Skip to install跳到安装
based on the Linux 6.6.129 LTS kernel基于 Linux 6.6.129 LTS 内核

immkernel

immune kernel — immune to rootkits, backdoors, exploits免疫内核 — 抵御 rootkit、后门、漏洞利用

Tired of upgrading systems and running incident response behind every AI-found exploit. Counter AI with immunity, stay ahead of the bugs, stay ahead of the hackers.拒绝苦哈哈的跟在AI挖漏洞后面升级系统和应急响应。以免疫对抗 AI，走在漏洞前面，走在黑客前面。

For适合 lazy sysadmins懒得折腾的运维 change-resistant quant trading systems拒绝变更的量化交易系统 sensitive servers that need immunity from 0-day exploits and rootkit backdoors需要免疫 0day 漏洞和各种 rootkit 后门的敏感服务器 long-running servers长期稳定运行的服务器

one step install · set and forget · relax一键安装、一劳永逸、一把躺平

curl -fsSL https://immkernel.org/immkernel.sh | bash curl -fsSL https://immkernel.org/immkernel_cn.sh | bash

Continuous Validation持续验证

Private validation farm re-tests stock 6.6.129 · lite · pro · enterprise. Public counts only here — licensed detail, short videos, and probes live on the Continuous Validation Matrix.私有验证场持续复测 stock 6.6.129 · lite · pro · enterprise。此处仅公开计数；明细、短视频与探针见持续验证矩阵页（许可证门闩）。

Tracked: 13 CVE/LPE · 2 near-RCE/RCE · 2 backdoor classes · 7 rootkit insertion classes · 7 attacker techniques · App/stack published: 0 (nginx queued for farm repro).追踪：13 CVE/LPE · 2 近 RCE/RCE · 2 后门类 · 7 rootkit 插入类 · 7 攻击者技术类 · 应用栈已发布：0（nginx 排队待农场复现）。

See Continuous Validation Matrix →查看持续验证矩阵 →

Distro compatibility发行版兼容性

Amazon Linux 2 / 2023 Debian 12 / 13 Ubuntu 22.04 / 24.04 LTS Alibaba Cloud Linux 3 TencentOS Server 3 OpenCloudOS 9

App compatibility应用兼容性

WebWeb 服务
nginx · Apache httpd · Caddy · HAProxy · Traefik · lighttpd
Database数据库
MySQL · MariaDB · PostgreSQL · Redis · MongoDB · ClickHouse · Elasticsearch · TiDB
Middleware中间件
Kafka · RabbitMQ · NATS · Pulsar · Memcached · ZooKeeper
Runtime运行时
JVM · Go · Python · Node.js · Rust
Observability可观测性
Prometheus · Grafana · Loki · Jaeger · OpenTelemetry Collector
Security安全工具
JumpServer · Teleport · HashiCorp Vault · Casdoor · Suricata · Zeek · Splunk
Container容器
Docker · Podman · Kubernetes · containerd · runc

Performance性能

immkernel vs stock Ubuntu, Debian, and Amazon Linux 2023 kernels — fio · sysbench · wrk · redis-benchmark · pgbench.immkernel vs Ubuntu、Debian、Amazon Linux 2023 默认内核 — fio · sysbench · wrk · redis-benchmark · pgbench。

Report coming.报告生成中。

Variants版本对比

lite = free kernel path elimination · pro = kernel-only immunity (attack-surface reduction / unprivileged LPE class) — no application/userspace overflow claims · enterprise = kernel story + application vulnerability immunity (userspace exploit hardness) + rootkit/backdoor immunity + fleet · SSO · PAM.lite = 免费内核路径消除 · pro = 仅内核免疫（攻击面削减 / 无特权 LPE 类）— 不宣称应用/用户态溢出免疫 · enterprise（企业版）= 内核能力 + 应用漏洞免疫（用户态利用硬化）+ rootkit/后门免疫 + 舰队 · SSO · PAM。

immkernel-lite immkernel-pro immkernel-enterprise
Pricing定价 Free免费 Paid付费 Premium高价
Kernel CVE path elimination内核 CVE 路径消除 Partial部分 Most绝大部分 Near-complete接近完备
Kernel attack-surface reduction内核攻击面削减 Limited有限 Strong强 Strong强
Rootkit / backdoor immunityrootkit / 后门免疫 — Partial–most部分–大部分 Near-complete接近完备
Application vulnerability immunity (userspace exploit hardness)应用漏洞免疫（用户态利用硬化） — — ✓
Centralized fleet management · SSO · PAM集中舰队管理 · SSO · PAM — — ✓
Docker / eBPF supportDocker / eBPF 支持 ✓ — —
Release发布状态 Released已发布 Unreleased未发布 On roadmap规划中

