Skip to main content
These partitioning recommendations draw from the Defense Information Systems Agency (DISA) Security Technical Implementation Guide (STIG) library. Poolside does not provide STIG-specific implementation guidance or support for customer-defined STIG policies.

​
Partitioning overview

This page shows recommended partition sizing for single-node Poolside on-premises model deployments running RKE2 and explains how model checkpoints affect storage requirements. The checkpoint estimates cover these model artifacts:

​
STIG-compliant partition recommendations

For STIG-hardened Linux nodes, Poolside recommends the following partition layout and sizing as a minimum for the listed models: The total recommended disk space for the listed model artifacts is 1 TB.

​
Dedicated /opt/poolside partition for model artifacts

STIG controls recommend dedicated partitions to prevent system partitions from filling up and causing denial of service. Poolside recommends placing model artifact storage on a dedicated /opt/poolside partition rather than the root filesystem. Without separation, model artifact growth can render the OS unusable.

​
Inference storage impact

When you run inference workloads, the workloads load model checkpoints from SeaweedFS into storage-backed emptyDir volumes under /var/lib/kubelet. This means you store two copies of the model checkpoint on disk: one copy in SeaweedFS and one copy in the emptyDir volume. Each inference workload consumes disk space equal to its model checkpoint size: Plan for sufficient free space in /var/lib to accommodate your largest model’s checkpoint size when running inference.

​
Scaling prioritization guidance

If you need to scale storage, allocate additional space in this priority order:
  1. /var/lib: Scales per model deployed in-cluster
  2. /opt/poolside: Scales with model checkpoints
  3. /home: Scales with Terraform files. The Poolside Terraform bundle packages container upgrade images.
Core OS partitions (/, /boot, /tmp, /var, /var/tmp, /var/log) can remain fixed regardless of total disk size.

​
STIG mount option recommendations

  • /tmp, /var/tmp, and /var/log should have noexec set in the mount options to prevent code from running in temp directories.
  • /var/lib cannot have noexec. The container runtime runs binaries from overlay layers stored there. Adding noexec here breaks Kubernetes pods.