Container security defaults

RamaLama ships models as OCI images you can inspect and sign

Treating the runtime and the weights as a container image buys you a hardened default docker run and a signable artifact. On Apple Silicon, though, that same boundary costs you the GPU. One hands-on run puts a number on that cost.