On shared hosting, many customers live on one server. CageFS is the CloudLinux feature that puts each cPanel account in its own virtual file system, so no account can see other users, their files or sensitive server files. It runs on every MdmHost server and you do not need to set anything up.
Before you start
Nothing is needed to use CageFS. To look around inside it you need SSH or Terminal access in cPanel (cPanel → Advanced → Terminal), if your package includes it.
What CageFS does
- Hides other users. You see only your own home directory. Other accounts and their processes are invisible.
- Hides sensitive files. Server configuration and password files are replaced with safe versions.
- Limits tools. Only a safe set of commands is available in the shell.
- Makes PHP Selector work. Each account's chosen PHP version and extensions are mounted inside its own cage.
Why it matters
If one customer's WordPress site is hacked, the attacker is trapped inside that account's cage. They cannot read other customers' wp-config.php files, list usernames or use server tools to attack neighbours. Combined with LVE resource limits and Imunify360 (see Imunify360 overview), it is a big part of what makes shared hosting safe.
What you notice over SSH
| Command | Inside CageFS |
|---|---|
ls /home | Shows only your own directory |
ps aux | Shows only your processes |
cat /etc/passwd | Lists only your user and system users |
php -v | Shows the version chosen in Select PHP Version |
git, composer, wp, node | Usually available |
Common questions in practice
Why does the command-line PHP differ from the website's?
It should not, inside CageFS: the command-line php follows your selector choice. If you see a different version, call the exact binary, for example /opt/alt/php82/usr/bin/php, and check MultiPHP settings (see PHP Selector vs MultiPHP).
A tool is missing
Not every Linux tool is available inside the cage. Ask support whether it can be added; many common tools can.
A cron job cannot find a command
Cron jobs run inside CageFS too. Use full paths, for example /usr/local/bin/php or the alt-php path above.
Note: CageFS cannot be turned off for individual accounts by customers. It is a server security setting maintained by MdmHost.
For resellers
CageFS applies automatically to every account you create in WHM. You do not need to enable it per package. If a customer reports "permission denied" errors when reading files outside their home directory, that is CageFS working as intended.
Frequently asked questions
Does CageFS slow my website down?
No. It isolates file system views without adding noticeable overhead to web requests.
Can I share files between two of my accounts?
Not directly; each account is caged. Use FTP, a download link or Git to move files between accounts.
Is CageFS the same as a VPS?
No. It isolates accounts on a shared server, but you still share the server's CPU and memory under CloudLinux limits. A VPS gives you a whole operating system.
Does CageFS protect against malware?
It limits what malware can reach, but it does not remove it. Imunify360 scans and cleans files; CageFS keeps an infection contained to one account.