# Bob's concerns and this measured deployment

The existing video project retains captions for [Unbiased Bob's referenced video](https://www.youtube.com/watch?v=i18vpg0T-mk) at `videos/strata-security-take/source/source-bob-transcript.en.vtt`. Its `COMPLETION.md` identifies that transcript as the source used for the prior commentary. This experiment read the retained captions; it has not watched a newly downloaded video. Caption errors are possible, so ambiguous lines are not used as evidence.

| Concern in retained captions | Relevant pinned-source finding | Experiment outcome so far |
|---|---|---|
| Broad inference-server permissions and internet access, approximately 1:43–1:49. | Official deployment supports normal container networking and persistent writable model storage. | Inference actually served a response with `--network none`, loopback only, UID 65534, read-only root/models/config, zero capabilities and `no-new-privileges`. GPU access still shares the host kernel and driver. |
| Downloaded executable binaries, approximately 1:54–2:03. | Setup can select release prebuilt engines; verification has a warning-and-continue path when a release digest cannot be obtained. | Engine compiled locally from the exact v0.1.43 source and pinned llama.cpp source; no upstream prebuilt engine used. Startup checks its SHA256. |
| Agent-directed installation from downloaded scripts/Markdown, approximately 2:04–2:24. | Setup documentation is executable operational guidance, and setup can install dependencies. | Reviewed build/preparation scripts run before serving. No agent-driven installation, compiler or executable downloader runs inside the production startup path. This does not remove the need to trust reviewed build tools and dependencies. |
| Automatic setup downloads, approximately 2:42–2:51. | Official Docker entry point invokes setup; model/prebuilt/dependency paths can access the network. | Separate offline preparation succeeded with already verified model/MTP files and the precompiled engine. Serving invokes `serve.server` directly rather than setup. |
| Container isolation as a practical mitigation, approximately 3:02–3:07. | Containers provide a boundary, not a proof of safety. | Dedicated unprivileged LXC plus restricted Docker runtime tested. No Docker socket, host root, SSH keys or Proxmox management mounts. |

Bob describes an offline-focused fork around 11:17–12:43 and says its stress testing is limited. The fork is a reference, not the engine tested here. This experiment retains upstream Python to preserve v0.1.43 behavior; it does not claim equivalent architecture or endorsement.

The first runtime SBOM scan reported 550 package matches, including 14 high-severity matches covering three vulnerability identifiers. Available package upgrades produced a separate `sm120-v2` runtime with the identical compiled engine. Re-scanning against the same Grype database reported 281 matches (253 medium, 26 low, two negligible), with zero high/critical matches. Counts are package matches, not independently demonstrated exploits or a certification. The original image, scan and updated image remain available.

Ubuntu's [GnuPG advisory](https://ubuntu.com/security/CVE-2025-68973) and [OpenSSL September notice](https://lists.ubuntu.com/archives/ubuntu-security-announce/2026-September/011307.html) provide primary vendor context for affected package families. Final package inventories and raw Grype matches are the experiment evidence for installed versions. No claim is made that every scanner finding has been independently confirmed.

Remaining trust includes CUDA and host-driver binaries, the host kernel, native Strata/model parsers, Python packages, signed OS repositories, PyPI wheels, downloaded source archives and model artifacts. Build-time downloads were allowed and recorded; this was not a fully air-gapped build. The tested inference namespace had no external networking.