Yes No AI Is Now A Feature

Yes, “No AI” Is Now a Feature

If you run your own infrastructure, you have noticed the slow drift. Operating systems ship with AI assistants enabled by default. Code editors push model suggestions the moment you start typing. Routers, NAS appliances, and even text editors now ship with “copilot” features baked in. Somewhere along the way, “no AI” stopped being the default and became something you have to opt into, configure, or actively fight to preserve.

For DevOps engineers, sysadmins, and homelab operators who handle sensitive data, the absence of artificial intelligence features is not a limitation. It is a requirement. Patient records, legal documents, source code under NDA, and internal financial reports should not be exfiltrated to a model provider’s inference endpoint just because a developer clicked the wrong menu item.

This guide covers the practical side of that stance. We will walk through how to identify AI features in your stack, how to disable them, how to verify that no telemetry is leaving your network, and how to build a DevOps workflow that stays AI-free by design. You will get reproducible configuration snippets for Linux, Git, Docker, Kubernetes, Visual Studio Code, and common self-hosted services.

Understanding the Problem: AI as a Default, Not an Opt-In

The Shift in Software Defaults

A decade ago, the answer to “does this software phone home?” was usually no. Open-source tools assumed you wanted local, deterministic behavior. Telemetry was opt-in, often disabled by default, and frequently greeted with suspicion. That posture made sense for infrastructure software. Sysadmins needed predictable behavior, reproducible builds, and clear data flows.

The commercial shift toward SaaS and freemium models changed the defaults. Vendors needed engagement metrics, usage telemetry, and behavioral signals to inform product decisions. Open-core projects adopted similar models to fund development. Then generative AI arrived, and the metric that mattered most was whether the user was generating completions, accepting suggestions, and feeding the model with their work.

The result is that “AI” is now bolted into every layer of the stack:

• Operating systems: Windows Recall, macOS Apple Intelligence, Ubuntu’s Chromium AI features
• IDEs and editors: Copilot, Codeium, Tabnine, Cursor, JetBrains AI Assistant
• Source control: GitHub Copilot, GitLab Duo, Bitbucket AI
• Terminals and CLIs: Warp AI, Fig AI, Amazon Q CLI
• Routers and firewalls: UniFi AI, pfSense AI Traffic Cop (third-party)
• Container images: Base images that install inference clients by default
• Documentation portals: Embedded “Ask AI” widgets that train on your docs

When the AI is built into the tool you use every day, you cannot simply stop using it. You have to actively disable it, which is the inversion the title of this article describes.

Why “No AI” Matters for Infrastructure

The objections are not ideological. They are operational and legal:

1. Data residency: Many regulated industries (HIPAA, GDPR, PCI-DSS) require that certain data classes never leave controlled environments. LLM providers are not covered entities, and their inference logs may retain data longer than your retention policy allows.

2. Supply chain risk: AI features typically require additional dependencies, network endpoints, and credential chains. Every additional dependency is a potential CVE, and every new outbound endpoint is a potential exfiltration channel.

3. Predictability: DevOps tooling should be deterministic. A model suggestion that changes between releases breaks reproducibility, just like a clock skew or a DNS race condition.

4. Performance: AI features consume CPU, memory, and disk. On a homelab NAS with 8 GB of RAM, every megabyte matters.

5. License: Some AI training pipelines ingest user content under terms that conflict with your organization’s IP policies.

The Cultural Shift

The Reddit thread that inspired this post captured the sentiment succinctly: “No AI is 100% a feature to me and one that I appreciate.” That is the new baseline. Software that does not include AI, that does not phone home, and that does not require a cloud account to function is now a premium feature. It is what open source used to take for granted.

If you are building a homelab or a self-hosted stack in 2026, designing for “AI-free” means making architectural choices, not just flipping switches. The rest of this guide shows you how.

