sqlite and litestream docs (@akclace)
• 40aae7d: Updated version number (@akclace)

Added

• Added openrun_admin.secret_reveal: returns the clear text value of a secret reference (typically an app param holding {{secret_from ...}}), so an HTML app can pass an API key into a served page explicitly while the value lives only in the secret store, never in the app source or git history.
• Serving app files directly from the local disk source directory is now driven by the static_from_disk app config property instead of being hardcoded to the static_disk spec name.
• The ace.app settings dict now supports an app_config section which sets app config properties from app.star, e.g. settings={"app_config": {"fs": {"retain_versions": 3}}}.
• The redis/valkey service binding is now compiled into the server as a built-in binding type; it no longer needs openrun provider install redis. Each base binding gets a dedicated ACL user restricted to a unique key prefix (and matching pub/sub channel prefix); derived bindings share the base prefix with grant-controlled patterns. Requires Redis 7+ or Valkey, standalone mode.
• Added openrun server stop --wait: waits for the server process to fully exit instead of returning as soon as shutdown starts (the final litestream sync runs as the process exits, so scripts that move or restore data directories after a stop need this). Over the unix domain socket the server's pid (now returned by the stop API) is polled; over http(s) the listener port is polled as a best effort signal. Also added openrun server status (prints ok when the server connection works) and openrun server version (reports the server's build version and commit).

Fixed

• The openrun CLI now discovers a machine scoped Windows service install: when OPENRUN_HOME is not set and no config is found relative to the executable (a winget binary is a links shim, so executable-relative discovery finds nothing), it checks %ProgramData%\openrun\openrun.toml and connects to the server's unix domain socket under that home, like /var/lib/openrun on Linux. Previously the CLI fell back to $HOME\openrun and failed to find the service's socket unless OPENRUN_HOME was set machine-wide.

Release v0.18.18

Compare

Choose a tag to compare

Release v0.18.17

Compare

Choose a tag to compare

Added

• Added the sqlite service binding type: an app bound to a sqlite service gets a persistent volume (Docker/Podman named volume or Kubernetes PVC, ReadWriteOnce with single replica and Recreate strategy) holding its SQLite database files, surfaced through the SQLITE_URL/SQLITE_DB_PATH/SQLITE_DIR env variables. The mount directory defaults to /data and is configurable per binding with the path binding config key. An app can have one sqlite binding and a binding can be attached to one app (single-writer database); derived bindings and grants are not supported.
• Added Litestream-based continuous replication to S3-compatible storage, configured as named [litestream.<name>] server config entries. metadata.litestream_config replicates the server's own metadata and audit databases (embedded Litestream, restore-on-startup rebuilds a lost node from the replica); a sqlite service's litestream_config config replicates its apps' databases via a per-app replication container (Docker/Podman) or restore init containers plus a native sidecar in the app pod (Kubernetes 1.29+). Every *.db file in the binding directory is replicated, missing databases are restored from the replica before the app starts, and prod/staged environments replicate to separate locations (a linked staging service can use its own litestream config).
• Auto bindings can now carry binding config through the --bind source reference, e.g. --bind "sqlite;path=/mydata"; the comma separated params become the auto binding's config, for any service type. Slice CLI flag values are no longer split on commas (pass multiple values by repeating the flag).
• Zero downtime in-place restarts (Linux/macOS): openrun server restart (or SIGHUP, or POST /_openrun/restart) re-execs the server binary and hands the HTTP/HTTPS/unix-socket listeners to the new process.
• Added login page for system and builtin auth type and generic logout page
• Add support for Windows binary signing with signpath.io

