Which systems are supported, and what about cPanel?

Shelltrap is built for CyberPanel hosts and runs on the distribution you already have. No operating system conversion is required.

Operating systems

• Ubuntu 20.04, 22.04 and 24.04
• AlmaLinux, RockyLinux and RHEL 8, 9 and 10
• CloudLinux 8
• CentOS 9

With OpenLiteSpeed or LiteSpeed Enterprise. Debian is only third-party supported by CyberPanel itself, so we do not promise it either.

What the host actually needs

• Root access, or a package service account with full installation rights. The broker runs as root; the worker runs as shelltrap-scan, a system user with no login shell and no home directory.
• A Linux filesystem under the configured customer roots (/home by default) and a kernel on which the installer can genuinely probe the fanotify and file-handle capabilities.
• For the Full profile: a running or installable clamd with a socket reachable by shelltrap-scan, and at least 1.5 GiB of MemAvailable remaining after the measured reload reserve. Otherwise the host runs the Lite profile with lower coverage, and that is recorded rather than hidden.
• For the PHP upload adapter: a supported lsphp/LSWS installation. The adapter needs only the local socket /run/shelltrap/upload.sock.

The installer probes the running host rather than trusting a kernel version. Watcher tiers run from A (fanotify with file handles, full coverage) through B (fanotify without file handles, so renames arrive with a delay) and C (no CAP_SYS_ADMIN: budgeted inotify plus a checkpointing crawler, detection delayed and stated as such) to D (no usable backend, no installation).

CyberPanel

CyberPanel is fully supported: the scanner, the local API, the CLI, alerts and the CyberPanel plugin with its roles for administrators, resellers and customers. The plugin ships a repair path for the case where a CyberPanel upgrade rewrites the core files it patched.

cPanel

cPanel support arrives with version 0.3.0 as a beta. It is implemented against the cPanel file format, without a WHM plugin. CLI, API and alerts are available on cPanel hosts; the panel-integrated user interface is the CyberPanel one only.

That is the whole claim, and we would rather state it narrowly than have you discover the boundary in production. If you run cPanel and want to try the beta when it lands, tell us and we will let you know.

Do I have to switch to CloudLinux?

No. Not needing an operating system conversion is one of the reasons Shelltrap exists. It runs on stock Ubuntu and stock AlmaLinux, and CloudLinux 8 is supported as one of several options rather than as a requirement.

What it will not do

Shelltrap is not a WAF, not a firewall and not a desktop antivirus, and it cannot help against an attacker who already has root on the machine. Blocking a file open at the kernel level is prototyped for a later 1.x release and is deliberately not promised today.