Hosting Stack: cPanel & CloudLinux
CloudLinux CageFS Isolation
CageFS wraps every hosting account in its own virtualized filesystem, so users see only their files and a safe system façade, never neighbors' data, config files, or attack tools left in /tmp. On shared servers it converts cross-account snooping and local privilege escalation from routine threats into edge cases.
Key points
- Enable CageFS by default on every new account, opt-out isolation always drifts.
- Verify isolation with cagefsctl tests that attempt cross-account reads.
- Keep CageFS updated alongside the kernel; version skew breaks the veil silently.
- Combine with per-account PHP versions so legacy apps can't poison shared binaries.
- Monitor CageFS fault logs, repeated violations often signal compromised accounts probing.
- Exclude nothing from the cage without documented reason and expiry date.
- Pair with LVE limits: isolation plus resource caps is the complete containment story.
- Audit /tmp and /var/tmp handling, CageFS virtualizes these per user for good reason.
Field note
Enable it by default on every new account and never look back. Opt-in isolation always drifts toward off, and the drift is discovered during incidents, never before.
Frequently asked questions
Does CageFS slow down sites?
Negligibly, the virtualization overhead is tiny next to the noisy-neighbor protection it enables.
Can users still see system files?
Only a sanitized façade: their own binaries and safe configs, never real system or neighbor data.
Does it replace malware scanning?
No, it contains outbreaks; scanning still finds and cleans them.
What breaks under CageFS?
Poorly written scripts with hardcoded system paths, fixed once, correctly, during onboarding.
How Kinetikatech helps with hosting stack: cpanel & cloudlinux
Here's the deal: Operator-level guides for the stack we run daily, CloudLinux isolation, cPanel/WHM administration, Exim forensics, and LiteSpeed tuning. Hand it to our Server Management and Linux Server Security service and it's covered, assessed properly, implemented cleanly, monitored around the clock.