Fixed

• Fix WAL cleanup for SQLite based metadata

Release v0.18.15

Compare

Choose a tag to compare

Release v0.18.14

Compare

Choose a tag to compare

Release v0.18.12

Compare

Choose a tag to compare

Release v0.18.11

Compare

Choose a tag to compare

Added

• Added out-of-process binding providers: new binding types (mongodb, redis/valkey, sqlserver, oracle) are built as standalone executables in the openrundev/bindings repo and invoked by the server over gRPC using hashicorp/go-plugin, so adding a binding type no longer grows the openrun binary or its dependency tree. Providers are installed with the new openrun provider install/uninstall/list commands (/_openrun/provider APIs, gated by the new provider:read / provider:manage RBAC permissions); the install is recorded in the metadata database with pinned sha256 checksums, so it survives restarts and propagates to all server replicas — each replica materializes the verified binaries into the bindings.cache_dir local cache at startup, before serving traffic, making installs work on Kubernetes multi-replica deployments.
• Added the OCI image distribution path for binding providers: each provider release also publishes a minimal FROM scratch image (ghcr.io/openrundev/openrun-binding-<name>), and the Helm chart's bindings.images values render one init container per provider which copies the binary (via the provider binary's new export subcommand) into a shared volume. The server registers pre-placed provider executables from the new bindings.preinstalled_dir config at startup, with no downloads and no database registration — integrity comes from the image digests, and the sha256 computed at discovery is verified on every provider launch. The new bindings.disable_install config (chart value bindings.disableInstall) rejects the imperative openrun provider install/uninstall API/CLI, for deployments where providers are managed only declaratively.
• Add agent builder support using ACP integration
• Added the builtin app auth type: username/password authentication (HTTP Basic) against [builtin_auth.<username>] config entries, each with a bcrypt password hash and a groups list used for RBAC group: matching (user id is builtin:<username> in grants). Users can be defined statically in openrun.toml or managed dynamically with the new openrun user add/update/delete/list commands (/_openrun/user APIs), which take effect immediately without a server restart and shadow static entries of the same name. Useful for small deployments and for testing RBAC policies with multiple users and groups without setting up OAuth/SAML.
• Added the global CLI flag --as <provider>:<username> (e.g. openrun --as builtin:user1 app list): the management API call runs as the given user with RBAC enforcement (permission checks, list filtering, the owner rule, audit attribution) instead of as the trusted administrator. Supported over the unix domain socket only and requires RBAC to be enabled; for builtin: users the entry must exist and its groups feed group: grant matching, other provider ids (e.g. github:user) are taken literally with no groups so grants for SSO identities can be tested without creating them. Useful for testing RBAC policies from the CLI without going through an app.
• The stop_server management API now enforces the server:stop RBAC permission (reachable only through --as; the trusted admin CLI is unaffected).
• Service and binding RBAC permissions are now scoped by grant targets, like app permissions. Grant targets accept service:<glob> entries matched against service ids (<type>/<name>, e.g. service:postgres/*) and binding:<glob> entries matched against binding paths (e.g. binding:/apps/team1/**); all matches every app, service and binding. New permissions: service:bind (provision binding accounts on a service, required to create base/auto bindings from it), binding:use (attach a binding to an app or derive a new binding from it), binding:reveal (read back binding account credentials with binding show-account; like secret:reveal it always needs an explicit grant — it is never implied by binding:manage and binding owners do not hold it by default, opt owners in via owner_permissions.binding), and the service:manage / binding:manage composites. Attaching bindings at app create/update/apply time now enforces binding:use / service:bind for newly added bindings, sync background runs enforce them against the frozen creator snapshot, and service/binding list operations (including export) return only the entries the user can read. The creator of a service or binding holds the owner permissions on it (default service:manage / binding:manage, configurable via owner_permissions).

Changed

• service:* and binding:* permissions are no longer global. A grant that should confer them must include service:/binding: target entries (or use the all target); grants whose targets only name app paths no longer confer any service or binding permissions. Sync entries created before this change froze grants without typed targets — recreate RBAC-snapshotted syncs whose apply files manage bindings.
• The app-level binding source whitelist is removed in favor of the scoped RBAC checks: the --bind-perm flag, openrun app update bind-perm, the bind_perm apply file argument, the permissions.binding_source_perms server config and the runtime container-start source check are gone, and approval no longer covers binding sources. Binding access authority is now checked when the binding is attached (RBAC binding:use/service:bind); with RBAC disabled, management operations are admin-only as usual.

Fixed

• App version history now records the user who created each version (create, update, reload, apply, promote). Previously every app_versions row was attributed to admin regardless of the caller, so version listings misattributed changes made by RBAC/SSO/builtin users. Trusted CLI/UDS calls (no user identity) keep the admin attribution.
• RBAC regex: user patterns (in grant.users and group members) now must match the entire user ID instead of any substring. Patterns already anchored with ^...$ behave the same as before.
• Grant target globs are now validated when the RBAC config is updated. A malformed target previously caused authorization checks that evaluated the grant to error at request time.

