A server without direct Internet access can receive KernelCare patches through a suitable architecture. It still needs an accessible patch source, appropriate licensing and a maintained update process. Network isolation does not supply new patches by itself.
This guide helps server and infrastructure owners plan that arrangement. If you use a shared hosting account, ask your provider to check the situation rather than trying to install an agent or change the network.
Choose the delivery path
- Controlled outbound access: a server can reach the necessary services through an approved gateway or proxy. A private address does not necessarily mean that Internet access is unavailable.
- Internal distribution: ePortal centralizes patches for machines that can reach it on the private network. External access can be concentrated on that infrastructure.
- Fully disconnected environment: plan a controlled transfer of patches obtained from an authorized source. An existing cache cannot provide patches that have not yet been obtained.
The official ePortal documentation describes distribution and patch import. Its cache mode retrieves some content on demand, so it is not, by itself, a self-contained solution for a completely disconnected network.
Confirm prerequisites before deployment
- Compatibility: identify the distribution, architecture and running kernel. Confirm coverage for that combination; the distribution name alone is insufficient.
- Licensing: confirm KernelCare entitlements, ePortal access, covered products and server quantities. The TuxCare subscription portal distinguishes licenses and activation keys. Do not assume that one IP-based license covers several machines behind the same gateway.
- Operations: assign responsibility for obtaining patches, checking their provenance, transferring them, approving distribution and handling failures.
- Continuity: plan storage, monitoring, management-system backups and recovery. Document responsibility for handling an outage.
Track patches through to the servers
A downloaded file or a machine appearing in a console does not establish that a patch is applied. For each affected kernel, check patch availability, approval in the intended feed, application and the freshness of the last check. A staged rollout needs an owner and criteria for moving from validation to production.
Keep the agent and ePortal on compatible versions as well. TuxCare has introduced a signed patch format requiring compatible components. Do not bypass signature verification to import an archive.
Understand live patching’s limits
KernelCare handles available patches for supported kernels. It does not replace PHP, application and plugin updates or backups. New kernel features and some changes still require conventional maintenance. TuxCare explains that reboots can remain necessary. Other live patching products have their own coverage and licensing requirements.
For communication problems, see our KernelCare connectivity guide. To assess a private architecture or clarify management of your service, contact Nuagerie with your constraints and intended outcome. Do not send license keys or proxy credentials.
