KernelCare License: Kernel Security Patches Without a Reboot

KernelCare applies security patches to a running Linux kernel while the machine stays up. The usual alternative is to install the new kernel and schedule a reboot — which, on a box hosting hundreds of sites, means a late-night maintenance window, a notice to customers and, more often than anyone likes to admit, a patch that sits unapplied for weeks. All that time the server keeps running a kernel whose flaw is already public. Live patching removes the trade-off: the fix goes into the running kernel in memory, processes are not interrupted, and uptime is not reset. It is aimed at shared hosting firms with hundreds of accounts on one machine, resellers who share a box with their customers, and sysadmins who never find a convenient moment to restart anything.

The license you buy here is registered against your server's IP address rather than a key file you have to download and keep safe. Installation is a single command on the server; the script resolves the license from the IP and brings the agent online. Payment comes out of your prepaid balance with no approval step in between, so the license is usually live within a minute. When you move the server to another machine or another data centre, you change the IP yourself in the panel — no ticket, no waiting — and the license on the old address stops immediately. If you run a fleet, creating, renewing, suspending and re-pointing licenses is all available over the REST API, which is open on every account tier and can be wired into WHMCS or your own system. Monthly licenses run to the end of the paid period and auto-renewal can be switched off whenever you like; there is no contract and no cancellation fee. Every order, renewal and API call is logged to your account with its result.

Patches are built against stock distribution kernels. If you run a custom-built or modified kernel, check `uname -r` before ordering, because the agent will simply find nothing to apply. With container virtualisation such as OpenVZ or LXC the kernel belongs to the host node, so the license goes on the host rather than on each container; KVM, VMware and bare-metal servers each run their own kernel and each need their own license. Userspace patching — keeping components like OpenSSL and glibc current without restarting services — and extended support for distributions past end of life are separate scopes; the catalogue shows which package covers what, at the current price. Finally, reboots do not disappear altogether: major kernel version jumps, hardware and driver changes and some system updates still call for a planned restart. What you gain is not having to postpone a security patch until that day comes around.