GitLab’s AI Gateway is a standalone service that connects GitLab Duo features to model endpoints; it is not the large language model (LLM) itself. A GitLab Self-Managed installation can use GitLab’s hosted gateway, run its own gateway and supported models, or combine the two. Which parts are actually self-hosted depends on the configuration chosen for each feature.
What the AI Gateway does
GitLab describes the AI Gateway as a standalone service that provides access to GitLab Duo AI features and mediates connections between GitLab and configured model endpoints. In GitLab’s hosted arrangement, GitLab operates the gateway. A customer can instead deploy a gateway in its own environment through GitLab Duo Self-Hosted.
As an Amazon Associate I earn from qualifying purchases.
The gateway handles the feature integration and request path; the model-serving platform runs or provides inference. A self-hosted gateway can connect to models inside the customer’s infrastructure, or to cloud model services such as AWS Bedrock or Azure OpenAI. In the latter case, the gateway is local but model inference is not necessarily local or isolated from the internet.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow a self-hosted request flows
- A user invokes a GitLab Duo feature.
- The GitLab instance authorizes the request and issues a self-signed token.
- The self-hosted AI Gateway verifies the token against the GitLab instance.
- The gateway forwards the prompt to the configured model endpoint.
- The response returns through the gateway to GitLab.
GitLab documents this self-issued-token model for self-hosted deployments; credentials for this setup are not synchronized with cloud.gitlab.com. See GitLab’s configuration documentation and self-hosted authentication guidance.
Three deployment choices
| Configuration | Who hosts the gateway and models | Network consequence | Main trade-off |
|---|---|---|---|
| Fully self-hosted gateway and models | The customer hosts the gateway and supported model infrastructure. | Can operate in a fully isolated network when all configured features use supported self-hosted models. | More control over data and security boundaries; the customer handles setup and maintenance. |
| Hybrid | The customer hosts a gateway and models for some features; selected features use GitLab-managed models. | Internet access is required for features routed to GitLab-managed models. Those requests go through GitLab’s hosted gateway. | Allows per-feature choices, but managed-model traffic is not isolated within the customer environment. |
| GitLab-managed gateway and models | GitLab manages the gateway and model integrations. | Requires internet connectivity. | No customer-hosted AI gateway infrastructure to maintain, but less control over model infrastructure. |
These distinctions matter more than whether the GitLab application itself is self-managed. In a hybrid setup, the data path depends on the model selected for each feature; do not assume every request uses the customer-hosted gateway. GitLab’s configuration overview describes the available arrangements.
Gateway hardware is not model hardware
GitLab’s installation guidance states: “A GPU is not needed for the GitLab AI Gateway.” That is about the gateway service only. A self-hosted model may have separate CPU, GPU, memory, serving-platform, and throughput requirements. Check the requirements for the chosen supported model and inference platform before sizing or buying hardware; a locally hosted gateway connected to a cloud model endpoint does not make that endpoint’s inference local.
Rank #2
- It is tracking-free for secure Remote Desktop (RDP), secure Network Attached Storage (NAS), secure Site-to-Site VPN, and Bitcoin Private Key backups.
- WIRED CONNECTIVITY: Stealth Remote Access Solution includes a hardware Private Matter Gateway (PMG) and 1-year of Virtual Machine Server (VMS) service bundle. After 1 year, a $36 annual service fee applied.
- Subscription Activation: Log in to activate.primes.com. You'll just need to input your Order ID, Device ID, and email address. We'll then send your client credentials straight to your inbox, and your device will be ready to go, no extra registration needed.
- Zero-Configuration: Deploys a zero-configuration VPN gateway at a private LAN. Simply connect a network cable, plug in power, and push a button – zero configuration required.
- Zero-Registration: Bypasses cloud-based middleman architectures with zero-registration and eliminates inherent user activity tracking by the cloud servers.
GitLab’s current installation guide lists approximately 340 MB of compressed image space for linux/amd64, at least 512 MB of RAM, and access to at least two CPUs for the AI Gateway and Duo Workflow services. These are stated minimums, not production sizing advice; GitLab notes that more resources may improve performance under heavy usage. The image-size figure is for the gateway image, not an LLM.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteInstallation and version compatibility
GitLab documents Docker and Kubernetes/Helm installation paths in its AI Gateway installation guide. The Docker example uses a reachable hostname rather than localhost, with port 5052 for HTTP and port 50052 for gRPC communication with the GitLab Duo Agent Platform service. The Helm path covers namespace setup, TLS certificates, ingress and gRPC TLS proxy configuration, and Kubernetes secrets.
Rank #3
For the self-hosted image, GitLab directs operators to use the self-hosted-vX.Y.*-ee tag family corresponding to their GitLab release and select a compatible patch version. Image tags and chart package versions change, so verify the current registry and chart repository values when deploying rather than copying an old version number.
The installation guidance also covers FIPS-validated images, trust for custom CA certificates, upgrades, and offline deployments. An offline installation has additional requirements, including mirroring the chart’s TLS proxy image to an internal registry and configuring authentication to use the local GitLab instance. Check the egress and registry dependencies for the specific release and installation method; an offline license by itself does not establish that every component is air-gapped.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keys, authentication, and network boundaries
The installation guide requires separate signing and validation key pairs for the AI Gateway and Duo Workflow service. Treat private signing keys as credentials: protect the generated files, restrict access, and use the deployment method’s documented secret-handling steps. GitLab’s self-hosted authentication guidance explains how the GitLab instance mints tokens and the gateway verifies them.
With GitLab’s hosted gateway, GitLab manages routing for GitLab Self-Managed and GitLab Dedicated customers; its documentation says customers cannot choose the deployment region. That limitation applies to the GitLab-hosted service, not to an organization’s own self-hosted gateway.
Timeouts are configurable
For chat model requests, GitLab documents a 30-second default timeout for the feature introduced in GitLab 19.2. The gateway timeout can be configured, and a model-specific timeout may take precedence. This is a request-handling setting, not a guarantee about model response speed; consult the current feature documentation for the relevant version and setting.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
