Self-hosted container
Data boundary
Exactly what reaches CarbonForge, and what never leaves your infrastructure.
The container is built for workloads that cannot leave your infrastructure. This page states the boundary precisely, so your security review does not have to reverse-engineer it.
What transits CarbonForge
| When | What | Where it goes |
|---|---|---|
| Sign-in, token mint | Your account identity; which container you requested | CarbonForge console and registry token service |
docker pull | The container image, downloaded to your host | From CarbonForge's registry (Google Artifact Registry) |
| Licence issue | The signed licence key, issued once | From the console to you |
That is the complete list, and all of it happens before the container serves its first request.
What never leaves your infrastructure
| Data | Where it stays |
|---|---|
| Prompts and outputs | Your host: in GPU memory and the response to your client |
| Model weights | Downloaded from Hugging Face (not CarbonForge) into your cache volume |
| Engine and runtime logs | Your log volume (/var/log/carbonforge) |
| Request traces | Off by default; when enabled, only the sinks you configure |
| Metrics | Off by default; when enabled, a port on your host |
No runtime phone-home
The running container makes no calls to CarbonForge:
- Licence checking is offline. The licence is an Ed25519-signed document verified inside the container against an embedded public key. No licence server is contacted, so the container runs in fully air-gapped networks. (The flip side: a licence cannot be revoked before its expiry, which is why licences are issued with bounded terms.)
- No telemetry. Nothing is reported back: not usage, not metrics, not errors.
- Tracing is yours.
--request-tracewrites to a file on your volume or an OpenTelemetry collector you name. At thefulllevel traces contain raw prompt and output text, so treat that setting with the care described in Tracing.
Network requirements
Outbound access is needed only at set-up time: to CarbonForge's registry
for the image pull, and to Hugging Face for the model weights. After
prefetching weights, the container serves
with no outbound network access at all (HF_HUB_OFFLINE=1).