# Root Lock by HeartSuite Documentation > Complete guide for installing and configuring Root Lock by HeartSuite. --- LLMS index: [llms.txt](/llms.txt) --- --- *Root Lock by HeartSuite | Humans in Command* --- **Overview**: Every attack does three things: run a program, access files, make a network connection. Root Lock by HeartSuite enforces default-deny on all three at the kernel, per program, including as root. In Lockdown, anything not on the allowlist is blocked before it can act. By design, remote root has no intended path to change the sealed allowlist while the machine is running. Unsealing takes the maintenance kernel from a physical or serial console. [Lockdown](lockdown/) covers activation. [Circumvention and recovery](introduction/how-it-compares/#circumvention-and-recovery) covers residual risk. On a single host, Root Lock supports two setup paths. Cloud Path and Local Path both arrive at the Dashboard after initial setup.
Cloud Path

Pre-installed on AWS, Google Cloud, Azure, DigitalOcean, Linode, and other providers. The Dashboard appears on first login.

Local Path

Manual installation with a guided setup across several reboots.

Many hosts still install through Cloud Path or Local Path on each machine. Ansible, Terraform, and GitOps apply allowlist policy after that install — see [Central Policy](alerts/central-policy-management/). Root Lock fits production servers, regulated workstations, build and CI infrastructure, and AI agent sandboxes. Shared-kernel container guests, local eBPF tooling, and rootless containers are not a fit by design: the kernel omits overlay filesystems, user namespaces, and the BPF syscall because those are the features attackers use to hide, shadow directories, and reach root. See [Deployment Scenarios](introduction/deployment-scenarios/). ## Introduction and concepts - [Introduction and Overview](introduction/) — Overview, setup process, Dashboard guidance, and requirements. - [Deployment Scenarios](introduction/deployment-scenarios/) — Where Root Lock fits best, and where it doesn't. - [How Root Lock Compares](introduction/how-it-compares/) — What Root Lock replaces (Falco, AppArmor, gVisor, EDR on the enforcement dimension), what it complements (SIEM, NDR, VA), and how it can be circumvented. - [Allowlisting Programs](allowlisting/) — How to approve programs and their file and network permissions using the review queues. - [Lockdown](lockdown/) — Setup Mode and Lockdown. ## Get started Start with [Quick Start](getting-started/) — it covers Cloud Path and Local Path and links each step in order: prerequisites, download, install, verify, and allowlist. The pages below are the individual steps, linked from Quick Start: - [Obtaining and Installing Root Lock](installation/) — Download and setup steps (Local Path). - [Verifying Installation](verification/) — Confirm initial setup is complete in the Dashboard. ## Use and manage - [Network and Remote Access](network/) — Configure network permissions. - [Script Launchers](script-launchers/) — Secure interpreted script execution. - [Alert Settings](alerts/) — Set up push notifications for blocks and state changes. - [SIEM and Fleet Integration](alerts/siem-integration/) — Connect to Splunk, Elastic, PagerDuty, and other tools at fleet scale (syslog, webhook, status JSON). - [Central Policy Management and External Control](alerts/central-policy-management/) — Drive allowlist policy from Ansible, Terraform, ServiceNow, GitOps, and custom automation. - [Maintenance](maintenance/) — Protecting during maintenance, file backup and versioning, cache adjustment, kmod file-access narrowing, updating Root Lock, and reprovisioning locked fleets from an updated image. ## Troubleshoot and reference - [Troubleshooting and Logs](troubleshooting/) — Common issues and solutions. - [FAQs](faqs/) — Answers to frequent questions. - [Kernel Security Transparency](security/) — CVE status and Not Affected rationale for the Root Lock kernel. - [Kernel Hardening](kernel-hardening/) — Objective measurements, procurement guidance, and the [Enterprise Adoption Guide](kernel-hardening/enterprise-adoption-guide/) for regulated environments. - [Appendices](appendices/) — List of included tools. ## Subscription and support - [Subscription](licensing/) — Activate your subscription for Lockdown. - For updates or help, email [support@heartsecsuite.com](mailto:support@heartsecsuite.com) or visit [heartsecsuite.com](https://heartsecsuite.com). ## Ready to get started? **Already have a subscription?