Prerequisites

Hardware and OS Baseline

You do not need exotic hardware to run an AI-free stack. In fact, most AI-free setups run on modest hardware because you are not allocating resources to local models or inference servers.

Component	Minimum	Recommended
CPU	4 cores, x86_64	8 cores, AES-NI
RAM	8 GB	16 GB or more
Storage	256 GB SSD	1 TB NVMe
Network	1 Gbps	2.5 Gbps

Supported operating systems for this guide:

• Debian 12 (Bookworm) or later
• Ubuntu 22.04 LTS or later (Ubuntu 24.04 LTS recommended)
• Fedora 40 or later
• Rocky Linux 9 or later
• Arch Linux (rolling)
• FreeBSD 14 (where applicable)

Network and Egress Controls

Before you disable AI features, you need visibility into what is actually leaving your network. Set up an egress monitor so you can audit outbound traffic:

# Install and enable ntopng for flow monitoring
sudo apt install ntopng
sudo systemctl enable --now ntopng

Alternatively, use a Pi-hole or a dedicated DNS sinkhole to log every DNS query. AI features typically call home using a small set of well-known domains. Knowing those domains lets you block them at the resolver rather than chasing individual application settings.

Required Tools

Install these before proceeding:

# Debian/Ubuntu
sudo apt update
sudo apt install -y \
  curl \
  wget \
  git \
  vim \
  jq \
  yq \
  tcpdump \
  wireshark \
  net-tools \
  dnsutils \
  apparmor-utils \
  ufw

# RHEL/Fedora
sudo dnf install -y \
  curl \
  wget \
  git \
  vim \
  jq \
  yq \
  tcpdump \
  wireshark \
  net-tools \
  bind-utils \
  apparmor-utils \
  firewalld

User Permissions

You need a non-root user with sudo access for most steps. Some operations require root. Where that is the case, the guide calls it out explicitly. For production systems, prefer doas over sudo where supported, because its configuration is auditable in a single file.

Pre-Installation Checklist

Confirm the following before making changes:

• Backups are current for all critical data
• You have console access (IPMI, KVM, or physical) in case a network change locks you out
• Your DNS resolver is documented and backed up
• You know which services are exposed publicly vs. locally
• You have a rollback plan for each configuration change

Installation and Setup: Building an AI-Free Baseline

Step 1: Harden the Operating System

The operating system is the foundation. Disable AI features at the OS level before installing anything else.

Debian/Ubuntu:

Edit /etc/os-release and document the baseline. Then disable any AI-related packages:

# Disable Ubuntu's new AI features (Ubuntu 24.04+)
sudo systemctl disable --now whoopsie.service  # crash reporting
sudo apt remove -y whoopsie

Fedora:

# Disable Fedora's optional AI/ML telemetry
sudo dnf remove -y fedora-workstation-repositories  # if present
sudo systemctl mask --now abrt-journal.service

For systemd-based systems, disable any service whose description mentions “AI”, “intelligence”, “telemetry”, or “analytics”:

# Audit running services for AI-related descriptions
systemctl list-units --type=service --all | grep -iE "ai|intel|telemetry|analytic|assistant"

Step 2: Block AI Endpoints at the DNS Layer

The most effective way to stop AI features from phoning home is to refuse to resolve their domains. Configure your DNS resolver to return NXDOMAIN for known AI endpoints:

# Example: pi-hole custom blacklist (add to /etc/pihole/blacklist.txt)
githubcopilot.com
api.githubcopilot.com
copilot.github.com
api.openai.com
chat.openai.com
api.anthropic.com
api.cohere.ai
api.groq.com
generativelanguage.googleapis.com
bedrock-runtime.us-east-1.amazonaws.com
q.us-east-1.amazonaws.com
codeium.com
api.codeium.com
tabnine.com
api.tabnine.com
cursor.sh
api.cursor.sh
continue.dev
api.continue.dev
aider.chat
api.aider.chat
claude.ai
api.claude.ai
gemini.google.com