Added

• Added an embedded secrets store: the db secret provider encrypts values with AES-256-GCM and saves them in the metadata database. The master key is auto generated into $OPENRUN_HOME/config/secret.key or can be a {{secret_from ...}} reference resolved through another provider (for Kubernetes, mount it from a native Secret). Secrets are managed with the openrun secret create/list/show/delete/rekey commands, the /_openrun/secret management APIs and the openrun_admin plugin (create_secret, get_secret, list_secrets, delete_secret, rekey_secrets); create generates a unique name from a prefix and prints the {{secret_from "db" "<name>"}} reference to use. New secret:create, secret:read, secret:delete and secret:reveal RBAC permissions gate the APIs.
• The management console can now store values as secrets with one click: value fields in app params, service and binding config, config entry forms (OAuth client id/secret, git auth) and the system config key/value tables have a lock button which encrypts the value (or a picked file's content, for example an SSH private key) into the embedded secrets store and replaces the field with the generated {{secret ...}} reference.
• Added the git_auth setting private_key for providing the SSH private key contents inline (supports {{secret ...}} references), as an alternative to key_file_path.
• Added the app code setting container.separate_stage_prod_images for specs that need distinct staging and production container images.
• With structured templates, a route's full template (and template names passed to ace.response) can now name a {{define}} block from the base templates instead of a template file, so fragment-only endpoints need no dedicated template file.
• Added the static_disk app spec for serving static files directly from a local source directory without storing the static file contents in the metadata database.
• Container management operations are now gated by RBAC. New container:read permission covers listing containers, getting container details, logs and Kubernetes stats/status; new container:manage permission covers starting and stopping managed containers (and implies container:read). These operations previously had no RBAC check.
• Added the audit:read RBAC permission, which grants read access to the audit log across all apps. It gates the list_audit_events and list_operations plugin APIs, which previously had no RBAC check.

Fixed

• The delete_apps plugin API now rejects an empty path glob instead of matching every app: a caller omitting the path argument could previously delete all apps (the HTTP route already validated this, plugin calls did not).
• Scheduled sync runs now record a synthesized request id on their audit events, attributed to the user who created the sync. These events previously had no request id since no HTTP request is behind a scheduled run, so they could not be traced; now all events of one run share an id and the audit trace shows everything the run did.

Changed

• App responses now include baseline security headers by default: the new security.headers_level app config defaults to 2, which adds X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN and Referrer-Policy: strict-origin-when-cross-origin when the app did not set its own value. Apps embedded in cross-origin iframes need security.headers_level = 0 (settable per app with openrun app update conf) or an app-provided X-Frame-Options/CSP header, which takes precedence. Levels 5 and 10 opt into stricter sets (HSTS, CSP).
• The proxy write-access check for staging and preview apps (stage_enable_write_access / preview_enable_write_access) now treats every method other than GET, HEAD and OPTIONS as a write, so PATCH and custom verbs fail closed; denied requests now return 403 instead of 500.
• New production apps now create their linked staging app on a staging subdomain by default, for example stage.example.com:/app, instead of suffixing _cl_stage to the production path. Use system.stage_at, system.default_stage_domain, openrun app create --stage-at, or declarative stage_at to choose path-based staging or a specific staging domain for new apps.
• Containerized staging and production apps now share the same generated image name by default when the build inputs match, avoiding a second image build during production promotion. Specs can opt out with settings={"container": {"separate_stage_prod_images": True}}.
• Kubernetes deploys now watch Deployment rollout status instead of relying only on repeated polling, reducing API overhead and returning sooner when Kubernetes reports readiness or rollout failure. The watch path uses the same container.deploy_health_attempts budget, and the best-effort EndpointSlice convergence check now skips immediately when the Kubernetes API or RBAC policy does not allow listing EndpointSlices.
• Docker/Podman container names and image tags are much shorter: the version suffix is now the first 16 chars of the content hash (matching Kubernetes workload names) instead of a base32 encoding of the full hash, for example clc-app_prd_<id>-e96c79f753cfafff instead of a 143-character name. Containers running under the old names are stopped by the stale-container sweeper after upgrade and the app is recreated under the new name on its next request; images built under old tags are not reused.

Added

• Added the app internal /_openrun_app/verify_file/{file_name} API to verify that an app-relative source file exists and return its size.

Fixed

• Fixed service stop error when running as windows service

Security

• Fixed an open redirect issue reported by @Fushuling https://github.com/openrundev/openrun/security/advisories/GHSA-h5g6-xmh4-hc37

Added

• Added Windows Service Control Manager support for openrun server start, allowing OpenRun to run as a native Windows service registered with sc.exe.

Changed

• Proxied responses now rewrite the Location header so upstream redirects don't leak the internal backend authority. Absolute Locations pointing at the proxy target are converted to path-only URLs, and path-absolute Locations get any stripped prefix (strip_app / strip_path) restored so the client's next request lands on the same public route. Cross-host Locations (OAuth/SSO and similar) pass through unchanged.

