本地部署的隔离面Isolation Surfaces of a Local Deployment
Isolation Surfaces of a Local Deployment
说清模型跑在自己机器上时，到底哪些面被切断了、哪些面一点没变。States plainly what running a model on your own machine cuts off, and what it leaves untouched.
本地部署改变的是数据的默认去向：请求不再出网。它没有自动改变的是本机进程能碰到什么：文件、网络、凭据仍然在同一台机器上。
可分的边界至少四层：文件系统、网络出站、进程与命令权限、凭据可见性。越往里越容易收紧，越往外越依赖宿主配置。
Anthropic 介绍 Claude Code 沙箱时给出的做法是按操作系统原语隔离（Linux 用 bubblewrap、macOS 用 seatbelt）来限制文件与网络访问，并明确这套机制不防「本机已经被攻陷」这种前提。
服务监听面是隔离面的一部分：Ollama 官方文档写明默认绑定 127.0.0.1:11434，改 OLLAMA_HOST 把它开放到网络，就等于给同一台机器上的其他设备开了口子。
提示注入会把「隔离」变成「执行面」：模型被诱导调用工具时，能造成什么后果取决于工具当时的权限，而不是取决于模型在不在本地跑。
A local deployment changes where data goes by default: requests stop leaving the network. It does not change what the process can reach: files, outbound connections and credentials are still on that same machine.
At least four boundaries can be drawn - filesystem, outbound network, process and command privileges, and credential visibility. The inner ones tighten with configuration; the outer ones depend on the host.
Anthropic describes Claude Code's sandbox as using operating-system primitives (bubblewrap on Linux, seatbelt on macOS) to restrict filesystem and network access, and states explicitly that it does not defend against an already-compromised local machine.
The listening surface is part of the isolation surface: Ollama's documentation says the server binds 127.0.0.1:11434 by default, and changing the bind address with OLLAMA_HOST opens it to the network.
Prompt injection turns "isolated" into "executable": when a model is steered into calling a tool, the damage depends on the permissions that tool held at that moment, not on whether the model runs locally.
「都本地部署了，隐私自然没问题」是常见误读。本地只是换掉了数据默认流向哪儿，剩下的边界要靠你显式配置：绑定地址、文件范围、出站规则、工具权限。画不清这几层，事故会发生在你以为已经隔离的那一层。"It's local, so privacy is solved" is a common misreading. Local only redirects the default destination of your data. Every remaining boundary is something you configure on purpose - bind address, file scope, egress rules, tool permissions - and incidents land in the layer people assumed was already sealed.
本地不等于隔离
回到名词地图看第5站的其他 33 个词 →Back to the map: the other 33 terms in station 5 →