Docker Compose
One container with SQLite on a volume. The simplest route for a single machine.
- Version
- 1.3.0 (Demo)
- Released
- 15 Nov 2026
- Size
- 3.1 KB
- File
- penweir-demo-1.3.0.zip
Download
Download the Penweir demo.
Penweir runs on your own machine or cluster and is up in about ten minutes. No sign-up, no form, no calls home.
Install
Choose how to install.
All three run the same gateway. Each has its own step-by-step guide.
The demo is free. No account or early access needed, and no time limit. It runs in Demo mode with limits (1 provider, 2 applications, 1 pipeline, 50 requests per UTC day). Demo limits and paid licences →
Docker image
Already have your own setup? The image comes as a file per CPU architecture. Load it with docker load, then run it without Compose.
- Version
- 1.3.0 (Demo)
- Released
- 15 Nov 2026
- Size
- 48 MB
- Image
- penweir-app:v1.3.0
Pick the file that matches uname -m: x86_64 is amd64, arm64 or aarch64 is arm64. Loading the wrong one fails with exec format error.
The image in the registry is not public yet. Until it is, the image files are the way to install.
Helm and Kubernetes
A hardened chart for a cluster: non-root, read-only filesystem, restricted Pod Security.
- Version
- 1.3.0 (Demo)
- Released
- 15 Nov 2026
- Size
- 5.0 KB
- File
- penweir-1.3.0.tgz
What's in it
What the demo contains.
The gateway
An OpenAI-compatible endpoint with streaming and tool calls. Requests go to OpenAI-compatible or Anthropic providers, with fallback.
Redaction
Structured identifiers such as IBANs and email addresses are redacted or blocked on the way out, and put back in the response.
The dashboard
Admins, applications, keys, pipelines, the audit log and system status.
No phoning home
No telemetry and no licence server. Penweir only contacts the providers and connectors you set up, and the alerts webhook if you turn it on.
Penweir is in early access. Read what it does and doesn't guarantee before you send real data through it. What Penweir guarantees ·Threat model
Verify
Check your download.
Every file comes with a checksum and an SBOM, so you can verify it before you run it. The image files are checked with their SHA-256 file. Image signatures (cosign) apply to the registry image, once it is published.
- Demo zip (SHA-256)
- 3bd8b16346fddf2dd9617b1c96df8ced6e530728314175d536d214d57273f396
- Helm chart (SHA-256)
- 7090fc6f75a8b851e472cd32f69644169e11a695f15a2b2a6c295e1ba6ec7e25
- Image file amd64 (SHA-256)
- b5a743ee799572030263dba1ac8ec0fd61c207806d554c6a3aa26101197b4668
- Image file arm64 (SHA-256)
- fcea8b61cec7d1e8a82321b9dc28631bb5eb4461f641101d5b69a77395783cfa
- SBOM
- cyclonedx.json
Every file has a .sha256 file next to it. Put both in one folder and check with shasum -a 256 -c.
- penweir-demo-1.3.0.zip.sha256
- .sha256
- penweir-1.3.0.tgz.sha256
- .sha256
- penweir-app-1.3.0-amd64.tar.gz.sha256
- .sha256
- penweir-app-1.3.0-arm64.tar.gz.sha256
- .sha256
- penweir-sbom-1.3.0.cdx.json.sha256
- .sha256
shasum -a 256 -c penweir-demo-1.3.0.zip.sha256
shasum -a 256 -c penweir-1.3.0.tgz.sha256
shasum -a 256 -c penweir-app-1.3.0-amd64.tar.gz.sha256
shasum -a 256 -c penweir-app-1.3.0-arm64.tar.gz.sha256
shasum -a 256 -c penweir-sbom-1.3.0.cdx.json.sha256Requirements
Before you start.
- Architectures
- linux/amd64 and linux/arm64
- Docker
- Docker with Compose v2, or another container runtime
- Ports
- 8080 (gateway) and 8081 (dashboard), published on 127.0.0.1 only
- Storage
- One volume. SQLite by default, Postgres optional
- Kubernetes
- 1.27 or later with Helm 3 (Helm route only)
- Outbound
- Only to the model providers and connectors you configure, and the alerts webhook if you turn it on
Questions
Common questions.
Do I need an account, or to contact you?
No. Download it and start. If you get stuck you're welcome to email us, but you don't have to.
Is this the paid product?
It is the same gateway and dashboard, running in Demo mode: 1 provider, 2 applications, 1 pipeline, 50 requests per UTC day, 3 detector steps per pipeline and 7 days of audit log, with no time limit. A paid licence key lifts the limits; deploying works the same way. See the pricing page.
Can I use real data?
Start with sample data. Read the guarantees and the threat model first, and keep the ports on 127.0.0.1 until TLS is in front.
How do I upgrade or remove it?
Download the new release, load the new image file with docker load, then run docker compose up -d. Migrations run at startup, so back up the volume first. docker compose down -v removes everything, data included.
Flow, on your terms
Hold the line.
A one-time licence, deployed inside your own network. Your data never needs to leave to be useful.