ODS
ODS 安全与运维：治理私有 AI 服务栈
覆盖安装器来源、密钥、Dashboard、扩展、代理、数据留存、云模式和事件恢复。
你将学会
- Threat-model ODS supply chain and runtime
- Apply privacy and least-privilege operations
- Build an incident and rollback runbook
开始前需要
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
先看结论
- Pin and audit installers, compose images, model catalogs, and extension manifests.
- Protect dashboard, secrets, prompts, documents, and telemetry with least privilege and explicit retention.
- Operate with canaries, redacted evidence, credential revocation, quarantine, and rollback.
Treat the installer and compose graph as code
将安装器、镜像、模型目录、compose 和扩展 manifest 视为供应链输入；Dashboard、密钥、提示词、文档、工具和遥测分别限权、脱敏并设定留存。用 canary、凭据撤销、隔离和已知良好版本回滚应对事件。
The runtime discovers services and merges compose fragments automatically. Review each extension's image, port, health endpoint, GPU access, volumes, and outbound domains before enabling it; a convenient manifest is not a security approval.
Protect secrets, prompts, and local documents
Keep generated credentials, provider keys, dashboard sessions, and `.env` files outside source control. Restrict the dashboard to a trusted LAN/VPN, rotate secrets after a suspected exposure, and separate local mode from cloud or hybrid mode in policy and logs. Cloud fallback changes where prompts and files travel and which provider quotas apply.
RAG documents, search results, model outputs, and uploaded media are untrusted content. Isolate parsers, limit file size and redirects, scan for sensitive data, set retention, and prevent retrieved instructions from granting agent or workflow permissions.
Constrain agents, extensions, and observability
Hermes, n8n, OpenCode, ComfyUI, and other services can call tools or reach networks. Apply least-privilege users, explicit egress allow-lists, bounded steps and spend, approval for writes, and separate service accounts. Keep deprecated or optional agent paths disabled unless their migration and threat model are understood.
Token Spy, Langfuse, logs, and the dashboard improve diagnosis but can also collect prompts and identifiers. Redact by default, restrict viewers, define retention and deletion, and document whether telemetry stays local or leaves the host.
Detect, respond, and recover
Monitor image and model provenance, container health, exposed ports, disk growth, GPU behavior, authentication failures, tool calls, and cloud spend. Canary release upgrades and model swaps with a fixed smoke suite; keep a known-good preset, model, installer, and backup.
During an incident, stop external traffic, disable the affected extension, preserve redacted logs and hashes, revoke credentials, quarantine suspect artifacts, restore the known-good pair, and replay release-validation checks. Verify uninstall removes labelled Docker resources and runtime data according to the documented retention decision.
如何选择
| 比较维度 | 方案 A | 方案 B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
实施步骤
- 1
Create a supply-chain and asset inventory for the pinned release.
- 2
Restrict network, secrets, files, extensions, agents, and telemetry.
- 3
Run adversarial smoke tests for uploads, tools, ports, and cloud mode.
- 4
Rehearse incident stop, revoke, restore, uninstall, and evidence review.
可复制示例
pinned installer/images/models -> least-privilege services
trusted dashboard/VPN -> policy-gated tools
redacted telemetry -> canary -> quarantine/rollback常见问题
Is local mode automatically safe?
No. It reduces provider exposure but still requires installer, extension, network, file, secret, and agent controls.
Should telemetry include full prompts?
Not by default. Use redacted identifiers and metrics, define retention, and collect content only with an explicit policy.
资料来源
- ODS README (captured 2026-08-31)来源核查 2026-08-31
- ODS repository来源核查 2026-08-31