Added

• Added forward auth support for apps using auth modifiers such as system+forward_policy, with named [forward.<name>] configs, trusted forwarded/OpenRun identity headers and configurable copied response headers.

Changed

• Fix #95: Pull image and update apps which use image spec when app reload is done.

Added

• Added background cleanup for stale Docker/Podman containers started by OpenRun. The cleanup stops running OpenRun-labeled containers that are no longer referenced by an active app, and its interval is configurable with system.stale_container_cleanup_interval_mins.

• Fix #94: Added X-Openrun-User-Id and X-Openrun-User-Email headers for proxied apps, and exposed the same OIDC subject/email values on the Starlark request as UserSubject and UserEmail.

Changed

• Action request bodies are now capped by default at 33554432 bytes. The limit can be configured globally with app_config.action.max_request_body_bytes or overridden per app with openrun app update conf --promote 'action.max_request_body_bytes=<bytes>' /myapp.
• http.in requests now inherit the current request context, support an optional timeout argument with a default of 300 seconds, and automatically close unread response bodies through deferred plugin cleanup when body() or json() are not called.
• Fix #91: Store session info in metadata KV store to avoid cookie size limits
• Fix #85: openrun app create --cvol and openrun app update cvol now reject container volume values that start with --, making missing volume arguments fail clearly instead of consuming the next option as the volume name.

Added

• Added security.trusted_proxies server config to control which reverse proxies or load balancers are allowed to supply forwarded client IP headers.
• Added system.fallback_unknown_domains server config to optionally preserve legacy routing of unknown hostnames to the default domain.
• Added system.builder_auth_token server config for delegated container builds, using a shared bearer token between the main OpenRun install and builder node(s).
• Added security.allowed_mounts server config to allow administrators to approve host directories that apps may use as container bind-mount sources.

Changed

• req.RemoteIP now ignores X-Forwarded-For and X-Real-IP unless the direct peer is listed in security.trusted_proxies.
• Reverse proxied requests now strip inbound forwarding headers and rebuild a clean X-Forwarded-* / X-Real-IP set before sending the request upstream.
• Requests for unknown Host values no longer route to the default domain unless system.fallback_unknown_domains is explicitly enabled.
• Delegated builds now require a valid bearer token on /_openrun/delegate_build. Builder nodes should run with builder.mode = "delegate_server" and no longer require security.admin_over_tcp = true for delegated-build ingress. Existing delegated-build setups must set the same system.builder_auth_token value on the main install and every builder node before upgrading.
• CORS is disabled by default for apps. The default app_config.cors.allow_origin is now empty and app_config.cors.allow_credentials is now "false". Apps that need browser cross-origin access must opt in with an app config override such as cors.allow_origin="https://frontend.example.com" or cors.allow_origin="origin".
• The default server-level container.config(...) permission no longer allows access to all secrets. Containerized apps that pass secrets through params, build args or generated secret volumes now need an explicitly approved container.config permission with the required secrets=[...] allowlist, unless the server config is intentionally changed to allow those secrets globally.
• Container runtime options now only pass raw Docker/Podman flags from app metadata when the flag is explicitly listed in security.allowed_container_args. Built-in cpus and memory options continue to be parsed by OpenRun and do not require this raw flag allowlist.
• Container bind-mount sources are now restricted to the app source directory, the app runtime directory, or directories listed in security.allowed_mounts. Relative bind sources must stay inside the app source tree.

Added

• Added UserId, CustomPerms, and AppRBACEnabled to the request object available in Starlark handlers and HTML templates.

Added

• Added system.list_apps_title and system.show_hosted_with server config options to customize the built-in app listing page title and whether it shows the Hosted with OpenRun text.

• Add the security.auth_required server config option. When enabled, apps configured with auth="none" are denied at request time with 401 Authentication required, providing a server-wide guardrail against unauthenticated app access.

Added

• Added automatic app version cleanup with a default retention of 5 older versions per app, configurable globally with app_config.fs.retain_versions and per app with openrun app update conf --promote fs.retain_versions=<count> /myapp.

Added

• Support for default permissions in server config. Containerized apps do not require explicit approval.

Added

• Postgres database support for store plugin

Changed

• Changed python appspecs to use uv for managing dependencies

Changed

• Updated appspecs to not use heredocs since Kaniko does not support it

Added

• Lots of changes for Kubernetes support.