inferencepath/membrane repository overview

⁠Membrane

Membrane is a self-hosted AI gateway that anonymizes inference calls at the egress boundary.
Applications call logical Pathways with a short-lived Caller Key; Membrane attaches pooled provider credentials server-side and strips all caller/organization identity before any request reaches a provider.

• Identity-safe egress — caller/org identity never crosses to the provider
• Logical Pathways & operations — apps target a Pathway, not provider endpoints or keys
• Provider-neutral — uniform request, response, and error behavior across providers
• Fail-closed — invalid or missing boundary config serves traffic to nobody
• Single static binary — distroless, non-root image; config supplied at runtime
• Built-in operator Console — token-protected admin UI on a separate listener

⁠Supported tags

Pin a fixed version or digest in production; avoid deploying latest directly.

⁠Configuration (managed mode)

Membrane holds no secrets or routing in the image.

Mount a bootstrap config at:

• /etc/inferencepath/membrane.yaml

Persist managed state at:

• data_dir (typically /var/lib/membrane) on a Docker volume

Operational config (providers, pathways, credentials, callers, permeability) is stored in the managed state store and configured via:

• Console (http://<host>:7474)
• CLI (membrane config apply -f bundle.yaml)
• Seed-on-empty (MEMBRANE_SEED)

Use secret references only (env: / file: / vault:), never inline secret values.

⁠Quick start (docker run)

docker run --rm \
  -p 8080:8080 -p 7474:7474 \
  -e OPENAI_API_KEY=your-provider-key \
  -e MEMBRANE_CONSOLE_TOKEN=your-admin-token \
  -e MEMBRANE_SEED=/var/lib/membrane/seed.yaml \
  -v membrane-data:/var/lib/membrane \
  -v "$PWD/config/membrane.yaml:/etc/inferencepath/membrane.yaml:ro" \
  -v "$PWD/config/seed.example.yaml:/var/lib/membrane/seed.yaml:ro" \
  inferencepath/membrane:v0.3.0