It runs everywhere. Here's an example of it running in a kubernetes cluster, regardless of where it's hosted: https://github.com/GoogleCloudPlatform/endpoints-samples/tre...

It's the "-k" parameter (key file) that lets you run it outside of Google Cloud. Credentials are automatically provided when you run it inside Google Cloud.

The proxy is packaged as a docker image, it can run anywhere docker is supported. For performance and convenience, the proxy and the server typically run next to each other, but that is not required.