Feature Manager toggle needed for "AI App Hosting" – requires user namespaces, conflicts with kernel hardening

nickgr67

• October 23, 2026 15:04
• Edited

Hi all,

The new Meridian theme adds an "AI App Hosting" option to the "How do you want to build?" wizard ("Deploy Node.js apps from Git or a file", "Publish in minutes, with MCP"). This feature relies on Podman, so it needs user.max_user_namespaces to be greater than 0.

That is a problem for us, and probably for many other shared hosting providers.

Over the past months there has been a steady stream of Linux kernel LPE vulnerabilities that depend on unprivileged user namespaces. Recent examples include GhostLock (CVE-2026-43499) and the nf_tables LPE CVE-2026-23111. For several of these, the standard interim mitigation until a patched kernel or livepatch is available has been:

sysctl -w user.max_user_namespaces=0

We have this set across our entire cPanel fleet (CloudLinux 8/9/10), and we are not going to re-enable it. On a multi-tenant shared hosting server, unprivileged user namespaces greatly expand the kernel attack surface available to every account on the box. We won't make that trade-off for a single feature, particularly when the CloudLinux Node.js Selector already gives our customers Node.js hosting without needing user namespaces.

The problem: there is currently no way to turn this feature off. If we roll out the new theme, customers will see "AI App Hosting" in the wizard, choose it, and it will fail. We end up with support tickets for a feature we can't and won't support, and the customer has a bad experience.

The request: please add an "AI App Hosting" entry to the Feature Manager, so it can be disabled per feature list (and therefore per package) like any other cPanel feature. When it's disabled, the option should not appear in the "How do you want to build?" wizard or anywhere else in the UI.

If there is an interim workaround, such as a feature key we can set manually in the feature list files, we'd appreciate hearing about it.

Environment: cPanel & WHM , CloudLinux 8/9/10 on AlmaLinux, user.max_user_namespaces=0 fleet-wide.

Thanks,

Nick

• 

  cPRex Jurassic Moderator

  • October 23, 2026 16:57

  Hey there!  I'm having the team review this and I'll let you know once I know more!

  0
• 

  cPRex Jurassic Moderator

  • October 23, 2026 19:46

  It looks like this is the "Web Apps" feature in Feature Manager, so it actually can be disabled but it's not an intuitive name for this tool.  The team is likely going to rename that in a future release.

  I'm still looking to get more details on the namespaces situation but I likely am not going to have much on that until next week.

  0
• 

  nickgr

  • October 24, 2026 15:27

   

  Thanks cPRex, I can confirm that disabling "Web Apps" in the Feature Manager removes the option, so that covers our immediate need. Renaming it to match what users see in the UI would help other admins find it much faster.

  On the namespaces side, please make sure the team takes this into account. Kernel exploits that rely on unprivileged user namespaces keep appearing at the current pace, and I don't see any responsible sysadmin running multi-tenant shared hosting turning user.max_user_namespaces back on just to make this feature work.  CloudLinux status page is full of kernel exploit mitigations that recommend setting user.max_user_namespaces=0. 

  Looking forward to whatever details you can share next week.

  Nick

  0
• 

  cPRex Jurassic Moderator

  • October 26, 2026 15:59

  Minor update - we've created case CPANEL-58096 to rename Web Apps to "AI App Hosting" so it's easier to find and more intuitive in the feature manager list.

  0

Please sign in to leave a comment.