What actually runs on your machine
mahout, the inference engine, and why there is no container to install today. Exactly what an ElephantPool host runs, where it comes from, and what it is allowed to do.
Two things run on a host machine, and you can read the source of both.
1. mahout — the agent
mahout is a single Rust binary, about 5 MB. It probes your hardware, enrolls with a one-time code, downloads and verifies model weights, starts and supervises the inference engine, polls for work, and signs a receipt for every job it completes. It runs as your user, needs no root, and opens no inbound port — it only makes outbound HTTPS calls, which is why it works behind any home router untouched.
It is open source, and the
installer you pipe into sh is
forty lines of shell you can read first.
2. The inference engine
mahout does not do the maths itself; it drives an engine. Today that engine is
llama.cpp — a specific pinned release, downloaded once into mahout's cache and
verified against a SHA-256 baked into the mahout binary. It runs as a child process bound to
127.0.0.1, so nothing outside your machine can reach it.
One llama.cpp build (the Vulkan one) serves AMD, NVIDIA and Intel GPUs alike. That is deliberate: AMD owners are not a second-class tier here, and our own fleet runs RX 7900 XTX cards.
So where are the Docker images?
There aren't any, and that is a feature. A container image for a serving engine is 10–30 GB, needs a container runtime, a GPU toolkit and often root to set up. For a gaming PC in someone's living room, that is a lot of ceremony to serve a model that a 5 MB binary already serves.
Containers become worth it at the other end of the market: many concurrent requests on a workstation-class or datacenter card, where vLLM's continuous batching and paged attention pull ahead. When we add that tier, the rules do not change:
- the image is referenced by digest, never by a moving tag;
- the list of images a host may run is compiled into the mahout release — the server cannot hand your machine an arbitrary image to execute;
- the container gets no network egress and a read-only mount of the weights;
- it stays opt-in per host.
Until then, the honest answer to "which images do you run on my computer?" is: none.
What it is allowed to do
mahout only runs artifacts that are pinned and checksummed: a specific engine release, a specific model file at a specific upstream revision. There is deliberately no way to point it at an arbitrary URL from the network, and a job is data — a prompt — not code. Prompts live in RAM, never touch your disk, and are gone when the job ends.