For Unbound (used by many homelabs), add a local zone:

# /etc/unbound/unbound.conf.d/ai-block.conf
server:
    local-zone: "openai.com" static
    local-zone: "anthropic.com" static
    local-zone: "githubcopilot.com" static
    local-zone: "cursor.sh" static
    local-zone: "codeium.com" static
    local-data: "api.openai.com A 127.0.0.1"
    local-data: "api.anthropic.com A 127.0.0.1"

sudo unbound-checkconf
sudo systemctl restart unbound

Step 3: Firewall Rules for AI Endpoints

DNS blocking is bypassable by hardcoded IPs. Add firewall rules for the IP ranges used by major model providers. Use an ipset for performance:

# Create an ipset for AI provider ranges (example using nftables)
sudo nft add set inet filter ai-endpoints { type ipv4_addr; flags interval; }
sudo nft add element inet filter ai-endpoints { 104.18.0.0/16 }  # Cloudflare (example range)

For UFW on Ubuntu:

# /etc/ufw/before.rules - add at the top
-A OUTPUT -m set --match-set ai-endpoints dst -j REJECT --reject-with icmp-admin-prohibited

The exact ranges change frequently. Use a maintained list like hagezi/dns-blocklists as a starting point.

Step 4: Configure Git Without AI

Git itself does not include AI features, but the hosts you use it with do. Configure Git to refuse to load AI-related helpers:

# ~/.gitconfig - global AI-free Git configuration
[user]
    name = "Your Name"
    email = "you@example.com"

[core]
    pager = less
    excludesfile = ~/.gitignore_global
    autocrlf = input

[advice]
    detachedHead = false
    statusHints = false

[pull]
    ff = only

[init]
    defaultBranch = main

[credential]
    helper = cache --timeout=3600

# Explicitly disable any AI helper that might be configured
[filter "llm"]
    clean = cat
    smudge = cat
    required = false

For GitHub specifically, if you use gh, disable the Copilot integration:

gh extension remove copilot 2>/dev/null || true
gh extension remove copilot-cli 2>/dev/null || true

Also review your GitHub account settings at https://github.com/settings/features and ensure “GitHub Copilot” is disabled.

Step 5: Docker Without AI

Modern Docker Desktop includes an “Ask Gordon” AI assistant. Replace Docker Desktop with the open-source Docker Engine:

Debian/Ubuntu:

# Remove Docker Desktop if installed
sudo apt remove -y docker-desktop
rm -rf ~/.docker/desktop
sudo rm /usr/local/bin/com.docker.* 2>/dev/null || true

# Install Docker Engine from official repository
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
sudo chmod a+r /etc/apt/keyrings/docker.gpg

echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin

Configure the daemon to disable experimental features and any AI-related telemetry:

# /etc/docker/daemon.json
{
  "features": {
    "buildkit": true,
    "containerd-snapshotter": false
  },
  "experimental": false,
  "metrics-addr": "127.0.0.1:9323",
  "no-new-privileges": true,
  "live-restore": true,
  "userland-proxy": false,
  "ip-forward": false,
  "iptables": true,
  "default-ulimits": {
    "nofile": {
      "Name": "nofile",
      "Hard": 64000,
      "Soft": 64000
    }
  }
}

sudo systemctl restart docker
sudo docker info | grep -iE "ai|experimental|telemetry"

When running containers, use the templating-safe variables:

# Audit running containers
sudo docker ps --format "table $CONTAINER_ID\t$CONTAINER_NAMES\t$CONTAINER_STATUS\t$CONTAINER_IMAGE"

# Check for AI-related images
sudo docker images | grep -iE "copilot|openai|llama|ollama|llm|gpt"

For image building, use BuildKit without AI features:

# ~/.docker/buildx/instantiation/default/config.toml
[worker.oci]
  enabled = true

[registry."docker.io"]
  mirrors = []

# Explicitly disable any AI features
[experimental]
  enabled = false

Step 6: Kubernetes Without AI

If you run Kubernetes, disable the AI integrations in kubectl plugins and in distributions that ship with Copilot-like features.

