How do container networks differ from published ports?
A private container network enables member communication, whereas a published port creates a host-to-container route.
Read article Read Local AI Apps Your Colleagues Can Rely OnHelp
FAQs, how-to guides and tips.
76references
FAQ
How should I choose an AI model?
Choose against a defined task and constraints, verify the exact model identifier in official documentation, and test it with a repeatable fixture.
Read article Open reference (opens in a new tab)What contributes to AI cost?
AI cost can include tokens, retrieval, tools, retries, storage, platform capacity, and human review.
Read article Read Keep One List of Every AI System Your Team Runs, and Make It Survive You Read Roll Out an AI Assistant to a Whole Department, With Access, Cost and Consent Settled FirstWhat does generated Kubernetes YAML represent?
Generated Kubernetes-style YAML describes a local Podman state for review and is not an approved cluster deployment.
Read article Read Local AI Apps Your Colleagues Can Rely OnWhat is a named volume?
A named volume is Podman-managed storage that exists separately from a container and can outlive it.
Read article Read Local AI Apps Your Colleagues Can Rely OnWhat is a temporal knowledge graph?
A temporal knowledge graph records relationships and when a claim applied, enabling time-bounded answers.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesWhat is agent interoperability?
Agent interoperability lets separate systems exchange defined tasks and results but does not establish trust or transfer authority.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesWhat is agent sandboxing?
Agent sandboxing limits what untrusted generated code can read, change, contact, and consume.
Read article Read Connect an Agent to a Real Mailbox Without Handing It the Keys Read Lock Down a Self-Hosted AI Service Before Real Data Goes InWhat is an agent handoff?
An agent handoff preserves verified evidence, remaining work, authority, and a completion check for the next worker.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesWhat is an AI eval?
An eval is a repeatable check of whether an AI feature meets explicit requirements across fixed cases.
Read article Read Keep a Production Prompt Healthy for Months, and Hand It Over Read Keep One List of Every AI System Your Team Runs, and Make It Survive YouWhat is an AI trust boundary?
A trust boundary separates untrusted prompts, documents, tool replies, and model output from enforceable application policy.
Read article Read Clean the Copy, Label the Result, Spot the Trap Read Lock Down a Self-Hosted AI Service Before Real Data Goes InWhat is an inference provider?
An inference provider is the hosted, managed, or self-operated endpoint that receives a model request and returns output.
Read article Read A Local Model Your Tools Can CallWhat is an LLM gateway?
An LLM gateway sits between applications and model providers to centralize routing, authentication, policy checks, and observability.
Read article Read A Local Model Your Tools Can CallWhat is context engineering?
Context engineering selects and structures relevant, authorized, traceable information for one bounded task.
Read article Read Build a Context Packet Your Team Can RerunWhat is MCP?
Model Context Protocol lets a client discover and invoke server capabilities, while server-side validation and authorization remain necessary.
Read article Read Connect an Agent to a Real Mailbox Without Handing It the Keys Read Turn a Connector Brief Into a Routine Colleagues Can Rerun Read Build a Read-Only Connector for a System Your Assistant Can't Reach YetWhat is prompt engineering?
Prompt engineering makes a task, permitted evidence, output requirements, constraints, and checks explicit for review.
Read article Read Write a Prompt You Can ReuseWhat is quantization?
Quantization represents model values with fewer bits to reduce storage or memory traffic, without guaranteeing accuracy, speed, or compatibility.
Read article Read Keep a Shared Model Server Fast, Affordable and RunningWhat is RAG?
Retrieval-augmented generation supplies selected document passages to a model before it answers, so the retrieved evidence still needs review.
Read article Read Ask Your Own Documents and Check Every CitationWhat is runtime context?
Runtime context is the task-specific information selected for one model request rather than everything a system has stored.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesWhat is test-driven prompt engineering?
Test-driven prompt engineering compares a baseline and revision against the same representative inputs and fixed rubric.
Read article Read Put a Test Set Under the Prompt Your Team Depends OnWhat is the AI supply chain?
An AI supply chain includes the model, prompt, documents, connectors, packages, runtime, and other components that can change behavior.
Read article Read Run Automatic Checks, an AI Reviewer and Releases You Can Roll Back Read Run Your Organisation's Connectors: One List, Per-Person Access, a Log and a Clean ExitWhat is the difference between a tag and a digest?
A tag is a readable label that can move, while a digest identifies the exact image content received.
Read article Read Local AI Apps Your Colleagues Can Rely OnWhat is the difference between an image and a container?
An image is a saved application package, while a container is a running or stopped working copy made from that image.
Read article Read Local AI Apps Your Colleagues Can Rely OnWhat makes a model deployment private?
A local or private model deployment still requires controls for gateways, identity, retrieval, logs, and operator access.
Read article Read A Self-Hosted Assistant Your Team Can Use Safely Read Run an AI Model on Your Own Laptop, Offline Read A Local Model Your Tools Can CallWhy is memory a write problem?
