How do container networks differ from published ports?
A private container network enables member communication, whereas a published port creates a host-to-container route.
Read Containers, honestlyPractical reference
Get unstuck without guessing.
Concise answers, bounded procedures, and working habits linked back to the books that explain the reasoning.
75references
FAQ
How should I choose an AI model?
Choose against a defined task and constraints, verify the exact model identifier in official documentation, and test it with a repeatable fixture.
Open reference (opens in a new tab)What contributes to AI cost?
AI cost can include tokens, retrieval, tools, retries, storage, platform capacity, and human review.
Read Governance, evidence and handover Read Rolling it outWhat does generated Kubernetes YAML represent?
Generated Kubernetes-style YAML describes a local Podman state for review and is not an approved cluster deployment.
Read Containers, honestlyWhat is a named volume?
A named volume is Podman-managed storage that exists separately from a container and can outlive it.
Read Containers, honestlyWhat is a temporal knowledge graph?
A temporal knowledge graph records relationships and when a claim applied, enabling time-bounded answers.
Read Many agents, and memoryWhat is agent interoperability?
Agent interoperability lets separate systems exchange defined tasks and results but does not establish trust or transfer authority.
Read Many agents, and memoryWhat is agent sandboxing?
Agent sandboxing limits what untrusted generated code can read, change, contact, and consume.
Read Agents with real credentials Read Put a lock on it: securing a self-hosted stackWhat is an agent handoff?
An agent handoff preserves verified evidence, remaining work, authority, and a completion check for the next worker.
Read Many agents, and memoryWhat is an AI eval?
An eval is a repeatable check of whether an AI feature meets explicit requirements across fixed cases.
Read Regression sets and evaluation ops Read Governance, evidence and handoverWhat is an AI trust boundary?
A trust boundary separates untrusted prompts, documents, tool replies, and model output from enforceable application policy.
Read Privacy and labelling in everyday work Read Put a lock on it: securing a self-hosted stackWhat is an inference provider?
An inference provider is the hosted, managed, or self-operated endpoint that receives a model request and returns output.
Read A local model your tools can callWhat is an LLM gateway?
An LLM gateway sits between applications and model providers to centralize routing, authentication, policy checks, and observability.
Read A local model your tools can callWhat is context engineering?
Context engineering selects and structures relevant, authorized, traceable information for one bounded task.
Read Context engineeringWhat is MCP?
Model Context Protocol lets a client discover and invoke server capabilities, while server-side validation and authorization remain necessary.
Read Agents with real credentials Read Connect an assistant to your tools Read Build your own connectorWhat is prompt engineering?
Prompt engineering makes a task, permitted evidence, output requirements, constraints, and checks explicit for review.
Read Prompting basicsWhat is quantization?
Quantization represents model values with fewer bits to reduce storage or memory traffic, without guaranteeing accuracy, speed, or compatibility.
Read Serving at scaleWhat is RAG?
Retrieval-augmented generation supplies selected document passages to a model before it answers, so the retrieved evidence still needs review.
Read Ask questions about your own filesWhat is runtime context?
Runtime context is the task-specific information selected for one model request rather than everything a system has stored.
Read Many agents, and memoryWhat is test-driven prompt engineering?
Test-driven prompt engineering compares a baseline and revision against the same representative inputs and fixed rubric.
Read Test-driven promptingWhat is the AI supply chain?
An AI supply chain includes the model, prompt, documents, connectors, packages, runtime, and other components that can change behavior.
Read Agents in CI, and what they pull in Read Operating connectorsWhat is the difference between a tag and a digest?
A tag is a readable label that can move, while a digest identifies the exact image content received.
Read Containers, honestlyWhat is the difference between an image and a container?
An image is a saved application package, while a container is a running or stopped working copy made from that image.
Read Containers, honestlyWhat makes a model deployment private?
A local or private model deployment still requires controls for gateways, identity, retrieval, logs, and operator access.
Read A self-hosted assistant Read A model on your own laptop Read A local model your tools can callWhy is memory a write problem?
Durable memory needs checks for purpose, evidence, access, review, correction, and deletion before a claim is retained.
Read Many agents, and memoryHow-to
Build a local image from a Containerfile
Build from a reviewed Containerfile and empty context, run the one-shot result, and remove the local test image.
Read Containers, honestlyCapture reviewable workload evidence
Pair a minimal redacted screenshot with timestamped command output for the same named local container.
Read Containers, honestlyCreate a model selection record
Record a documented model identifier, constraints, and two fixture runs for one narrow task.
Open reference (opens in a new tab)Define a small AI evaluation
Create fixed ordinary, absent-answer, and hostile-content cases with observable pass criteria and named revisions.
Read Regression sets and evaluation ops Read Governance, evidence and handoverDeploy a temporary local Kubernetes workload
Verify the local context, apply one reviewed Deployment manifest, confirm rollout, and delete it with the same file.
Read Your own AI serverGenerate Kubernetes YAML from a pod
Create a local-only pod, generate Kubernetes-style YAML for review, and remove the exact test pod.
Read Containers, honestlyIdentify the local Podman connection
Check Podman Desktop resources and podman version before managing any local workload.
Read Containers, honestlyInspect a Podman machine
Use Desktop and read-only machine commands to identify an existing local machine before creating another.
Read Containers, honestlyInspect a test container
Confirm the container identity before collecting logs, inspecting metadata, or opening a terminal.
Read Containers, honestlyInspect an image before cleanup
Pull a fully qualified image, inspect its digest, confirm no container uses it, and remove only that image.
