A small runtime footprint
Runway runs as a single self-contained process and is deliberately lightweight. It runs on a modest VM and scales up when you need it — no cluster required to get off the ground.
- A single process — one ~60 MB executable jar, nothing else to assemble
- ~350 MB RAM in practice; JVM heap capped at 1 GB, so it fits a 1 GB VM
- ~5–6 second cold start
- No database required — every site’s content lives as plain files on disk
- One dependency: a Java 25 (LTS) runtime
Found by search engines — and by AI
Classic SEO is automatic. And because llms.txt ships first-class, generative engines can read and cite your sites too — GEO, Generative Engine Optimization, built in rather than bolted on.
- Automatic sitemap.xml and robots.txt
- Per-locale hreflang and JSON-LD structured data
- llms.txt for GEO — AI/LLM search can read your sites
- Multilingual by default: locales, runtime translations, localized URLs
cross
Secure by design, not by reminder
Security is structural. Two realms that never cross, sessions scoped per site, and modern defaults throughout — so the safe path is the default path.
- Two never-crossing security realms
- Per-site session isolation
- Argon2id password hashing
- App-layer brute-force protection and a Content-Security-Policy
- Self-managed TLS behind your reverse proxy
True multi-tenancy, complete isolation
Every site is isolated in identity, data, and presentation — the boundary is architectural, not a setting you can misconfigure. And because each site is self-contained, a backup is the whole site: portable, complete, and safe to restore anywhere.
- Separate login realms — one tenant can never authenticate into another
- Its own folder on disk for all content and configuration
- Its own templates, chrome, assets, and translations
- Self-contained sites — backups are complete and portable by construction
- Restore anywhere, on any version — renders identically
Monitor it with the tools you already run
Runway is built to be watched. Scrape it from Prometheus through a Micrometer endpoint, and wire its health checks straight into Kubernetes or systemd.
- A Prometheus scrape endpoint, powered by Micrometer
- Kubernetes- and systemd-ready health checks
- Liveness and readiness probes out of the box
- Standard JVM, HTTP and per-site metrics in one place
Search, blog, and forms — included
The everyday building blocks of a real site are already here, each as a first-class plugin. Turn them on per site; swap the search engine when you outgrow the default.
- On-site full-text search, with an optional advanced engine
- A blog with its own URLs and feeds
- Contact forms and carousels out of the box
- Everything localizable per site
Extend the platform with drop-in plugins
Features are folders. Add one, restart, and it’s installed — the same mechanism the core itself uses. If a plugin fails to load, it’s skipped and logged; the platform stays up.
- Install by dropping in a folder and restarting
- A broken plugin is skipped — never crashes the platform
- Search, blog, forms and SEO/GEO are plugins themselves
- Built on the same extension points (SPI) you get
Open-source, and truly self-hosted
No SaaS in the loop. One self-extracting installer, a systemd service, and a first-run wizard — on your own Linux box. Because it’s open source, the whole platform is yours to read, audit, and change.
- Single self-extracting installer · no external build tooling
- Runs as a systemd service on your own Linux box
- First-run setup wizard
- Own, audit, and control the entire platform
Modern infrastructure, the boring-in-a-good-way kind.
Editable YAML and templates live on disk — portable and backup-friendly. No external build tooling; a single installer and a systemd service.
Read the docs →Give every site its own runway.
Install Runway on your own box and launch your first site in minutes. Own it, audit it, control it — end to end.