# Obtaining and Installing Root Lock by HeartSuite

> Download and installation steps for Root Lock by HeartSuite.

---

LLMS index: [llms.txt](/llms.txt)

---

**Overview**: On a single host, Root Lock by HeartSuite installation follows Cloud Path or Local Path. Both end at the Dashboard after initial setup confirms that the machine is ready for allowlisting. On Local Path, finish the OS and the services this host will run before you install.

## Finish the OS first

On Local Path, complete distribution updates and install the packages and services this host will actually run. Then run the installer. During initial setup, Root Lock records startup and shutdown programs from those boots. Package-install helpers, compilers, and one-shot probes that execute in that window become allowlist entries even if they never execute again.

On Cloud Path, Root Lock already finished initial setup during image preparation. First-boot leftovers can still appear in the queues — dismiss them if they are not runtime. Details are in [Installation Part 2](installation-part2/).

## Choose your path

<div class="row g-4 mb-4 hs-choice-pane">
<div class="col-md-6 d-flex">
  <div class="card h-100 w-100 hs-choice-card">
    <div class="card-header">Cloud Path</div>
    <div class="card-body">
      
      <p>Launch a pre-configured cloud instance (AWS, Google Cloud, Azure, DigitalOcean, Linode, and other providers). The Dashboard confirms initial setup is complete on first boot — skip ahead to the allowlisting queues. First-boot leftovers (cloud-init, provisioning helpers) can still appear there; do not approve them if they are not runtime.</p>
<p>Installer and initial setup logs from the image build are in <code>/var/log/heartsuite/</code>. Use the provider serial console if you need them.</p>

    </div>
  </div>
</div>

<div class="col-md-6 d-flex">
  <div class="card h-100 w-100 hs-choice-card">
    <div class="card-header">Local Path</div>
    <div class="card-body">
      
      <p>Finish distribution updates and install the packages and services this host will actually run, then run a single install command on bare metal or a full virtual machine with hardware virtualization. Reboot multiple times to build the initial allowlist of startup and shutdown programs. Nesting a second guest without <code>/dev/kvm</code> causes the installer to stop at the start. See <a href="/rootlock/introduction/system-requirements/#bare-metal-virtual-machines-and-nested-vms">Bare metal, virtual machines, and nested VMs</a>.</p>
<ol>
<li><a href="/rootlock/installation/obtaining-heartsuite/">Obtaining Root Lock</a> — Run the install command.</li>
<li><a href="/rootlock/installation/installation-part1/">Installation Part 1</a> — Run the installer and reboot to load the kernel.</li>
<li><a href="/rootlock/installation/installation-part2/">Installation Part 2</a> — Complete the initial setup steps to allowlist startup and shutdown programs.</li>
</ol>
<p>After the final reboot cycle, the Dashboard appears and displays the Suggested Next Step to guide you into allowlisting. On failure or for forensics, use the serial console to <code>cat /var/log/heartsuite/install.log</code>.</p>

    </div>
  </div>
</div>

</div>


Many hosts still install through Cloud Path or Local Path on each machine. Ansible installs by running the Local Path installer or launching a Cloud Path image, then applying policy — see [Central Policy](../alerts/central-policy-management/).

When initial setup is complete, continue to [Verifying Installation](../verification/).

---

Section pages:

- [Obtaining Root Lock by HeartSuite](/rootlock/installation/obtaining-heartsuite/): Install Root Lock by HeartSuite with a single command.
- [Installing Root Lock by HeartSuite – Part 1](/rootlock/installation/installation-part1/): Install the Root Lock by HeartSuite kernel and boot into it for the first time.
- [Installing Root Lock by HeartSuite – Part 2](/rootlock/installation/installation-part2/): Root Lock by HeartSuite builds the initial allowlist automatically after the first boot. The Dashboard appears when setup is complete.