# Before You Begin

> System requirements and prerequisites for installing Root Lock by HeartSuite.

---

LLMS index: [llms.txt](/llms.txt)

---

**Overview**: Confirm the requirements below match your system, then follow Cloud Path or Local Path on that host. On Local Path, finish distribution updates and the packages this host will run before you install.

## System requirements

- **Operating System**: x86 (64-bit) Linux — Debian 11–13, Ubuntu-derived, Alpine, or RPM-based (Rocky 9.7 validated; Fedora 41, CentOS Stream 9 validated; RHEL/AlmaLinux/SLES: customer validation). See [Distro Compatibility Matrix](../../kernel-hardening/distro-compatibility-matrix/).
- **Execution environment**: bare metal or a full virtual machine with hardware virtualization (KVM, cloud hypervisors, VMware). The Local Path command is the same on both. Shared-kernel container guests (OpenVZ, LXC, Docker/Podman guests sharing the provider kernel) are not a fit by design. If a VPS or cloud guest has no `/dev/kvm`, install there; nesting a second guest causes the installer to stop at the start. See [Bare metal, virtual machines, and nested VMs](../../introduction/system-requirements/#bare-metal-virtual-machines-and-nested-vms) and [Deployment Scenarios](../../introduction/deployment-scenarios/).
- **Access Level**: Root access (sudo privileges).
- **Skills**: Basic familiarity with the Linux command line.

If your setup differs, check the [Introduction](../../introduction/) for compatibility details.

## Finish the OS first

On Local Path, complete distribution updates and install the packages and services this host will actually run. Then install Root Lock. During initial setup, Root Lock records startup and shutdown programs from those boots. Package-install helpers, compilers, and one-shot probes that execute in that window become allowlist entries even if they never execute again.

After the Dashboard appears, run the workload you will keep — not compilers, probes, or other one-shot tools. After Lockdown, add software through [Protecting During Maintenance](../../maintenance/protecting-during-maintenance/).

## Choosing your setup path

<div class="row g-4 mb-4 hs-choice-pane">
<div class="col-md-6 d-flex">
  <div class="card h-100 w-100 hs-choice-card">
    <div class="card-header">Cloud Path</div>
    <div class="card-body">
      
      <p>Launch a pre-installed Root Lock by HeartSuite instance on AWS, Google Cloud, Azure, DigitalOcean, Linode, or another provider. No download or kernel installation required — you boot directly into Setup Mode and the Dashboard appears on first login.</p>
<p><strong>Ready?</strong> Launch your instance, then continue to <a href="/rootlock/verification/">Verifying Installation</a>.</p>

    </div>
  </div>
</div>

<div class="col-md-6 d-flex">
  <div class="card h-100 w-100 hs-choice-card">
    <div class="card-header">Local Path</div>
    <div class="card-body">
      
      <p>Finish distribution updates and the packages this host will actually run, then download the installation package from <a href="https://heartsecsuite.com">heartsecsuite.com</a>, extract, install the Root Lock kernel, and complete the Installation setup through multiple reboot cycles before reaching the Dashboard.</p>
<p><strong>Ready?</strong> Continue to <a href="/rootlock/installation/obtaining-heartsuite/">Obtaining Root Lock</a>.</p>

    </div>
  </div>
</div>

</div>


Cloud Path and Local Path merge at the Dashboard after initial setup is complete. Cloud users continue to [Verifying Installation](../../verification/). Local users continue to [Obtaining Root Lock](../../installation/obtaining-heartsuite/).

Many hosts still install through Cloud Path or Local Path on each machine. Ansible, Terraform, and GitOps apply allowlist policy after that install — see [Central Policy](../../alerts/central-policy-management/).