CloudLinux is a good product. It is also a forked kernel you pay monthly to run on your own hardware. That is the whole conversation.
When you install CloudLinux, you replace the in-tree AlmaLinux/RHEL kernel with theirs. From that day, every dnf upgrade, every kernel CVE, every security window is gated on their release cadence, not the distro’s. You stopped running AlmaLinux. You started running a single vendor’s kernel and paying rent for the privilege.
tenantd asks a simpler question: what if you got CloudLinux-grade tenant isolation on the stock kernel you already run, and what if the whole thing was free?
What CloudLinux charges for, tenantd gives away
Per-user CPU caps. Per-user memory caps. Process-count and entry-process caps. A per-user filesystem view (CageFS-equivalent). Per-user SSH and cron isolation. Multi-PHP. The MySQL governor. Dedicated per-tenant MariaDB instances. eBPF IO visibility. On CloudLinux those are a licensed bundle on a kernel you rent. On tenantd every one of them is free. Zero dollars, every server, every tenant.
| What you actually want | CloudLinux | tenantd |
|---|---|---|
| Per-tenant CPU / memory / process caps | Licensed (LVE) | Free (cgroup v2) |
| CageFS-style per-tenant filesystem view | Licensed | Free (mount namespace) |
| Per-tenant SSH + cron isolation | Licensed | Free |
| Multi-PHP | Licensed add-on | Free |
| Shared-mysqld per-tenant query/connection governor | Licensed (mysql-governor) | Free |
| Dedicated per-tenant mysqld + eBPF IO visibility | Licensed / not the LVE path | Free |
| License fee | $7-18/server/mo | $0 |
| Forked kernel required | Yes | No |
It is the same kernel primitives. cgroup v2 does natively, in the kernel you already trust, what LVE does through a patch you rent.
Free and closed-source. So what’s the catch?
There is no catch on the price. tenantd is free for every feature, on every server, for every tenant. It is closed-source, maintained by GetPageSpeed, signed, and shipped through the same RPM channel as our nginx modules. It is funded by optional paid support and CloudLinux-migration help that you never have to buy to use any feature. Why give it away? Because a free, stock-kernel CloudLinux replacement is the fastest way to end forked-kernel lock-in across the cPanel ecosystem, and the operators who trust this tool are the operators who buy our other things. We would rather have the install base than a $30 line item.
Let’s talk about the part most vendors hide
Here is the one thing CloudLinux does that tenantd does not, stated plainly: per-thread block-IO throttling on a shared MySQL. CloudLinux patches the kernel to attribute disk IO at the thread level inside one mysqld. cgroup v2’s io controller is domain-only, so on a stock kernel every thread in a mysqld shares one IO budget. We refuse to fork the kernel, so we cannot split it the way they do. That is a real gap and we will not pretend otherwise.
What tenantd does instead, all of it free: the governor kills runaway queries, connection-floods, and lock-storms via performance_schema polling, sub-2s at p99. For the genuine heavy hitter, mysql-promote moves that one tenant onto a dedicated mariadb@tenant instance inside their own cgroup slice, where per-tenant IO enforcement works perfectly because there is exactly one tenant in the process. Plus read-only per-tenant IO visibility via eBPF, so you see the noisy neighbor before the ticket lands.
Honest math: that is roughly 80% of the LVE-Governor outcome – sub-2s noisy-neighbor detection and termination, hard per-user query and connection caps enforced inside MariaDB itself, observability for the rest – without a forked kernel and without a license fee. The remaining 20%, per-thread IO accounting on a shared mysqld, is the deliberate cleanroom tradeoff.
If you run a fleet of shared-mysqld tenants who each need hard per-thread IO caps and you cannot promote any of them, CloudLinux is still your tool. Buy it. We would rather tell you that now than watch you fight it in production for six months. Most cPanel hosts in 2026 are not that shape.
The price is zero. The cost that matters is the kernel.
tenantd is free: $0, every feature, every server, every tenant. CloudLinux is $7 to $18 per server per month for a forked kernel. We are not playing a per-license shell game to look cheaper. We are simply not charging.
But the sticker was never the real cost. CloudLinux’s price is paid again every time a kernel CVE drops and you wait on their rebuild instead of the distro’s, every time your dnf upgrade behaves differently from every other RHEL-rebuild box you run, every time an audit asks “what kernel is this and who ships its patches.” tenantd’s answer to all three is “the same stock kernel as the rest of your fleet, patched by your distro, today.” And it costs nothing, so a hundred low-risk hosts cost you nothing.
Switching takes one command and under two minutes
tenantctl-migrate --dry-run previews the conversion first; tenantctl-migrate apply reads your existing lvectl caps and CageFS layout, generates matching tenantd profiles, enrolls every user, swaps the FPM master, and unmounts CageFS. Target: under two minutes on a ~100-user host, with a sub-30s FPM swap window. --rollback reverses it if anything looks off. Cron and SSH never drop; a handful of in-flight HTTP requests may see a one-shot 5xx during the FPM swap. When it is done, cancel your CloudLinux license and stop paying for a forked kernel.
The pitch in one line
CloudLinux is a kernel you rent. tenantd is isolation you own, on the kernel you already trust, and the whole thing is free. Keep your kernel. Keep your money. Keep the parts that actually protect your tenants.
dnf install tenantd at getpagespeed.com/tenantd
The full honest comparison, including what tenantd does NOT do: getpagespeed.com/tenantd/vs-cloudlinux