# Getting Started

> Choose your setup path and begin installation.

---

LLMS index: [llms.txt](/llms.txt)

---

**Overview**: On a single host, Root Lock by HeartSuite uses Cloud Path (pre-installed instance, Dashboard appears on first login) or Local Path (manual installation with multiple reboots). Cloud Path and Local Path both arrive at the Dashboard after initial setup.

## Before you begin

Check [Before You Begin](before-you-begin/) for system requirements and prerequisites, then follow Cloud Path or Local Path below.

## Order of work

On Local Path, finish distribution updates and install the packages and services this host will actually run. Then run the installer. After the first reboot into the Root Lock kernel, leave the host quiet until the Dashboard appears.

On Cloud Path, Root Lock already finished initial setup during image preparation. First-boot leftovers can still appear in the queues — do not approve them if they are not runtime.

When the Dashboard appears, Root Lock has already added the programs that executed at boot and shutdown. In Setup Mode, Root Lock logs the rest of the workload. [Allowlisting Basics](../allowlisting/allowlisting-basics/) covers **approve** and **skip**. After Lockdown, add software through [Protecting During Maintenance](../maintenance/protecting-during-maintenance/).

## Choose your path

<div class="row g-4 mb-4 hs-choice-pane">
<div class="col-md-6 d-flex">
  <div class="card h-100 w-100 hs-choice-card">
    <div class="card-header">Cloud Path</div>
    <div class="card-body">
      
      <p>Launch a pre-installed Root Lock instance. No download or kernel installation required. First-boot leftovers can still appear in the queues — dismiss them if they are not runtime.</p>
<ol>
<li><strong>Launch the instance</strong> — start a pre-installed image on AWS, Google Cloud, Azure, DigitalOcean, Linode, or another provider.</li>
<li><strong>Open the Dashboard</strong> — you boot into Setup Mode and the Dashboard appears on first login. Initial setup is already complete.</li>
<li><strong><a href="/rootlock/verification/">Verifying Installation</a></strong> — confirm the Dashboard is ready, then follow the Suggested Next Step to begin allowlisting.</li>
</ol>

    </div>
  </div>
</div>

<div class="col-md-6 d-flex">
  <div class="card h-100 w-100 hs-choice-card">
    <div class="card-header">Local Path</div>
    <div class="card-body">
      
      <p>Install Root Lock on bare metal or a full virtual machine with hardware virtualization. Finish distribution updates and the packages this host will actually run, then:</p>
<!-- markdownlint-disable MD029 -->
<ol>
<li><strong><a href="/rootlock/installation/obtaining-heartsuite/">Obtaining Root Lock</a></strong> — download the installer from heartsecsuite.com.</li>
<li><strong><a href="/rootlock/installation/installation-part1/">Installation Part 1</a></strong> — verify the download, run the installer, and reboot into the Root Lock kernel.</li>
<li><strong><a href="/rootlock/installation/installation-part2/">Installation Part 2</a></strong> — complete initial setup through multiple reboot cycles until the Dashboard confirms it is complete.</li>
<li><strong><a href="/rootlock/verification/">Verifying Installation</a></strong> — confirm initial setup is complete in the Dashboard.</li>
</ol>
<!-- markdownlint-enable MD029 -->

    </div>
  </div>
</div>

</div>


Many hosts still install through Cloud Path or Local Path on each machine. Ansible, Terraform, and GitOps apply allowlist policy after that install — see [Central Policy](../alerts/central-policy-management/).

Once initial setup is complete, Cloud Path and Local Path merge — the Dashboard shows the setup checklist and the Suggested Next Step directs you to begin [allowlisting](../allowlisting/).

---

Section pages:

- [Before You Begin](/rootlock/getting-started/before-you-begin/): System requirements and prerequisites for installing Root Lock by HeartSuite.