For k0s, k3s, or kubeadm, the upstream Kubernetes does not include AI features. The risk comes from cloud-managed distributions and from CNI plugins or ingress controllers that add AI capabilities.

# Audit your kubectl plugins
kubectl krew list

# Remove AI-related plugins
kubectl krew uninstall openai 2>/dev/null || true
kubectl krew uninstall kubectl-ai 2>/dev/null || true
kubectl krew uninstall kube-copilot 2>/dev/null || true

For the cluster itself, audit RBAC and admission controllers:

# Check for AI-related admission webhooks
kubectl get validatingwebhookconfigurations -A | grep -iE "ai|copilot|llm"
kubectl get mutatingwebhookconfigurations -A | grep -iE "ai|copilot|llm"

If you find any, document them and decide whether to keep them based on your threat model.

Step 7: Editor Configuration Without AI

Visual Studio Code:

VS Code has the most aggressive AI integration of any editor. Disable it comprehensively:

// settings.json (User)
{
    // Disable all AI/ML features
    "github.copilot.enable": {
        "*": false
    },
    "github.copilot.chat.enabled": false,
    "github.copilot.inlineSuggest.enable": false,
    "github.copilot.nextEditSuggestions.enabled": false,
    "github.copilot.edits.enable": false,
    "github.copilot.appendCodeSuggestion": false,
    "github.copilot.generateTests.enabled": false,
    "github.copilot.fixTests.enabled": false,

    "codeium.enableCodeium": false,
    "codeium.enableChat": false,
    "codeium.enableCodeLens": false,
    "codeium.enableTabAutocomplete": false,

    "tabnine.tabAutocomplete": false,
    "tabnine.enableChat": false,
    "tabnine.enableTelemetry": false,

    "continue.enableTabAutocomplete": false,
    "continue.enableCodeLens": false,

    "cursor.ai.enable": false,

    "amazonq.showWelcomePage": false,
    "amazonq.inlineSuggestions.enabled": false,

    // Telemetry and experiments
    "telemetry.telemetryLevel": "off",
    "workbench.enableExperiments": false,
    "workbench.settings.enableNaturalLanguageSearch": false,

    // Disable the new chat panel even if extensions try to enable it
    "chat.commandCenter.enabled": false
}

Disable all extensions and reinstall only what you need:

# Disable all extensions
code --disable-extension $(code --list-extensions | tr '\n' ' ')

Then manually enable only the extensions you actually use (lsp, linters, formatters, etc.).

Vim/Neovim:

For Vim and Neovim, AI features come from plugins like vim-copilot, codium.vim, and chatgpt.vim. Avoid them entirely and configure your LSP for completion:

-- ~/.config/nvim/init.lua
vim.opt.completeopt = { "menu", "menuone", "noselect" }
vim.opt.signcolumn = "yes"

-- No AI plugins, period.
-- Use built-in omnifunc with your language servers instead.

JetBrains IDEs:

For IntelliJ, PyCharm, GoLand, and the rest:

1. Go to Settings → Plugins → Installed
2. Uninstall AI Assistant
3. Go to Settings → Advanced → Disable AI features
4. In Help → Diagnostic Tools → Debug Log Settings, add #com.intellij.ai to silence AI logs

Step 8: Shell and Terminal Configuration

Modern terminals sometimes include AI features. Disable them:

Warp:

Warp is AI-first by design. Avoid it. Use Alacritty, Kitty, Foot, or WezTerm instead.

Fig:

Fig’s autocomplete can send keystrokes to a remote service. Disable telemetry:

fig settings telemetry.disable true
fig settings ai.disable true

Standard bash/zsh:

Add to your .bashrc