{"record":{"id":"6a183ffa28a8e26f","repo":"docling-project/docling","slug":"connections-to-remote-services-are-only-allowed-wh","errorCode":null,"errorMessage":"Connections to remote services are only allowed when set explicitly. pipeline_options.enable_remote_services=True.","messagePattern":"Connections to remote services are only allowed when set explicitly\\. pipeline_options\\.enable_remote_services=True\\.","errorType":"exception","errorClass":"OperationNotAllowed","httpStatus":null,"severity":"error","filePath":"docling/models/inference_engines/image_classification/api_kserve_v2_engine.py","lineNumber":56,"sourceCode":"        enable_remote_services: bool,\n        options: ApiKserveV2ImageClassificationEngineOptions,\n        model_config: Optional[EngineModelConfig] = None,\n        accelerator_options: AcceleratorOptions,\n        artifacts_path: Optional[Union[Path, str]] = None,\n    ):\n        super().__init__(\n            options=options,\n            model_config=model_config,\n            accelerator_options=accelerator_options,\n            artifacts_path=artifacts_path,\n        )\n        self.options: ApiKserveV2ImageClassificationEngineOptions = options\n        self._kserve_client: Optional[KserveV2Client] = None\n        self._input_name: Optional[str] = None\n        self._output_name: Optional[str] = None\n\n        if not enable_remote_services:\n            raise OperationNotAllowed(\n                \"Connections to remote services are only allowed when set explicitly. \"\n                \"pipeline_options.enable_remote_services=True.\"\n            )\n\n    def _resolve_model_name(self) -> str:\n        if self.options.model_name:\n            return self.options.model_name\n\n        return self._repo_id.replace(\"/\", \"--\")\n\n    def _resolve_model_version(self) -> Optional[str]:\n        return self.options.model_version\n\n    def _resolve_tensor_names(self) -> tuple[str, str]:\n        if self._kserve_client is None:\n            raise RuntimeError(\"KServe v2 client is not initialized.\")\n\n        metadata = self._kserve_client.get_model_metadata()","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/docling-project/docling/blob/61d76f1ff3f8428065465889f7b4577da7df704c/docling/models/inference_engines/image_classification/api_kserve_v2_engine.py#L38-L74","documentation":"Docling refuses to connect to remote inference services unless the user explicitly opts in. Constructing the KServe v2 image-classification engine without enable_remote_services=True raises OperationNotAllowed. This is a deliberate privacy/data-boundary guard: document content would otherwise be sent to an external endpoint without consent.","triggerScenarios":"Creating ApiKserveV2ImageClassificationEngine (directly or via the engine factory with engine_type=API_KSERVE_V2) while the enable_remote_services flag passed down from pipeline_options is False/unset.","commonSituations":"Switching ImageClassifier pipeline options to the ApiKserveV2 engine without setting pipeline_options.enable_remote_services=True; a shared config where the flag was disabled for local-only operation; new users trying the remote engine from an example without the opt-in flag.","solutions":["Set enable_remote_services=True in your pipeline options before using the ApiKserveV2 image-classification engine (e.g. pipeline_options.enable_remote_services = True).","If you did not intend remote calls, keep the flag False and use a local engine type (ONNXRUNTIME or TRANSFORMERS) instead.","If setting it programmatically, ensure the flag is propagated to the factory call (create_..._engine(enable_remote_services=...)) and not overridden elsewhere."],"exampleFix":"# before\npipeline_options.enable_remote_services = False\noptions = ImageClassifierPipelineOptions(\n    engine_options=ApiKserveV2ImageClassificationEngineOptions(...)\n)\n\n# after\npipeline_options.enable_remote_services = True\noptions = ImageClassifierPipelineOptions(\n    engine_options=ApiKserveV2ImageClassificationEngineOptions(...)\n)","handlingStrategy":"validation","validationCode":"from docling.datamodel.image_classification_engine_options import ApiKserveV2ImageClassificationEngineOptions\n\nif isinstance(options, ApiKserveV2ImageClassificationEngineOptions) and not enable_remote_services:\n    raise PermissionError(\n        \"enable_remote_services must be True to use the KServe v2 engine\"\n    )","typeGuard":null,"tryCatchPattern":"from docling.exceptions import OperationNotAllowed\n\ntry:\n    engine.initialize()\nexcept OperationNotAllowed as e:\n    # config issue: set the flag or switch to a local engine; do not retry\n    raise SystemExit(f\"config error: {e}\") from e","preventionTips":["Centralize the enable_remote_services decision in one config location and assert it before building pipelines.","Default to local engines (ONNXRUNTIME/TRANSFORMERS) in shared configs so remote calls never happen implicitly.","Document the data-privacy implication when enabling remote services in team configs."],"tags":["remote-services","opt-in","privacy","kserve","configuration"],"backgroundTag":null,"analyzedSha":"61d76f1ff3f8428065465889f7b4577da7df704c","analyzedAt":"2026-08-14T23:53:18.727Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}