Durable memory needs checks for purpose, evidence, access, review, correction, and deletion before a claim is retained.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesHow-to guides
Build a local image from a Containerfile
Build from a reviewed Containerfile and empty context, run the one-shot result, and remove the local test image.
Read article Read Local AI Apps Your Colleagues Can Rely OnCapture reviewable workload evidence
Pair a minimal redacted screenshot with timestamped command output for the same named local container.
Read article Read Local AI Apps Your Colleagues Can Rely OnCreate a model selection record
Record a documented model identifier, constraints, and two fixture runs for one narrow task.
Read article Open reference (opens in a new tab)Define a small AI evaluation
Create fixed ordinary, absent-answer, and hostile-content cases with observable pass criteria and named revisions.
Read article Read Keep a Production Prompt Healthy for Months, and Hand It Over Read Keep One List of Every AI System Your Team Runs, and Make It Survive YouDeploy a temporary local Kubernetes workload
Verify the local context, apply one reviewed Deployment manifest, confirm rollout, and delete it with the same file.
Read article Read Put Your Team's Assistant on a Server Colleagues Can ReachGenerate Kubernetes YAML from a pod
Create a local-only pod, generate Kubernetes-style YAML for review, and remove the exact test pod.
Read article Read Local AI Apps Your Colleagues Can Rely OnIdentify the local Podman connection
Check Podman Desktop resources and podman version before managing any local workload.
Read article Read Local AI Apps Your Colleagues Can Rely OnInspect a Podman machine
Use Desktop and read-only machine commands to identify an existing local machine before creating another.
Read article Read Local AI Apps Your Colleagues Can Rely OnInspect a test container
Confirm the container identity before collecting logs, inspecting metadata, or opening a terminal.
Read article Read Local AI Apps Your Colleagues Can Rely OnInspect an image before cleanup
Pull a fully qualified image, inspect its digest, confirm no container uses it, and remove only that image.
Read article Read Local AI Apps Your Colleagues Can Rely OnInstall Podman Desktop safely
Use the official installer and supported onboarding flow, pausing for required device-owner approval.
Read article Read Local AI Apps Your Colleagues Can Rely OnMap a private model service boundary
List allowed connections, distinct service identities, authorization rules, and a denied-access test before using real documents.
Read article Read A Self-Hosted Assistant Your Team Can Use Safely Read Run an AI Model on Your Own Laptop, Offline Read A Local Model Your Tools Can CallOpenCode Setup: From Your Laptop to Your First App
Seminar-day checklist: what to bring, the internet check, the recovery card and instructor rehearsal. Setting up OpenCode itself is taught in the L1 book Start With OpenCode.
Read article Read Start With OpenCode: Set It Up, Change One Line, and Undo It Read From Idea to Working Result: The Four-Quadrant MethodPrepare a local Kubernetes target
Create or identify an approved local Kind cluster, select its context, and verify it with read-only kubectl checks.
Read article Read Put Your Team's Assistant on a Server Colleagues Can ReachRun a controlled local LLM test
Install AI Lab, review an approved model details, start a local service, test fictional text, and stop it afterward.
Read article Read Put Your Team's Assistant on a Server Colleagues Can ReachRun a disposable local container
Pull a named NGINX image, bind it only to loopback, verify it locally, then stop and delete the test container.
Read article Read Local AI Apps Your Colleagues Can Rely OnRun the Compose guestbook demo
Review the Compose file, run the localhost-only guestbook stack, then remove its services and course volume.
Read article Read Local AI Apps Your Colleagues Can Rely OnSpecify a read-only MCP tool
Define an allowlisted input schema, authenticated caller, authorization rule, minimal output, and explicit error outcomes.
Read article Read Connect an Agent to a Real Mailbox Without Handing It the Keys Read Turn a Connector Brief Into a Routine Colleagues Can Rerun Read Build a Read-Only Connector for a System Your Assistant Can't Reach YetTest a cited RAG answer
Use a small approved or synthetic collection, inspect retrieved passages, and retain an unsupported question as a regression test.
Read article Read Ask Your Own Documents and Check Every CitationTest an inference route
Record the route, scoped identity, permitted data class, synthetic response, denied identity, and rollback reference.
Read article Read A Local Model Your Tools Can CallTest an LLM gateway route
Separate client and provider credentials, enforce route limits, verify an allowed test request, and verify a denied route request.
Read article Read A Local Model Your Tools Can CallTest persistent container data
Write a marker to a named volume and read it from a new container to verify the data outlives the first container.
Read article Read Local AI Apps Your Colleagues Can Rely OnTest private container networking
Create a temporary user-defined network and verify internal name resolution without publishing a host port.
Read article Read Local AI Apps Your Colleagues Can Rely OnTroubleshoot Podman without resetting
Record the first error, selected connection, engine state, container state, and Kubernetes context before attempting recovery.