FAQ

Did you modify the kernel source code?你修改了内核代码吗？
For released lite: no. Pure upstream Linux 6.6.129 — immunity comes from configuration. Higher tiers may add further hardening; enterprise adds userspace exploit hardness for application vulnerabilities.已发布的 lite：没有。基于纯净的 6.6.129，免疫来自配置。更高档可能叠加额外加固；enterprise（企业版）增加面向应用漏洞的用户态利用硬化。
Are there known CVEs in this kernel version?这个内核版本有漏洞吗？
Yes — the code paths for copy.fail and dirtyfrag are still present, but the kernel is already immune. We deliberately stay on this version. Try to exploit it.有。copy.fail 和 dirtyfrag 漏洞相关代码都在，但已经免疫了。我们故意不用最新版本，大家可以打打看。
Do apps need configuration changes after install?装完之后应用要改配置吗？
The default immkernel-lite needs no changes. immkernel-pro will require some tuning, but it isn't released yet — nothing to worry about, just run the one-click install.默认的 immkernel-lite 不需要改，pro 需要一些微调，但还没放出来，所以不必担心，一键安装就是了。
How do I roll this out without causing trouble?怎么用这个内核不捅娄子？
Phased rollout, always. Test environments first, production second. Edge services before core ones. Move with intent, not in haste.务必记得灰度部署。先在测试环境部署，再到正式环境部署；先在边缘业务部署，再到核心业务部署。目标清晰但不着急不冒进。
A service won't start. What do I do?我有服务跑不起来怎么办？
First, paste the error log into an AI assistant for triage. If you're still stuck, email me — but include the actual error message and a description of what you're trying to do, or I can't help either.先把错误信息给 AI 帮你分析一下。如果还搞不定，发邮件给我，我帮你看看，但务必带上完整错误信息和描述，否则我也爱莫能助。
Does it immunize against every CVE and rootkit backdoor?能免疫所有漏洞和 rootkit 后门吗？
No. pro immunizes kernel vulnerabilities only (path elimination + attack-surface / unprivileged LPE class mitigation) — it does not claim application or userspace overflow immunity. lite is a free subset of that kernel path-elimination story. enterprise keeps the kernel story and adds application vulnerability immunity (userspace exploit hardness), plus near-complete rootkit/backdoor immunity.不能。pro 只免疫内核漏洞（路径消除 + 攻击面 / 无特权 LPE 类缓解）— 不宣称应用或用户态溢出免疫。lite 是该内核路径消除故事的免费子集。enterprise（企业版）保留内核能力，并增加应用漏洞免疫（用户态利用硬化），以及接近完备的 rootkit/后门免疫。
Will you publish a list of the rootkits and backdoors it's immune to?免疫的 rootkit 和后门会给清单吗？
Publicly we publish counts and insertion-class framework names (see /validation). Sample-level results and videos are enterprise-license only.公开只公布数量与插入类框架名（见 /validation）。样本级结果与视频仅 enterprise（企业版）许可证可见。
Is immkernel free? Do you take money?immkernel 免费吗？收不收钱？
Freemium. lite is free forever (one-click install). pro and enterprise are paid. Continuous Validation detail is on /validation and gated by license.Freemium。lite 永久免费（一键安装）。pro 与 enterprise（企业版）付费。除免费 lite 明细表外，持续验证明细见 /validation，按许可证门闩。
What does enterprise add beyond rootkit immunity?enterprise（企业版）在 rootkit 免疫之外还提供什么？
Beyond the kernel story, enterprise adds application vulnerability immunity — userspace exploit hardness so overflows in apps (e.g. nginx) are far harder to turn into reliable RCE — plus near-complete rootkit/backdoor immunity and centralized fleet management with SSO and PAM.在内核能力之外，enterprise（企业版）增加应用漏洞免疫——用户态利用硬化，使应用溢出（如 nginx）更难打成稳定 RCE——以及接近完备的 rootkit/后门免疫，并提供集中舰队管理与 SSO / PAM。
