Docker Model Runner vs PrivateGPT

Docker Model Runner 85

v1.2.9 was tagged on 21 October 2026, 14 days before the check (30 of 30, from 20). Three releases in the 90 days to 4 November 2026, v1.2.7 (11 August, an SSRF fix on the pull path and a llama.cpp bump), v1.2.8 (12 August, a fix for proxied token fetches) and v1.2.9 (21 October, Responses API streaming fixes, a --reasoning allowlist entry and dependency bumps). Each changes the server's code, so all count in full (20 of 20, from 0). 49 commits on main since 6 August, the newest on 2 November. Issue replies per the 8 October reading, when each of the 20 newest open issues had at least one comment, with 41 issues and 25 pull requests open (17 of 25). No SDK of its own. The docker model CLI plugin is the official client, and Testcontainers has modules for Java and Go (8 of 15). Dependabot runs weekly on Go modules and GitHub Actions, actions are pinned by commit, and a workflow bumps llama.cpp. CI runs the tests on main, pass state per 8 October (10). Total 85.

PrivateGPT 41

The last release is 1.0.1, dated 16 June 2026 in the changelog and tagged 18 June, 141 days before the check (10 of 30). No release or dated changelog entry in the 90 days since 8 August (0 of 20). Maintainers commit most days and outside pull requests merged in October, but 23 pull requests are open and the stale bot closes issues, including two security reports, with no maintainer reply (13 of 25). Homebrew tap, wheel index and Docker images ship with releases, and Anthropic SDKs work against it. No product MCP server of its own, though it connects to remote MCP servers (10 of 15). Dependabot, uv.lock, actions pinned by commit since 19 October and dependency CVE upgrades in June, July and August (8 of 10). 10 + 0 + 13 + 10 + 8 = 41.

Docker Model Runner 49

Read for an API. No OpenAPI or similar file was found in the repository or the docs. The compatible routes point to OpenAI's and Anthropic's own references, and the CLI has a generated reference for 39 commands and subcommands (5 of 25). docs.docker.com has llms.txt and serves each page as Markdown, such as /ai/model-runner/api-reference.md (10). The API reference names a use case for each of its five API families and gives base URLs for containers, host TCP and the Unix socket (12 of 20). Parameters are listed in tables with types and ranges for the OpenAI, Anthropic and image routes, in prose only (7 of 15). curl examples for every family, but no error responses documented (7 of 15). Dated GitHub releases with notes. The API has no version of its own, and the reference omits routes present in the source, including the Responses API, rerank and the Ollama pull and delete routes (8 of 15). Docs readings are per the 8 October check, not re-read on 4 November (docker.com hosts paused under Docker's Terms of Use).

PrivateGPT 83

An OpenAPI file of 38 paths in the repository (fern/openapi/openapi.json, version 1.0.1), also served by each instance at /openapi.json, with the messages API modelled on Anthropic's (25). docs.privategpt.dev serves llms.txt, a Markdown copy of every page and a docs MCP server (10). The docs explain each endpoint group, startup and model discovery, and a compatibility table says which parts of the Claude API are supported, partial or missing, such as prompt caching and OAuth (15 of 20). Pydantic models with literal type discriminators and required fields, while settings and tool context are wide objects (12 of 15). curl examples for each guide and a /v1/messages/validate route, with error shapes not documented as a list (9 of 15). /v1 paths and a dated changelog, though releases trail main by more than four months (12 of 15). 25 + 10 + 15 + 12 + 9 + 12 = 83.

Docker Model Runner 74

The editorial half. Apache-2.0 for the server, the CLI and the dmr binary in a public repository. Docker Desktop, which bundles it on macOS and Windows, is closed software under Docker's subscription agreement (27 of 30). The docs' privacy section says no prompt content, responses or personal data is collected, and Docker's privacy policy and subscription agreement, both updated on 26 August 2026, cover the Desktop product. No retention period specific to Model Runner was found (18 of 30). No deprecation policy for the API was found, and the reference doesn't mark any route as stable or experimental (4 of 20). Telemetry is disclosed with a link to the source. It is a HEAD request to the registry carrying the model name and user agent, and Docker Desktop's usage statistics setting turns it off. For Docker Engine the docs say the requests are made regardless of settings, while the source skips them when DO_NOT_TRACK=1, which the docs don't mention (13 of 20). Docs readings are per the 8 October check, not re-read on 4 November. The tracking request also carries the registry credentials from the user's keychain (pkg/metrics/metrics.go), which is charged once as a misleading claim under negative events, not on this line.

PrivateGPT 64

Apache-2.0 (30). The OpenAPI description says no data leaves the execution environment, but the docs list cloud gateways as model providers and web search goes to outside services when enabled, and no privacy statement covers the software. Zylon's privacy policy covers its website (15 of 30). The 1.0 rewrite was marked as a breaking change in the changelog, and there is no deprecation policy (6 of 20). No telemetry to Zylon found in the source. OpenTelemetry tracing is off by default and its exporters write local files or to the owner's collector, documented on the observability page (16 of 20). 30 + 15 + 6 + 16 = 67.