Read article Read Put Your Team's Assistant on a Server Colleagues Can ReachUse the InstructLab container flow
Use the version-specific flow only when it is present in the approved local installation, and test it with synthetic input.
Read article Read Put Your Team's Assistant on a Server Colleagues Can ReachWrite an agent sandbox contract
Define a disposable workspace, disabled network, scoped identity, resource limits, termination events, and cleanup.
Read article Read Connect an Agent to a Real Mailbox Without Handing It the Keys Read Lock Down a Self-Hosted AI Service Before Real Data Goes InTips
Bind test services to loopback
Use 127.0.0.1 for local container demonstrations instead of exposing them on every network interface.
Read article Read Local AI Apps Your Colleagues Can Rely OnCapture narrow evidence
Make screenshots support a specific timestamped claim and remove information a reviewer does not need.
Read article Read Local AI Apps Your Colleagues Can Rely OnCount non-model work
Include retrieval, tools, retries, storage, and review when analyzing request cost.
Read article Read Keep One List of Every AI System Your Team Runs, and Make It Survive You Read Roll Out an AI Assistant to a Whole Department, With Access, Cost and Consent Settled FirstDate cost assumptions
Preserve the rate source and date used in any cost estimate.
Read article Read Keep One List of Every AI System Your Team Runs, and Make It Survive You Read Roll Out an AI Assistant to a Whole Department, With Access, Cost and Consent Settled FirstGive tools least privilege
Limit each connection to the permissions required for its bounded task.
Read article Read Clean the Copy, Label the Result, Spot the Trap Read Lock Down a Self-Hosted AI Service Before Real Data Goes InInspect before deleting storage
Confirm a named volume and its metadata before removing it.
Read article Read Local AI Apps Your Colleagues Can Rely OnKeep a route rollback reference
Before you switch the AI model or provider an app uses, write down the current setting so you can switch back.
Read article Read A Local Model Your Tools Can CallKeep evaluation cases fixed
Use the same representative cases across prompt revisions so regressions remain visible.
Read article Read Put a Test Set Under the Prompt Your Team Depends OnKeep external content separate
Label retrieved or external text as untrusted data and do not let it redefine the task.
Read article Read Build a Context Packet Your Team Can RerunKeep first build contexts empty
Use an empty course folder and no COPY instruction to avoid packaging local files or secrets.
Read article Read Local AI Apps Your Colleagues Can Rely OnKeep historical claims time-bounded
Return unknown when no authorized claim covers the requested date instead of extending the nearest record.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesKeep provider secrets behind the gateway
Clients should receive access only to approved routes, not broad provider credentials.
Read article Read A Local Model Your Tools Can CallLabel memory evidence and uncertainty
Before an AI assistant keeps a fact, record why, where it came from, how sure you are, who may use it, and when it goes.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesMake output requirements observable
Specify a concrete format and limits so a reviewer or system can inspect the result.
Read article Read Write a Prompt You Can ReuseName one primary task
State one bounded transformation rather than leaving the model to choose the job.
Read article Read Write a Prompt You Can ReuseRecord image digests
Use an image digest to preserve the exact content received rather than relying only on a tag.
Read article Read Local AI Apps Your Colleagues Can Rely OnReview generated YAML before reuse
Treat Podman-generated Kubernetes YAML as a local-state artifact, not proof of production readiness.
Read article Read Local AI Apps Your Colleagues Can Rely OnSeparate facts from assumptions in handoffs
Give the next worker verified state, open work, authority limits, and an observable completion check.
Read article Read Keep a Team of Agents Running for Months, With Memory a Person ApprovesSet eval criteria before testing
Write observable pass conditions before reviewing a model response.
Read article Read Keep a Production Prompt Healthy for Months, and Hand It Over Read Keep One List of Every AI System Your Team Runs, and Make It Survive YouTest a denied path
Verify that an unauthorized identity is denied before using real material or broadening access.
Read article Read A Self-Hosted Assistant Your Team Can Use Safely Read Run an AI Model on Your Own Laptop, Offline Read A Local Model Your Tools Can CallTreat content as data, not authority
A document instruction does not gain permission to change policy, access data, or invoke a tool.
Read article Read Clean the Copy, Label the Result, Spot the Trap Read Lock Down a Self-Hosted AI Service Before Real Data Goes InUse exact model identifiers
Record an official model identifier instead of relying on a remembered family name or alias.
Read article Open reference (opens in a new tab)Use the right diagnostic view
Use logs for main-process output, inspect for configuration and state, and a terminal for a deliberate in-container command.
Read article Read Local AI Apps Your Colleagues Can Rely OnUse the smallest permitted context
Include only relevant, authorized, current material needed to answer the bounded question.
Read article Read Build a Context Packet Your Team Can RerunVerify the Kubernetes context first
Check the active context and node readiness before applying any manifest.
Read article Read Put Your Team's Assistant on a Server Colleagues Can Reach