Does pro immunize application overflows (e.g. nginx)?pro 能免疫应用溢出（如 nginx）吗？
No. pro is kernel-only. Application / userspace overflow immunity is an enterprise capability; the App/stack Continuous Validation lane on /validation is framed as enterprise-tier userspace validation.不能。pro 是仅内核。应用 / 用户态溢出免疫属于 enterprise（企业版）；/validation 上的应用栈持续验证通道按 enterprise 档用户态验证来写。
How do I combine immkernel with other security tools?组合拳怎么打？
Pair immkernel with an EDR/HIDS for genuine 1+1>2 synergy. Because the kernel has shut down most of the routes attackers use to take over a system, your security tooling sees a cleaner picture — fewer rootkit-induced blind spots, more authentic signal.在 immkernel 安全免疫内核的保护下结合 EDR/HIDS，让我们占据更有利的位置，1+1>2。因为内核堵住了黑客成为系统主宰的好些路子，安全工具的结果更可靠、更真实。
Will you publish the kernel config?会公开内核配置文件吗？
No. If you're worried about security, the kernel source is already public — have an AI download and analyze it for you. Whether what's in here counts as novel is for you to judge. But this thing was built on my late nights, distilling 20+ years of hands-on Linux offensive and defensive security work. In the AI era CVEs land faster and exploits land faster still, so I'm releasing this as my contribution back to the open-source community, with no plans to monetize. If you have the skills and the time, you can absolutely build your own. I'm just not making it easy for the rebrand-and-claim crowd.不会。如果你担心安全问题，内核代码本来就是公开的，你可以让 AI 下载研究。有没技术含量见仁见智——但这玩意是我熬夜搞出来的，也承载了我在 Linux 安全攻防 20 多年的实战经验。AI 时代漏洞只会越出越多，exploit 越出越快，作为对开源社区的反哺发出来，也不打算盈利。你有能力和时间的话，我相信你也可以；但我不惯着谣谣领先和自主可控们。
Will you keep maintaining and iterating?会继续维护和迭代吗？
Yes, but mostly on compatibility and stability. The kernel version stays locked at 6.6.129 unless an LPE breaks immunity or a stability / compatibility issue forces a bump. The whole point is no upgrades, no churn — never go looking for trouble.会，但更多是在兼容性和稳定性上迭代。如果这个内核被 LPE 漏洞打掉了，或者出现稳定性/兼容性问题，会升级；否则版本就锁定在 6.6.129。因为我们的核心目标就是不升级不折腾，没事绝对不自己找事。
Is the install process safe? What about supply-chain risk?安装过程安全吗？有供应链风险吗？
GPG signatures and SHA256 checksums are verified end-to-end. I keep the install chain as simple as I can. Because no kernel source has been modified, there is no contributor pipeline to compromise — poisoning the supply chain is materially harder than for projects shipping custom code.装的时候有 GPG 签名和 SHA256 校验，我会尽量让整个过程简单又安全。因为没有改任何内核代码，所以也没有代码贡献者通道，投毒不那么容易。
My boss is worried immkernel might have a backdoor. What now?老板担心 immkernel 有后门怎么办？
Up to you. If you're a tier-one player, just have an AI study the source — I've revealed most of the thinking, kept a bit hidden, but nothing stops you from rolling your own. If you're not tier-one, AND you worry about immkernel's security, AND you think CVE exposure would hurt you, AND you don't want to patch CVEs yourself, AND you want it all for free — mate, that takes money. But I don't take money and I don't accept donations either. So figure it out yourself.看你自己选。如果你是头部玩家，让 AI 研究就好——思想我已经透露了一部分，虽然还藏了一点，这也不妨碍你自己搞一套。如果你不是头部玩家，又担心 immkernel 的安全问题，又觉得漏洞对你影响大，又不想自己修漏洞，这既要又要还要更要的逻辑——老铁，得掏钱。但我不要钱也不接受任何形式的捐赠，所以自己想办法吧。