69 terms, defined.

Core concepts

General vocabulary for running AI on your own hardware.

• age encryption

  age is a simple modern file-encryption tool, commonly used to encrypt backups on the device so the storage provider only ever holds ciphertext.

• Air-gapped

  An air-gapped system has no network connection at all, so software must arrive pre-installed and must never expect to reach the internet.

• Appliance image

  An appliance image is a complete, pre-built operating system image that boots straight into a working application with no installation steps.

• Build attestation

  A build attestation is signed metadata describing how an artifact was produced — which source, which builder, which inputs — so consumers can verify its provenance.

• CVE

  A CVE is a public identifier for a specific known security vulnerability, letting everyone refer to the same flaw unambiguously.

• Default deny

  Default deny is a security posture where everything is blocked unless explicitly permitted, so a forgotten service is closed rather than exposed.

• Fleet management

  Fleet management is administering several machines from one place — seeing their status, pushing updates, and running commands across all of them.

• GGUF

  GGUF is the single-file model format used by llama.cpp, packaging weights, tokenizer and metadata together so a model can be loaded with no external dependencies.

• GPU passthrough

  GPU passthrough gives a virtual machine direct hardware access to a physical GPU, so it can run accelerated workloads at close to bare-metal speed.

• Immutable OS

  An immutable OS mounts its system partition read-only, so the running system cannot be modified in place and updates are applied as whole images.

• KVM

  KVM is the Linux kernel's built-in hypervisor, giving virtual machines near-native CPU speed by using hardware virtualization extensions.

• Local LLM

  A local LLM is a language model whose weights run on your own hardware, so prompts never leave the machine.

• Managed backup

  Managed backup is scheduled, encrypted, off-device backup with a tested restore path, as opposed to copying files somewhere and hoping.

• mDNS

  mDNS lets devices on the same network find each other by name without a DNS server, which is how a freshly booted appliance can be reached at a .local address.

• nftables

  nftables is the Linux kernel's packet filtering framework, the successor to iptables, used to express firewall rules including default-deny egress policies.

• Object storage

  Object storage keeps data as flat keyed objects accessed over HTTP rather than as a filesystem, and is the usual destination for backups and large artifacts.

• Quantization

  Quantization shrinks a model by storing its weights at lower numerical precision, trading a small amount of quality for a large reduction in memory.

• Reproducible build

  A reproducible build produces byte-identical output from the same source every time, so anyone can verify a published artifact was built from the code it claims.

• Reverse tunnel

  A reverse tunnel lets you reach a device behind a home router by having the device open the connection outward, so no ports need forwarding.

• SBOM

  An SBOM is a machine-readable inventory of every component in a piece of software, used to tell quickly whether a newly disclosed vulnerability affects you.

• Self-hosted AI assistant

  A self-hosted AI assistant is a personal AI agent you run on hardware you control, rather than using a vendor's cloud service.

• WireGuard

  WireGuard is a fast, modern VPN protocol that creates an encrypted private network between devices, commonly used to reach a home server without exposing it publicly.