Overview
Zwall overview
Purpose
Zwall is a self-hosted security and observability platform for Linux hosting and virtualized infrastructure.
A Manager you operate holds policy, identity, and events. Agents on Linux hosts either:
- observe a hosting node (Hosting Agent, Enterprise), or
- enforce packet policy on a virtualization host (Virtualization Agent).
The customer protocol to the Manager is HTTP/REST. The operator API is /api/v1. The web console is a React application served by the Manager. zwallctl is the CLI.
Audience
Hosting providers, VPS and cloud operators, service providers, platform operators, and infrastructure security teams.
Architecture context
Operator browser / zwallctl
|
| HTTPS REST /api/v1
v
Manager + PostgreSQL + console
|
| Agent registration, heartbeat, sync, event upload
v
Agent on a Linux host
|
+-- Hosting: pass-only observation programs + log collectors
+-- Virtualization: XDP ingress / TC egress firewall programsSupported scope
Zwall is not:
- a Zwall-operated SaaS scrubbing network
- a certified compliance product
- an autonomous AI SOC
- a Kubernetes mesh sidecar
- a substitute for a host firewall you never inspect
Edition applicability
Scroll sideways to see the full table. Use the arrow keys when focused.
| Capability | Community | Enterprise |
|---|---|---|
| Manager, Agent runtime, console, REST API, zwallctl | Shared | Shared |
| Virtualization / KVM-libvirt visibility and enforcement paths | Shared | Shared |
| Hosting Agent observation profile | Not supported | Enterprise |
| AI Preview | Not supported | Preview |
| Signed-release admission | Not supported | Enterprise |
| Hard 3-Agent limit | SUPPORTED | Licensed (not the Community hard limit) |