llm security

Practical, Bash-first guide to hardening open-source AI on Linux: explains why LLMs widen attack surfaces (prompt injection, poisoned weights/datasets, secret exfiltration, runtime escapes) and delivers a step-by-step playbook: rootless Podman sandboxes, default-deny egress with firewalld, provenance checks (checksums, signatures, Git LFS), observability via auditd/eBPF, safe secrets (Podman secrets/pass), plus AppArmor/SELinux tips and a minimal secure recipe.