Docker Model Runner 40

Read with the tool checklist, for the local API. No credential, by design. The docs say the API is not authenticated and that any client that can reach it, including other containers on the same Docker network, can pull, load and run models. Host-side TCP is off by default in Docker Desktop and on by default on port 12434 in Docker Engine, and cross-origin requests are refused with 403 unless the origin is localhost, 127.0.0.1, 0.0.0.0 or listed in DMR_ORIGINS (7 of 30). No read-only mode or per-caller limit. Runtime flags pass an allowlist, engines run sandboxed on macOS and Windows and in a container on Linux, and Enhanced Container Isolation, a Docker Business control, blocks container access (6 of 20). The API returns model output, with no injection guidance in the docs (6 of 15). docker model requests and the Requests tab show recent requests and responses, the source keeps the last 10 per model, and /metrics exposes Prometheus counters. No caller identity (8 of 15). www.docker.com has a valid security.txt with a disclosure policy, Docker's organisation-wide SECURITY.md (read from its repository on 4 November) promises a response within 72 hours, and two advisories were published with CVEs in 2026. No monetary bounty for this project (13 of 20).

PrivateGPT 32

Read with the tool checklist. Authentication is off by default, and when on it is one static secret compared with the whole Authorization header, with a sample secret:key value in settings.yaml. There are no per-user keys or scopes, private-gpt serve binds 0.0.0.0 by default and CORS allows every origin, so a default start answers anyone on the network. The docs disagree on the header (Bearer, Basic or an Anthropic key) (6 of 30). Tools are chosen per request and code execution has internet off by default, but bash runs as a host subprocess with resource limits, not in a container, and nothing asks for approval (6 of 20). Web fetch, web search, documents and MCP servers bring untrusted text to the model. A public prompt-injection report (#2270) was closed by the stale bot, and no guidance was found beyond a 19 October change that bounds tool output (3 of 15). OpenTelemetry traces cover every request, model call, tool and sandbox step, off by default, with local JSON lines exporters (10 of 15). SECURITY.md since 23 July 2026 asks for private reports through GitHub or Discord. No bounty, no certification, and the June and July security reports in issues were closed by a bot with no reply (7 of 20). 6 + 6 + 3 + 10 + 7 = 32.

Docker Model Runner 58

Read for an API. Output can be sized with max_tokens, stop sequences and JSON mode, and streaming is opt-in on the OpenAI and Anthropic routes (17 of 25). Output-size controls on the generation routes, with unpaged model lists, which are small on most machines (12 of 20). Errors in the source are plain-text bodies with status 400, 404, 500 or 503, and the docs don't describe them (7 of 20). Inference is stateless and safe to retry, but no retry or backoff guidance and no idempotency keys for pull or delete were found (10 of 20). model is the only required field beyond the messages or prompt. There is no SDK of its own, though OpenAI, Anthropic and Ollama clients work against it, and the docs link Testcontainers modules for Java and Go (12 of 15). Per the 8 October check, not re-read on 4 November.

PrivateGPT 64

Read for an HTTP API an agent calls on a local instance. Token counting, top_k style retrieval settings, citation output and response byte caps let a caller size context (18 of 25). Artifact listing by namespace and retrieval filters, with no documented cursor pagination (12 of 20). FastAPI validation errors name the field and the validate route checks a request before running it, but there is no error catalogue (12 of 20). Async messages and ingestion return task ids with status, cancel and delete routes. No idempotency keys were found (10 of 20). Anthropic SDKs and Claude Code work by pointing ANTHROPIC_BASE_URL at the server, but a model server and an embedding server have to be configured first (12 of 15). 18 + 12 + 12 + 10 + 12 = 64.

Docker Model Runner 75

Read with the local-software lines, since the API runs on the owner's machine. Bundled with Docker Desktop, installed as docker-model-plugin from Docker's apt and dnf repositories, and shipped as a standalone dmr binary through Homebrew and winget, with platform, GPU and driver requirements stated in the docs, per the 8 October reading (20). The CI workflow runs lint, go test -race ./... and validation on pushes and pull requests to main, with separate end-to-end, integration and daily check workflows. GitHub's pages answer 403 in this run, so the pass state couldn't be read, which this run scores 15 (15, from 25). 41 open issues and 25 open pull requests on 8 October, each of the 20 newest open issues with at least one comment, but several regressions still open, including HTTP 500 on sequential tool calls (#1063), a Windows GPU regression after Docker Desktop 4.82.0 (#1054) and a context-size setting applied nondeterministically (#1025). Not re-read on 4 November (17 of 25). Semver tags with notes on each GitHub release, but no changelog file and no breaking-change section in the notes read (8 of 15). Version 1.2.9 (15). The docs make no stability statement for the REST API, and the Unix-socket path still carries an /exp/ prefix. Total 75.

PrivateGPT 70

Read with the local-software lines, since PrivateGPT runs on the owner's hardware with no hosted service behind it. Homebrew tap, uv tool install from Zylon's own wheel index (not PyPI) and Docker Hub images zylonai/private-gpt 1.0.1 of 18 June 2026. Python 3.11 only, stated in pyproject.toml, and it needs a separate OpenAI-compatible model server (17 of 20). tests.yml runs format, lint, typecheck and the tests affected by each push on main, with the full suite of 217 test files on release pull requests. We couldn't see run results because the GitHub API refused us, and issue #2441 of 1 November reports the Claude spec update workflow failing (15 of 25). GitHub shows 3 open issues of about 1,250, because a stale bot closes quiet issues, two security reports among them, with no maintainer reply (12 of 25). release-please keeps a changelog with breaking changes marked, but no release has been cut since 1.0.1 while main carries 51 commits since 8 August, among them a breaking observability change of 23 October (11 of 15). Version 1.0.1 (15). 17 + 15 + 12 + 11 + 15 = 70.