Compute infrastructure,scaled to zero.
Amoeba is an edge-aware L7 application and compute gateway written in Rust. It runs containerized microservices — AI models, scrapers, document parsers, and stateful nodes — on demand, with zero-trust auth, capacity gating, and full audit trails. No Kubernetes, no managed control plane.
The Problem
Idle compute is expensive, and Kubernetes is overkill for one machine.
Services run 24/7, whether anyone's calling them
Most schedulers keep containers hot around the clock. AI models, scrapers, and parsers that see bursty traffic still burn CPU, memory, and GPU-VRAM sitting idle.
Auth gets rebuilt for every service
Without a shared gateway, teams reimplement JWT validation and role checks inside every microservice — and every implementation drifts a little further from the last.
No record of who called what
When usage, cost, and compliance questions come up, teams without built-in metering end up stitching logs together from a dozen different tools after the fact.
How Amoeba Works
One binary in front of every service you run
A two-tier design: an edge proxy (Caddy or Traefik) handles public TLS, while Amoeba manages container lifecycles, auth, capacity, and telemetry behind it.
Services start on the first request, stop when idle
Every service boots on demand and winds down after a configurable cooldown — cutting idle compute cost without hand-rolled scripts or a Kubernetes HPA to babysit.
- Per-service cooldown windows before shutdown
- Single containers or full Docker Compose stacks
- Runs on a bare VM — no control plane required
"placement": { "cooldown_seconds": 180 },
"container": { "image": "ollama/ollama:latest" }
}
Role-based access on every request, no upstream changes
JWT-based auth — local HMAC or remote JWKS — sits in front of any backend service and applies read, add, update, and delete permissions per role before a request ever reaches the container.
- Local HMAC or JWKS-backed token verification
- Zero code changes required on upstream services
- Credential translation bridges different auth schemes
Declare a CPU, memory, and GPU budget — Amoeba enforces it
Operators declare a machine's resource budget; the orchestrator sums active service footprints and rejects requests with a 503 before admitting a workload that would exceed it. Every proxied request also generates telemetry — caller, org, service, status, latency — for compliance and chargeback.
One binary, no DNS records or per-service SSL
New services go live at /v1/<service_name>/<subpath> — no subdomain, no reverse-proxy rule, no certificate to provision per service. Editing services.json is picked up immediately, with no restart required.
Deploy It Your Way
One machine or a whole fleet
Single Machine
- Edge proxy (Caddy/Traefik) + orchestrator on one Docker network
- Runs on Docker (Linux/Windows) or Apple's container CLI (macOS)
- First admin bootstrapped via the
amoeba-adminCLI
Multi-Machine Fleet
- One independent Amoeba instance per physical machine
- Each manages its own Docker socket — no central control plane
- Identity unified across machines via a shared JWKS provider
Amoeba
Run compute where you need it,
not where a scheduler decides.
Clone the repo, drop in your services.json, and get a zero-trust compute gateway running in minutes — no Kubernetes cluster required.