fix(security): warn when Ollama binds to 0.0.0.0 during onboard - #1877
Conversation
NemoClaw's onboard flow starts Ollama with OLLAMA_HOST=0.0.0.0 so the Docker-based sandbox can reach the host via host.docker.internal. This silently exposes the unauthenticated Ollama API (port 11434) to the entire local network. On public WiFi, any adjacent device can enumerate models, send prompts, and consume GPU resources without authentication. The 0.0.0.0 binding is intentional (Docker requires it), but the user is never informed of the exposure. Ollama's lack of authentication is a known issue with multiple CVEs (CNVD-2025-04094, CVE-2024-37032, CVE-2024-39720 through CVE-2024-39722) and 175,000+ exposed servers found in internet-wide scans. Add a visible warning during onboard at both Ollama startup sites (existing install and brew install paths) so the user knows their inference API is network-accessible. The warning is suppressed on WSL where Ollama binds to 127.0.0.1 by default. This does not change the binding behavior — only informs the user. A future fix should add a firewall rule or Docker network bridge to restrict access to localhost + the container bridge. Signed-off-by: ColinM-sys <cmcdonough@50words.com>
|
Caution Review failedPull request was closed or merged during review Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds a console warning helper and prints a multi-line warning when Ollama is started bound to Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/onboard.ts (1)
3412-3417: Deduplicate the Ollama exposure warning text.The same warning appears here and at Line 3348-Line 3352. Please extract it into a small helper to avoid message drift and keep
setupNimfrom growing further.As per coding guidelines, "Limit cyclomatic complexity to 20 in JavaScript/TypeScript files, with target of 15".♻️ Proposed refactor
+function printOllamaExposureWarning() { + console.log(""); + console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); + console.log(" This exposes the Ollama API to your local network (no auth required)."); + console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); + console.log(" See: CNVD-2025-04094, CVE-2024-37032"); + console.log(""); +} ... - if (!isWsl()) { - console.log(""); - console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); - console.log(" This exposes the Ollama API to your local network (no auth required)."); - console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); - console.log(" See: CNVD-2025-04094, CVE-2024-37032"); - console.log(""); - } + if (!isWsl()) printOllamaExposureWarning(); ... - console.log(""); - console.log(" ⚠ Ollama is binding to 0.0.0.0 so the sandbox can reach it via Docker."); - console.log(" This exposes the Ollama API to your local network (no auth required)."); - console.log(" On public WiFi, any device on the same network can send prompts to your GPU."); - console.log(" See: CNVD-2025-04094, CVE-2024-37032"); - console.log(""); + printOllamaExposureWarning();🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/lib/onboard.ts` around lines 3412 - 3417, Extract the repeated Ollama exposure console.log block into a small helper (e.g., showOllamaExposureWarning or logOllamaExposureWarning) and replace both duplicated blocks inside setupNim with a call to that helper; ensure the helper reproduces the exact multi-line message (including blank lines) and is declared near other logging utilities in the file so setupNim shrinks and cyclomatic complexity is reduced.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@src/lib/onboard.ts`:
- Around line 3412-3417: Extract the repeated Ollama exposure console.log block
into a small helper (e.g., showOllamaExposureWarning or
logOllamaExposureWarning) and replace both duplicated blocks inside setupNim
with a call to that helper; ensure the helper reproduces the exact multi-line
message (including blank lines) and is declared near other logging utilities in
the file so setupNim shrinks and cyclomatic complexity is reduced.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: 9bbfd09e-a4a7-4bd7-a673-0bd5299e56c9
📒 Files selected for processing (1)
src/lib/onboard.ts
|
@ColinM-sys Great security contribution — the Ollama exposure warning is well-documented with CVE references. Code looks good. DCO check is failing — commits need a git rebase HEAD~1 --signoff
git push --force-with-leaseReady to merge once DCO passes. |
Signed-off-by: ColinM-sys <cmcdonough@50words.com>
5dc7690 to
949fed1
Compare
|
DCO sign-off added to both commits. Thanks for the review! |
There was a problem hiding this comment.