Read Containers, honestlyInstall Podman Desktop safely
Use the official installer and supported onboarding flow, pausing for required device-owner approval.
Read Containers, honestlyMap a private model service boundary
List allowed connections, distinct service identities, authorization rules, and a denied-access test before using real documents.
Read A self-hosted assistant Read A model on your own laptop Read A local model your tools can callPrepare a local Kubernetes target
Create or identify an approved local Kind cluster, select its context, and verify it with read-only kubectl checks.
Read Your own AI serverRun a controlled local LLM test
Install AI Lab, review an approved model details, start a local service, test fictional text, and stop it afterward.
Read Your own AI serverRun a disposable local container
Pull a named NGINX image, bind it only to loopback, verify it locally, then stop and delete the test container.
Read Containers, honestlyRun the Compose guestbook demo
Review the Compose file, run the localhost-only guestbook stack, then remove its services and course volume.
Read Containers, honestlySpecify a read-only MCP tool
Define an allowlisted input schema, authenticated caller, authorization rule, minimal output, and explicit error outcomes.
Read Agents with real credentials Read Connect an assistant to your tools Read Build your own connectorTest a cited RAG answer
Use a small approved or synthetic collection, inspect retrieved passages, and retain an unsupported question as a regression test.
Read Ask questions about your own filesTest an inference route
Record the route, scoped identity, permitted data class, synthetic response, denied identity, and rollback reference.
Read A local model your tools can callTest an LLM gateway route
Separate client and provider credentials, enforce route limits, verify an allowed test request, and verify a denied route request.
Read A local model your tools can callTest persistent container data
Write a marker to a named volume and read it from a new container to verify the data outlives the first container.
Read Containers, honestlyTest private container networking
Create a temporary user-defined network and verify internal name resolution without publishing a host port.
Read Containers, honestlyTroubleshoot Podman without resetting
Record the first error, selected connection, engine state, container state, and Kubernetes context before attempting recovery.
Read Your own AI serverUse the InstructLab container flow
Use the version-specific flow only when it is present in the approved local installation, and test it with synthetic input.
Read Your own AI serverWrite an agent sandbox contract
Define a disposable workspace, disabled network, scoped identity, resource limits, termination events, and cleanup.
Read Agents with real credentials Read Put a lock on it: securing a self-hosted stackTips
Bind test services to loopback
Use 127.0.0.1 for local container demonstrations instead of exposing them on every network interface.
Read Containers, honestlyCapture narrow evidence
Make screenshots support a specific timestamped claim and remove information a reviewer does not need.
Read Containers, honestlyCount non-model work
Include retrieval, tools, retries, storage, and review when analyzing request cost.
Read Governance, evidence and handover Read Rolling it outDate cost assumptions
Preserve the rate source and date used in any cost estimate.
Read Governance, evidence and handover Read Rolling it outGive tools least privilege
Limit each connection to the permissions required for its bounded task.
Read Privacy and labelling in everyday work Read Put a lock on it: securing a self-hosted stackInspect before deleting storage
Confirm a named volume and its metadata before removing it.
Read Containers, honestlyKeep a route rollback reference
Retain the previous inference-route mapping before changing a provider route.
Read A local model your tools can callKeep evaluation cases fixed
Use the same representative cases across prompt revisions so regressions remain visible.
Read Test-driven promptingKeep external content separate
Label retrieved or external text as untrusted data and do not let it redefine the task.
Read Context engineeringKeep first build contexts empty
Use an empty course folder and no COPY instruction to avoid packaging local files or secrets.
Read Containers, honestlyKeep historical claims time-bounded
Return unknown when no authorized claim covers the requested date instead of extending the nearest record.
Read Many agents, and memoryKeep provider secrets behind the gateway
Clients should receive access only to approved routes, not broad provider credentials.
Read A local model your tools can callLabel memory evidence and uncertainty
Store a claim purpose, provenance, confidence, access boundary, and lifecycle rule before retaining it.
Read Many agents, and memoryMake output requirements observable
Specify a concrete format and limits so a reviewer or system can inspect the result.
Read Prompting basicsName one primary task
State one bounded transformation rather than leaving the model to choose the job.
Read Prompting basicsRecord image digests
Use an image digest to preserve the exact content received rather than relying only on a tag.
Read Containers, honestlyReview generated YAML before reuse
Treat Podman-generated Kubernetes YAML as a local-state artifact, not proof of production readiness.
Read Containers, honestlySeparate facts from assumptions in handoffs
Give the next worker verified state, open work, authority limits, and an observable completion check.
Read Many agents, and memorySet eval criteria before testing
Write observable pass conditions before reviewing a model response.
Read Regression sets and evaluation ops Read Governance, evidence and handoverTest a denied path
Verify that an unauthorized identity is denied before using real material or broadening access.
Read A self-hosted assistant Read A model on your own laptop Read A local model your tools can callTreat content as data, not authority
A document instruction does not gain permission to change policy, access data, or invoke a tool.
Read Privacy and labelling in everyday work Read Put a lock on it: securing a self-hosted stackUse exact model identifiers
Record an official model identifier instead of relying on a remembered family name or alias.
Open reference (opens in a new tab)Use the right diagnostic view
Use logs for main-process output, inspect for configuration and state, and a terminal for a deliberate in-container command.
Read Containers, honestlyUse the smallest permitted context
Include only relevant, authorized, current material needed to answer the bounded question.
Read Context engineeringVerify the Kubernetes context first
Check the active context and node readiness before applying any manifest.
Read Your own AI server