A Modelfile is a blueprint for a customized model. It sets where the weights come from, plus the system prompt, example messages, prompt template and generation parameters. A Modelfile you did not write can change how a model behaves, so read it like a configuration file with instructions inside it.
What the reference lists
Ollama's Modelfile reference describes a simple format: a comment line, then instruction names followed by arguments. The instructions it documents are FROM, PARAMETER, TEMPLATE, SYSTEM, LICENSE, MESSAGE, CAPABILITY and REQUIRES.
The reference marks FROM as required. It defines the base model to use when creating a model. It can name an existing model with a tag, a directory holding Safetensors weights for a supported architecture, or a GGUF file by absolute path or a path relative to the Modelfile.
Instruction by instruction
| Instruction | What it does, per the reference | What to review |
|---|---|---|
| FROM | Base model: library name, Safetensors directory or GGUF file | Where do the weights come from, and who published them? |
| PARAMETER | Sets run parameters such as context size, temperature, stop sequences, token limits | Is any value odd, such as an unlimited prediction setting? |
| TEMPLATE | The full prompt template passed to the model | Does it add hidden text around user input? |
| SYSTEM | The system message | What behavior does it instruct? Does it tell the model to hide anything? |
| MESSAGE | Seeds a message history of system, user and assistant turns | Are the examples steering the model in unexpected ways? |
| LICENSE | The legal license text for the model shared with the Modelfile | Is it consistent with the real upstream license? |
| CAPABILITY | Adds a capability to a GGUF or MLX model without removing inherited ones | Does the added capability match what the weights were trained for? |
| REQUIRES | Sets the minimum Ollama version | Does it match the version you have approved? |
Why this deserves a review
A Modelfile does not run code in the way a pickle file does, as far as the reference describes. The risk is behavioral and supply chain related.
- Hidden instructions. A system message or seeded conversation can tell a model to behave in ways the user never sees. If you pull a model that bundles a Modelfile, those instructions come with it.
- Weights source. FROM decides what is loaded. A relative path or an unfamiliar GGUF is a decision about trust that should be recorded.
- Resource settings. The reference lists the number of tokens to predict with a default of minus one, meaning infinite generation. A server that exposes models to others should set sensible limits.
- License field. The license text in a Modelfile is whatever the author typed. Check it against the upstream license.
A review checklist
- Read the whole file. It is short.
- Trace FROM to a source you can name. Pin or hash GGUF files.
- Read SYSTEM and MESSAGE for instructions you would not accept in your own prompts.
- Check PARAMETER values for limits that fit your deployment.
- Compare the LICENSE text with the upstream model's actual license.
- Store the reviewed Modelfile in version control, and create models from that copy, not from a download.
ollama create reviewed-model -f ./Modelfile
Run that command from the reviewed copy in your repository.
Related controls
Reviewing a Modelfile does not make the weights safe, and it does not secure the server. Keep the server bound to localhost or behind a proxy, and keep model files under a managed directory. Separate posts on this blog cover binding the server safely and where Ollama stores models.
Quick check
Can a Modelfile execute code?
The reference describes it as configuration for weights, prompts and parameters, not code. The risk is hidden behavior and untrusted weights, so review for both.
Should I trust the LICENSE line in a Modelfile?
Treat it as the author's claim. Check it against the upstream publisher's license text.
Where Safeguard fits
Safeguard provides dependency scanning and policies and gates in CI, which help you keep the tooling around local models reviewed and current. A free scan is available.
Sources
- Ollama Modelfile reference, read 19 October 2026.
Last reviewed: 19 October 2026.
