Deploy your services and processes with a single binary, from one server to production infrastructure.
$ curl -fsSL https://get.runestack.io | sh
Rune borrows the mental model you already know from Kubernetes and Nomad — services, namespaces, secrets, policy — and strips it to the parts that earn their keep.
One verb deploys a service from a declarative file; the rest of the surface is the same muscle memory you'd expect — get, scale, logs, exec. No kubectl context juggling, no YAML archaeology.
service: name: api-core image: ghcr.io/acme/api-core:1.4.0 namespace: production instances: 3 ports: - 8080/http envFrom: - secretRef: db-credentials - configRef: api-config secretMounts: - secretName: jwt-signing-key mountPath: /etc/secrets/jwt health: http: /healthz interval: 10s
A runeset bundles the services, secrets refs, config and policy for an app into one versioned artifact — Rune's answer to a Helm chart. Lint it, pack it, cast it, roll it back. The file above is all it takes to stand a service up with secrets, config and health checks wired in.
Official Terraform modules provision runed across the major clouds. terraform apply, point your CLI at the context, and cast.
Rune isn't trying to run Google. It's trying to run your stack — with the smallest surface area that still feels like a real platform.
| Capability | Rune | Kubernetes | Nomad |
|---|---|---|---|
| Install footprint | single 28MB binary | control plane + etcd + kubelet | server + agents |
| Runs containers | ● yes | ● yes | ● yes |
| Runs raw processes | ● yes | — | ● yes |
| Encrypted secrets built-in | ● envelope encryption | base64 + addons | via Vault |
| Networking & policy | ● built-in | CNI plugins | via Consul |
| Identity & RBAC | ● built-in | ● yes | ACLs |
| Control API | gRPC + REST | REST | HTTP |
| Time to first deploy | minutes | days | hours |
// Reflects typical out-of-the-box setups · June 2026 · Kubernetes and Nomad are excellent at scale — this is about fit, not winners.
Rune's gRPC + REST surface renders as a Markline three-pane reference — endpoints, schemas and a request explorer — generated on every build and served from your own box.
$ grpcurl -d '{
"namespace":"production",
"spec":{ "name":"api-core" }
}' rune-prod:7700 \
rune.v1.Services/Cast
{
"service": "api-core",
"version": 4,
"ready": "3/3"
}
rune.sight is the log explorer that ships with runed — label-based search, saved views, log-based alerts and retention, served from the same box. No agents to wire up, no external SaaS to pay for.
Search every line by label — namespace, service, level, node — with live facets and a severity histogram.
Pin the queries your team runs daily and share them across the cluster.
Fire on log patterns — error rates, 5xx spikes, ingest drops — straight from a saved query.
Per-node rates, top streams and 14-day retention — all stored on your own box.
Rune is MIT-licensed and built in the open. No SaaS, no seats, no phone-home — the same binary you read is the one you ship.
One binary to install. One CLI to learn. Zero control planes to babysit.
$ curl -fsSL https://get.runestack.io | sh