Features

Everything Runway does — in depth.

Every capability in depth — a small runtime footprint, SEO & GEO, security, complete isolation, observability, built-in search & blog, extensibility, and open-source self-hosting, all on infrastructure you own.

01 · Footprint

A small runtime footprint

Runway runs as a single self-contained process and is deliberately lightweight. It runs on a modest VM and scales up when you need it — no cluster required to get off the ground.

  • A single process — one ~60 MB executable jar, nothing else to assemble
  • ~350 MB RAM in practice; JVM heap capped at 1 GB, so it fits a 1 GB VM
  • ~5–6 second cold start
  • No database required — every site’s content lives as plain files on disk
  • One dependency: a Java 25 (LTS) runtime
reference instance2 sites · 8 plugins
RAM in use~350 MB / 1 GB cap
comfortably fits a 1 GB VM
~60 MB
single executable jar
~5–6 s
cold start
0
databases required
1
dependency · Java 25 LTS
single process · ~26 threads · low idle CPU
02 · SEO & GEOTimely

Found by search engines — and by AI

Classic SEO is automatic. And because llms.txt ships first-class, generative engines can read and cite your sites too — GEO, Generative Engine Optimization, built in rather than bolted on.

  • Automatic sitemap.xml and robots.txt
  • Per-locale hreflang and JSON-LD structured data
  • llms.txt for GEO — AI/LLM search can read your sites
  • Multilingual by default: locales, runtime translations, localized URLs
auto-generated at /
sitemap.xml
robots.txt
hreflang · en/es/fr
structured-data · JSON-LD
llms.txt GEO
/en//es//fr/ localized URLs
Platform realm
never
cross
Site realm
Argon2idCSPTLS-readybrute-force guardsession isolation
03 · Security

Secure by design, not by reminder

Security is structural. Two realms that never cross, sessions scoped per site, and modern defaults throughout — so the safe path is the default path.

  • Two never-crossing security realms
  • Per-site session isolation
  • Argon2id password hashing
  • App-layer brute-force protection and a Content-Security-Policy
  • Self-managed TLS behind your reverse proxy
04 · Isolation

True multi-tenancy, complete isolation

Every site is isolated in identity, data, and presentation — the boundary is architectural, not a setting you can misconfigure. And because each site is self-contained, a backup is the whole site: portable, complete, and safe to restore anywhere.

  • Separate login realms — one tenant can never authenticate into another
  • Its own folder on disk for all content and configuration
  • Its own templates, chrome, assets, and translations
  • Self-contained sites — backups are complete and portable by construction
  • Restore anywhere, on any version — renders identically
sites/northbeam/
EN·ES·FR
sites/nocturne/
EN·ES·FR
sites/your-site/
+ add
isolated identity · data · presentation — no path between them
05 · Observability

Monitor it with the tools you already run

Runway is built to be watched. Scrape it from Prometheus through a Micrometer endpoint, and wire its health checks straight into Kubernetes or systemd.

  • A Prometheus scrape endpoint, powered by Micrometer
  • Kubernetes- and systemd-ready health checks
  • Liveness and readiness probes out of the box
  • Standard JVM, HTTP and per-site metrics in one place
GET /actuator/prometheus200 OK
# TYPE gauge
jvm_memory_used_bytes 3.62e8
http_server_requests_count 148920
runway_sites_active 2
runway_plugins_loaded 8
/health/live · 200/health/ready · 200
MicrometerPrometheusKubernetessystemd
06 · Built-ins

Search, blog, and forms — included

The everyday building blocks of a real site are already here, each as a first-class plugin. Turn them on per site; swap the search engine when you outgrow the default.

  • On-site full-text search, with an optional advanced engine
  • A blog with its own URLs and feeds
  • Contact forms and carousels out of the box
  • Everything localizable per site
search this site… full-text
/blog/roasting-notes-vol-3
name
email
send
07 · Extensibility

Extend the platform with drop-in plugins

Features are folders. Add one, restart, and it’s installed — the same mechanism the core itself uses. If a plugin fails to load, it’s skipped and logged; the platform stays up.

  • Install by dropping in a folder and restarting
  • A broken plugin is skipped — never crashes the platform
  • Search, blog, forms and SEO/GEO are plugins themselves
  • Built on the same extension points (SPI) you get
search
blog
contact-forms
seo-geo
carousel
+ your-plugin
drop in a folder · restart to install · a broken plugin is skipped
08 · Open source

Open-source, and truly self-hosted

No SaaS in the loop. One self-extracting installer, a systemd service, and a first-run wizard — on your own Linux box. Because it’s open source, the whole platform is yours to read, audit, and change.

  • Single self-extracting installer · no external build tooling
  • Runs as a systemd service on your own Linux box
  • First-run setup wizard
  • Own, audit, and control the entire platform
root@your-box
$ sh runway-installer.run
extracting — no external build tooling
installed systemd service · runway.service
setup wizard ready → https://your-box:8443
$
Under the hood

Modern infrastructure, the boring-in-a-good-way kind.

Editable YAML and templates live on disk — portable and backup-friendly. No external build tooling; a single installer and a systemd service.

Read the docs →
Java 25 Spring Boot 4 Embedded Jetty Filesystem-backed · YAML Decoupled Thymeleaf Plugin SPI
Ready when you are

Give every site its own runway.

Install Runway on your own box and launch your first site in minutes. Own it, audit it, control it — end to end.

$ sh runway-installer.run
Install Runway Documentation View source →