ODS
ODS: seguridad y operaciones de una pila privada
Gobierna procedencia, secretos, dashboard, extensiones, agentes, retención, cloud y respuesta a incidentes.
Qué aprenderás
- Threat-model ODS supply chain and runtime
- Apply privacy and least-privilege operations
- Build an incident and rollback runbook
Antes de empezar
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Conclusiones clave
- Pin and audit installers, compose images, model catalogs, and extension manifests.
- Protect dashboard, secrets, prompts, documents, and telemetry with least privilege and explicit retention.
- Operate with canaries, redacted evidence, credential revocation, quarantine, and rollback.
Treat the installer and compose graph as code
Trata instalador, imágenes, modelos, Compose y manifests como entradas de supply chain. Limita dashboard, secretos, prompts, documentos, tools y telemetría; usa canary, revocación, cuarentena y rollback a una release conocida.
The runtime discovers services and merges compose fragments automatically. Review each extension's image, port, health endpoint, GPU access, volumes, and outbound domains before enabling it; a convenient manifest is not a security approval.
Protect secrets, prompts, and local documents
Keep generated credentials, provider keys, dashboard sessions, and `.env` files outside source control. Restrict the dashboard to a trusted LAN/VPN, rotate secrets after a suspected exposure, and separate local mode from cloud or hybrid mode in policy and logs. Cloud fallback changes where prompts and files travel and which provider quotas apply.
RAG documents, search results, model outputs, and uploaded media are untrusted content. Isolate parsers, limit file size and redirects, scan for sensitive data, set retention, and prevent retrieved instructions from granting agent or workflow permissions.
Constrain agents, extensions, and observability
Hermes, n8n, OpenCode, ComfyUI, and other services can call tools or reach networks. Apply least-privilege users, explicit egress allow-lists, bounded steps and spend, approval for writes, and separate service accounts. Keep deprecated or optional agent paths disabled unless their migration and threat model are understood.
Token Spy, Langfuse, logs, and the dashboard improve diagnosis but can also collect prompts and identifiers. Redact by default, restrict viewers, define retention and deletion, and document whether telemetry stays local or leaves the host.
Detect, respond, and recover
Monitor image and model provenance, container health, exposed ports, disk growth, GPU behavior, authentication failures, tool calls, and cloud spend. Canary release upgrades and model swaps with a fixed smoke suite; keep a known-good preset, model, installer, and backup.
During an incident, stop external traffic, disable the affected extension, preserve redacted logs and hashes, revoke credentials, quarantine suspect artifacts, restore the known-good pair, and replay release-validation checks. Verify uninstall removes labelled Docker resources and runtime data according to the documented retention decision.
Cómo elegir
| Criterio | Opción A | Opción B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Pasos de implementación
- 1
Create a supply-chain and asset inventory for the pinned release.
- 2
Restrict network, secrets, files, extensions, agents, and telemetry.
- 3
Run adversarial smoke tests for uploads, tools, ports, and cloud mode.
- 4
Rehearse incident stop, revoke, restore, uninstall, and evidence review.
Ejemplo para copiar
pinned installer/images/models -> least-privilege services
trusted dashboard/VPN -> policy-gated tools
redacted telemetry -> canary -> quarantine/rollbackPreguntas frecuentes
Is local mode automatically safe?
No. It reduces provider exposure but still requires installer, extension, network, file, secret, and agent controls.
Should telemetry include full prompts?
Not by default. Use redacted identifiers and metrics, define retention, and collect content only with an explicit policy.
Fuentes
- ODS README (captured 2026-08-31)Fuente verificada 2026-08-31
- ODS repositoryFuente verificada 2026-08-31