Obtaining and Installing Root Lock by HeartSuite
Download and installation steps for Root Lock by HeartSuite.
Overview: Root Lock by HeartSuite installation follows one of two paths depending on your deployment method. Both paths end at the Dashboard, where Phase 1 (System Verification) confirms that the machine is ready for allowlisting.
Cloud Path
Launch a pre-configured cloud instance (e.g., AWS AMI, GCP image). The Root Lock by HeartSuite kernel is already installed and the Dashboard confirms Phase 1 is complete on first boot and appears immediately — skip ahead to the allowlisting queues.
Local Path
Run a single install command, then reboot multiple times to build the initial allowlist of startup and shutdown programs. This path involves:
- Obtaining Root Lock by HeartSuite — Run the install command.
- Installation Part 1 — Run the installer and reboot to load the kernel.
- Installation Part 2 — Complete the System Setup steps to allowlist startup and shutdown programs.
After the final reboot cycle, the Dashboard appears and displays the Suggested Next Step to guide you into Phase 2 (Program Allowlisting).
1 - Obtaining Root Lock by HeartSuite
Install Root Lock by HeartSuite with a single command.
Overview: Install Root Lock by HeartSuite with a single command.
Note
Cloud users who launched a pre-configured instance (AWS AMI, GCP image) already have Root Lock by HeartSuite installed. Skip this step and proceed directly to the Dashboard.
Run the following command on the target system:
curl -fsSL https://get.heartsecsuite.com/get-heartsuite.sh | sudo sh
The script downloads and installs the Root Lock by HeartSuite kernel, tools, and Dashboard, then reboots automatically. Proceed to Installation Part 1 after the reboot.
2 - Installing Root Lock by HeartSuite – Part 1
Install the Root Lock by HeartSuite kernel and boot into it for the first time.
Overview: After running the install command, the machine reboots into the Root Lock by HeartSuite kernel.
Note
Cloud users skip this step entirely. The Root Lock by HeartSuite kernel is pre-installed and on first boot the Dashboard confirms Phase 1 is complete. The Dashboard appears automatically on first boot.
Reboot into the Root Lock by HeartSuite kernel
The installer sets the Root Lock by HeartSuite kernel as the default boot target and reboots automatically. A 5-second countdown appears — press Ctrl+C to cancel if you need to inspect logs before rebooting.
After reboot, Root Lock by HeartSuite reads the startup and shutdown logs and adds those programs to the allowlist automatically. Continue with Installation Part 2.
Note
If you are connected over SSH, your session drops when the reboot fires — this is expected. Reconnect after the system comes back. While setup is running, each SSH login shows a brief status line and drops you at a regular shell; the Dashboard appears once setup is complete. The serial console (virsh console, AWS/Azure/GCP serial console, IPMI SOL) shows the current setup step on every boot.
Note
If an amber warning appears instead of the countdown, the installer could not set the GRUB default automatically. This occurs on Alpine Linux or when the GRUB configuration is missing. The warning includes instructions for opening a console session on your cloud provider (AWS, Azure, GCP, or DigitalOcean) or local VM before rebooting — then select the Root Lock by HeartSuite kernel from the GRUB menu manually.
If the system does not boot into HeartSuite
If the machine boots to the wrong kernel or hangs:
- Verify the installer completed without errors before the reboot fired.
- Reboot and select the Root Lock by HeartSuite kernel from the GRUB menu manually.
If the issue persists, contact HeartSuite support — we’re happy to help.
3 - Installing Root Lock by HeartSuite – Part 2
Root Lock by HeartSuite builds the initial allowlist automatically after the first boot. The Dashboard appears when setup is complete.
Overview: No commands are needed after the first boot into the Root Lock by HeartSuite kernel. Root Lock by HeartSuite reads the startup and shutdown logs and adds the programs it finds to the allowlist — the Dashboard appears when this is complete and directs you into Phase 2 (Program Allowlisting).
Note
Cloud users skip this step. On a pre-configured cloud instance, the Dashboard confirms Phase 1 (System Verification) is complete on first boot.
What happens after the first boot
Root Lock by HeartSuite reads the startup and shutdown logs, adds the programs it finds to the allowlist, and reboots. This repeats until no new programs are found — typically three to five passes, depending on the distribution.
While setup is running, you will see:
Over SSH: each time you reconnect, the login shows a brief status line and drops you at a regular shell — no action needed:
HeartSuite Phase 1 is running — step N of unknown total.
The system reboots automatically. Reconnect in a few minutes.
On the serial console (virsh console, AWS/Azure/GCP serial console, IPMI SOL): attach and press Enter — the console autologs in and shows the current step. No action needed.
The first time you connect and the Dashboard appears, setup is complete. The Dashboard shows the reboot history and the Suggested Next Step directs you into Phase 2 (Program Allowlisting).
If the Dashboard does not appear
If setup is still running, SSH reconnects show the status line above instead of the Dashboard. Wait a few minutes and reconnect.
If repeated reconnects still show the status line rather than the Dashboard:
Open the serial console (virsh console <vm> for KVM, AWS/Azure/GCP serial console, IPMI SOL) and press Enter to see the current step. If it has not advanced across reboots, run journalctl -u heartsuite-phase1 to see the setup output.
Verify the Root Lock by HeartSuite kernel is loaded:
Expected output ends in HeartSuite (for example, 6.18.9-HeartSuite-1.0).
If the wrong kernel booted, reboot and select the Root Lock by HeartSuite kernel from the GRUB menu manually.
If setup stops with an error
If something goes wrong during setup, the next login shows an error with the reason and the last output from the setup process.
Two options are available:
[r] Retry — restarts the setup from where it stopped.[q] Open shell — drops you to a shell to investigate before retrying.
Warning
The boot setup must complete before you activate Lockdown. If the initial allowlist is incomplete, the system may hang on boot or shutdown after activating Lockdown.
When the Dashboard appears and Phase 1 is confirmed, continue to Verifying Installation.