🧹 Nitpick comments (1)
src/lib/onboard.ts (1)
3355-3355: Make WSL suppression explicit at both warning call sites.Line 3414 is currently safe because that branch is macOS-only, but matching the explicit
!isWsl()guard used at Line 3355 would make the intent resilient to future flow changes.♻️ Proposed small consistency patch
- printOllamaExposureWarning(); + if (!isWsl()) printOllamaExposureWarning();Also applies to: 3414-3414
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@src/lib/onboard.ts` at line 3355, The warning call to printOllamaExposureWarning() should be explicitly guarded by !isWsl() at both call sites: keep the existing check at the location that already has if (!isWsl()) printOllamaExposureWarning(); and add the same explicit if (!isWsl()) guard around the other invocation (the one referenced at the second call site) so both places use isWsl() before calling printOllamaExposureWarning(), ensuring intent is clear and resilient to future flow changes.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@src/lib/onboard.ts`:
- Line 3355: The warning call to printOllamaExposureWarning() should be
explicitly guarded by !isWsl() at both call sites: keep the existing check at
the location that already has if (!isWsl()) printOllamaExposureWarning(); and
add the same explicit if (!isWsl()) guard around the other invocation (the one
referenced at the second call site) so both places use isWsl() before calling
printOllamaExposureWarning(), ensuring intent is clear and resilient to future
flow changes.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: f6fc0b36-2b85-473a-9073-66a0d852c8c8
📒 Files selected for processing (1)
src/lib/onboard.ts
|
@ColinM-sys Correction on my earlier comment — DCO check on this repo looks at the PR body, not the commits. Just add this line anywhere in your PR description: Edit the PR body, add the line, and DCO should pass. Same for #1878 if it hasn't been added there. |
|
Thank you so much for the guidance — added the sign-off to the PR description. Should be good now! |
ericksoa
left a comment
ericksoa
left a comment
There was a problem hiding this comment.
Looks good — minimal, focused, correctly scoped to both Ollama startup paths with WSL suppression. CVE references are a nice touch.
## Summary - Add "Ollama network exposure warning during onboard" troubleshooting entry (from #1877) - Document snapshot restore liveness preflight and clean restore behavior (from #1901) - Update Jetson troubleshooting for BSP R39+ support (from #1910) - Document `--from` Dockerfile permission error handling (from #1931) - Bump doc version switcher through 0.0.17 - Regenerate agent skills from updated docs ## Test plan - [x] `make docs` builds without warnings - [x] All pre-commit hooks pass - [ ] Verify rendered pages in docs build output 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Clarified onboarding error when build context contains unreadable files. * Updated snapshot restore: sandbox must be running; restore cleanly replaces state directories and removes files added after the snapshot. * Added Jetson BSP R39 automatic configuration guidance. * Added Ollama network-exposure security guidance for local provider selection during onboarding. * **Documentation (versions)** * Added docs entry for version 0.0.17 and updated project docs version. <!-- end of auto-generated comment: release notes by coderabbit.ai --> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
wscurran
added
area: cli
4 participants
Summary
nemoclaw onboardwhen Ollama is started withOLLAMA_HOST=0.0.0.0, informing the user that their inference API is exposed to the local network without authentication.Why
NemoClaw's onboard flow forces
OLLAMA_HOST=0.0.0.0:11434so the Docker sandbox can reach the host. This silently exposes the unauthenticated Ollama API to the entire local network. On public WiFi (airports, coffee shops, hackathons), any adjacent device can:GET /api/tags)POST /api/generate)POST /api/show)Ollama's lack of authentication is well-documented:
NemoClaw is actively creating this exposure by overriding
OLLAMA_HOSTduring automated onboard. The user is never warned.What changed
src/lib/onboard.ts— added a warning block after eachOLLAMA_HOST=0.0.0.0startup call, referencing the known CVEs and explaining the risk.What this does NOT change
0.0.0.0to reach the host from inside the container.Test plan
npm run build:cli— compiles cleanly.nemoclaw onboardwith Ollama selected shows the warning on non-WSL systems.Discovery
Identified during a code audit on 2026-04-07 (finding N-3 in my audit notes). The Ollama 0.0.0.0 exposure class has known CVEs but NemoClaw's role in forcing the insecure configuration has not been previously reported.
Summary by CodeRabbit
Signed-off-by: ColinM-sys cmcdonough@50words.com