HostRobSecurity at HostRob, and how Sentinel watches Enterprise containers
Isolation keeps a compromised container from reaching yours. Sentinel is there for the other case: noticing quickly when something inside your own container is wrong.
What is HostRob Sentinel?
HostRob Sentinel is a read-only security scanner that inspects every Enterprise container from the host every 15 minutes. New findings are explained in plain language by Claude, Anthropic's AI model, and sent to the HostRob engineer, who decides the response with the customer. Each month every Enterprise customer gets a security report for their containers. Sentinel never stops, deletes or edits anything on its own.
What Sentinel checks every 15 minutes
- Rootkit hooks
- Reads /etc/ld.so.preload inside the container. Any entry there is flagged critical; this is how process-hiding rootkits load.
- Crypto-miners and reverse shells
- Matches running processes against known miner names and reverse-shell patterns.
- Programs running from temp folders
- Flags anything executing from /tmp, /var/tmp or /dev/shm, where droppers usually land.
- New listening ports
- Learns which ports your app normally opens and alerts on any new one.
- SSH keys and cron jobs
- Fingerprints authorized_keys and crontabs; a new key or a new scheduled job is how attackers stay in.
- Dropped executables
- Looks for new executable files in temp folders.
- Web shells
- Every two hours, scans PHP files changed since the last check for web-shell patterns, and flags PHP files appearing in upload folders.
- CPU pinned at the limit
- An hour at the CPU ceiling is often a miner; Sentinel raises it.
- Brute-force pressure
- Counts failed SSH logins on the server every cycle.
From finding to fix
Scan
The host reads the container's processes, ports and files without entering it.
Compare
Results are checked against that container's own learned baseline, so normal app behaviour stays quiet.
Explain
Only new findings go to Claude, which writes how likely it is to be real, the risk, and the next step.
Decide
A HostRob engineer reads the alert and contacts you. Nothing is changed in your container without that decision.
Protection on every plan
- Each app in its own container: separate filesystem, network namespace, users and limits
- All Linux capabilities dropped, a small set added back per stack;
no-new-privilegeson every container - CPU, memory and process caps so a runaway app cannot starve others
- Container SSH only from the IP address registered on your account
- Server SSH by key only; passwords are off
- HMAC-signed requests between the panel and the server agent
- Cloudflare in front of hostrob.com addresses; TLS on every site
- Data stored in Mumbai; nightly backups with an encrypted offsite copy