** Follow the [Quick Start](getting-started/) — the Dashboard guides you from there. **Evaluating?** Cloud instances and the Local Path package are available at [heartsecsuite.com](https://heartsecsuite.com). ## Also in this documentation - [Root Lock Firewall](../firewall/) — Prototype. Inbound and host-path filter for a closed HeartSuite appliance. - [HeartSuite Joint File System (HJFS)](../hjfs/) — Prototype. Per-program file isolation on a standard unmodified kernel. - [HeartSuite Exec](../exec-lock/) — Prototype. HJFS UI for program install, update, and version selection. --- *About this Documentation*: Covers Root Lock v1.6.4. --- Section pages: - [Introduction and Overview](/rootlock/introduction/): Overview of Root Lock by HeartSuite, setup process, and system requirements. - [Getting Started](/rootlock/getting-started/): Choose your setup path and begin installation. - [Obtaining and Installing Root Lock by HeartSuite](/rootlock/installation/): Download and installation steps for Root Lock by HeartSuite. - [Confirm the Root Lock kernel is actually running](/rootlock/verification/): Initial setup checks that you booted the Root Lock kernel and the Dashboard is ready. What complete looks like on cloud and on local. - [Approve what each program may do](/rootlock/allowlisting/): Linux lets any program run, read any file, and connect anywhere. Root Lock requires an allowlist entry for all three — per program, not per user. - [Python should not inherit every script's rights](/rootlock/script-launchers/): If python3 may use the network, every Python script inherits that. Secure Script Launchers give each script its own allowlist entry. - [Each program gets its own internet destinations](/rootlock/network/): Outbound connections are allowlisted per program and per address. Approving a destination for curl does not approve it for wget. - [Alerts when Lockdown blocks something](/rootlock/alerts/): In Lockdown a blocked program fails silently unless you set alerts. Email, syslog, and webhook for denied execution, files, and network. - [Lockdown seals the allowlist, including from root](/rootlock/lockdown/): Setup Mode records; Lockdown blocks and seals. The Dashboard checklist, the YES confirmation, the probe reboot, and how Maintenance unseals from the console. - [A subscription is what turns on Lockdown](/rootlock/licensing/): Lockdown requires an active subscription. What the Dashboard shows, how to place and register the subscription file, and what you can still do without one. - [Every maintenance window is an attack window](/rootlock/maintenance/): Setup Mode logs but stops blocking; the maintenance kernel unloads Root Lock. How to make changes without leaving a hole. - [Blocked, wrong kernel, or silent fail?](/rootlock/troubleshooting/): Most failures are a missing allowlist entry, Setup vs Lockdown, or the maintenance kernel. How to tell which, and how to recover. - [Does this replace EDR? And other FAQs](/rootlock/faqs/): How Root Lock differs from anti-malware, who it is for, AI agents, containers, VM versus metal install, and what happens when something is blocked. - [Kernel Security Transparency](/rootlock/security/): How Root Lock by HeartSuite scores kernel CVEs: absent surface is 0.0, live paths keep a residual. Catalog and disabled-feature groups are child pages. - [A smaller kernel, not a thicker agent](/rootlock/kernel-hardening/): Root Lock compiles out the subsystems attackers use to bypass controls. Buyer briefs, scanner hygiene, distro fit, and measured evidence. - [From 2016 research to kernel default-deny](/rootlock/roadmap/): How program allowlisting, Lockdown, file versioning, and script launchers were designed as one architecture — and what is still ahead. - [Tools shipped with Root Lock](/rootlock/appendices/): CLI tools included with Root Lock by HeartSuite. Which ones the Dashboard runs for you, and which ones you run yourself. - [Compliance questions, answered on one page](/rootlock/compliance-quick-reference/): Direct answers for sales, briefings, and customer GRC preparation, with links to the NIST, ISO 27001, and SOC 2 maps. - [Compliance Reference: NIST CSF & ISO 27001](/rootlock/heartsuite-compliance-nist-iso27001/): How Root Lock by HeartSuite maps to NIST CSF 1.1 and ISO 27001:2022 Annex A controls. - [SOC 2 TSC mapped to Root Lock controls](/rootlock/soc2/): AICPA Trust Services Criteria mapped to Root Lock capabilities — for customers preparing a SOC 2 Type I or Type II audit.