The "last mile" problem of AI infrastructure: How do you reliably deploy and run a real AI model in a place with no internet?
Aegis solves this with a deterministic, profile-driven deployment engine that packages everything (code, models, containers) into a portable bundle you can carry on a USB stick into a restricted or air-gapped environment.
Think of it like this:
- You have a powerful but tiny AI model (Microsoft Phi-3 mini, 3.8 billion parameters).
- You want to run it on a cheap GPU (NVIDIA T4) inside a locked-down location (no internet allowed).
- You need to prove it works without ever touching the public internet after deployment.
Aegis gives you a repeatable way to:
- Define what you want using simple YAML profiles
- Automatically generate all the Kubernetes files
- Bundle models + container images into one portable file
- Deploy it (even on a fresh machine with zero internet)
Core promise: Once the bundle is on the target machine, the AI will keep working even if you cut the network cable.
graph LR
A[Your Laptop<br/>with Internet] -->|1. aegis-cli generate| B[Generated<br/>K8s Manifests]
A -->|2. Mirror images + models| C[Staging Folder]
B & C -->|3. aegis-cli bundle| D[Portable<br/>.bundle file]
D -->|4. Sneakernet / USB| E[Air-Gapped Machine]
E -->|5. bootstrap.sh| F[Running K3s Cluster<br/>+ Phi-3 Inference]
style D fill:#e1f5fe
style F fill:#e8f5e9
Key Components:
- Generator (
aegis-cli): Turns a profile into real Kubernetes YAMLs - Mission Control: A small FastAPI app that is the only thing allowed to talk to the AI model
- Bundle: One file containing everything needed to run offline
# 1. Build the CLI
go build -o aegis-cli ./cmd/aegis-cli
# 2. List available setups (profiles)
./aegis-cli profiles list
# 3. Generate everything for a demo on GCP
./aegis-cli generate --profile gcp-demo --out ./out/gcp-demo
# 4. (Optional) Create a fully portable offline bundle
./aegis-cli bundle --profile airgap-sim --out aegis.bundleSee the Complete Beginner Tutorial if you're new to this kind of tooling.
After everything is deployed in the locked-down environment, you must be able to run one command from inside the cluster and get:
- ✅ GPU is visible (
nvidia-smiworks) - ✅ The AI model was loaded from local disk (never downloaded from the internet)
- ✅ You get a useful answer back, and zero traffic left the machine to the outside world
| Who are you? | Start Here |
|---|---|
| I have 5 minutes | QUICKSTART.md |
| Complete newbie | grok-build-tutorial.md |
| Want to try it quickly | docs/ONBOARDING.md |
| Need exact commands | docs/RUNBOOK.md |
| Want to understand the long plan | docs/PLAN.md |
| Working on the code | AGENTS.md |
| Testing / Validation | TESTING.md |
Diagram Sources: All Mermaid diagrams live as editable source files in docs/diagrams/. Regenerate PNG/SVG versions anytime at mermaid.live.
- Phases 1–4: Complete (including true zero-internet "golden images")
- Phase 5: Code complete — you can now choose between Ollama or vLLM as the inference engine using the same system
- Phase 6+: Early design work started (multi-node clusters)
See docs/PLAN.md for the full roadmap.
Aegis is being actively aligned with defense and enterprise standards (see docs/reference.md for details).
| Area | Status | Notes |
|---|---|---|
| NIST SP 800-161 (C-SCRM) | 🟡 In Progress | SBOM + cosign signing scaffolding added (Phase 7) |
| DoD DevSecOps (Declarative) | 🟡 Partial | Strong at K8s layer; pipeline still has manual steps |
| CNCF Air-Gapped Deliverables | ✅ Good | Pre-mirroring + portable bundle |
| Reproducibility | 🟡 Improving | Pinned images + manifests; digest pinning in progress |
| Target Verification | ✅ Good | Mandatory SHA256 in bootstrap + web inspector |
Legend: ✅ Solid | 🟡 In Progress / Partial | 🔴 Major Gap
- Go 1.23+
- Python 3.11+
- Docker (to export container images)
- (Optional) GCP account with T4 GPU quota for full end-to-end testing
License: Internal demo / proof-of-concept. Not intended for production without security review.