
A new way to run Kubernetes: Meet CIQ Stratum Pro
Running Kubernetes usually means assembling about ten components, dreading every upgrade, and switching tools to see more than one cluster. CIQ Stratum Pro puts the whole lifecycle in one binary on…

CIQ Stratum Kubernetes Engine: Kubernetes for the AI Era
CIQ Stratum Kubernetes Engine (SKE) installs, joins, and upgrades Kubernetes from one signed file on Enterprise Linux 9 or later. CIQ Stratum Pro adds fleet management.

CIQ introduces CIQ Stratum Kubernetes Engine, open source Kubernetes for the AI era
One signed file installs and upgrades the cluster, and AI agents work with it within limits the operator sets RENO, Nev., October 29, 2026 \- CIQ, the enterprise software company behind Rocky Linux,…

AI-found CVEs: what PHP2Shell means for your triage
AI turned a parked 2024 PHP bug into remote code execution. Here is what AI-found CVEs change in triage, and why the fix is now the work that counts

Inside the DGX Spark benchmarks for RLC Pro AI
See how we reproduced the DGX Spark community leaderboard on Rocky Linux with CIQ's kernel, and how to rerun it on your own Spark.

One flag took Gemma 4 from 52% to 100% on a Strix Halo
Reasoning off took Gemma 4 from 52% to 100% on short tasks at one-eighth the cost. Plus a prompt change worth 41 points, and models that ignore both

How to stay secure when AI finds vulnerabilities faster
CVE disclosures doubled in 2026 as AI finds bugs faster. What it takes to ship Linux security fixes, what a backport involves, and how to stay secure.

PHP2Shell (CVE-2026-109618, CVE-2026-109619): what it is, how to patch, and what it means for your team
How to patch PHP2Shell (CVE-2026-109618, CVE-2026-109619): fixed PHP streams on RLC Pro, how to check yours, and what to do on streams with no fix.

From Samba to post-quantum cryptography: Jeremy Allison’s open source journey
Meet CIQ Distinguished Engineer Jeremy Allison and explore his journey from Samba to FIPS compliance, open source security, and post-quantum cryptography.

Upgrade, update, or migration? Why getting it wrong wrecks your timeline
A conversion and a rebuild are different projects. Know which one you're planning.

Patch PHP2Shell now and prepare for the next AI-found CVE
Six months ago, I wrote that vulnerabilities were going to come in waves. I undersold it. In April and May, Copy Fail, Dirty Frag, Fragnesia and CIFSwitch hit the Linux kernel. Researchers have kept…

Let an AI agent operate your Kubernetes cluster safely with the CIQ Stratum Pro MCP server
Let an AI agent work on Kubernetes safely: a least-privilege service account, stratum mcp read-only, and write tiers switched on only for the task.
Browse by product
What each product in the CIQ portfolio is for, and the briefs, guides, and portal links that go with it. Expand a product to see the detail.
OS Layer
CIQ's free tier, with variants purpose-built for major hardware ecosystems.
- RLC+ NVIDIA includes the complete NVIDIA AI and networking stack validated and ready out-of-the-box with CUDA Toolkit and DOCA-OFED pre-integrated, eliminating hours of driver setup before a single GPU-accelerated job runs.
- RLC+ AMD, coming soon, delivers AMD Instinct GPU drivers and ROCm support pre-integrated.
When requirements extend to LTS, FIPS validation, production SLOs, and indemnification, that is where RLC Pro begins.
A complete rethinking of what an Enterprise Linux vendor owes its customers. RLC Pro provides direct bug fixes, committed CVE timelines, Long-Term Support, and FIPS 140-3 as an all-inclusive subscription with no inventory tracking. Every enterprise requirement is treated as a baseline, not an add-on: binary compatibility, security, update SLAs, FIPS validation, indemnification, and support from engineers who helped build Rocky Linux.
A security-hardened variant of RLC Pro preconfigured for high-compliance environments. Ships 95%+ DISA STIG and 99% CIS compliant at first boot, no manual configuration required. Active defense is embedded directly in the OS: Linux Kernel Runtime Guard (LKRG) detects exploitation as it occurs, not after. Hardened memory allocator, hardened glibc and OpenSSH, cryptographically signed packages, and an SBOM per image provide layered protection against entire classes of vulnerabilities before they are known or disclosed.
Built with an AI-first mindset from the kernel layer up. The CIQ Linux Kernel (CLK), CUDA Toolkit, and DOCA-OFED ship commercially authorized and pre-integrated: drivers, kernel modules, and runtime dependencies validated together before release. PyTorch and vLLM combinations tested per release. The same validated stack runs identically on bare-metal, AWS, GCP, Azure, and sovereign on-premises infrastructure. Secure Boot, Confidential Computing, and a per-image SBOM included as standard.
A control plane for Enterprise Linux content, lifecycle, and provisioning that runs entirely in your own environment. Mirror content onto storage you own, curate it into signed and versioned content views, pin a known-good release, catch dependency conflicts and CVE exposure before rollout, promote through development, test, and production, and roll back in one move. ELM is available with all RLC Pro subscriptions at no additional cost.
Orchestration Layer
A cloud-native workload orchestration platform for AI and HPC that keeps data, models, and computation on infrastructure you control. Fuzzball unifies model training, fine-tuning, validation, and inference in a single portable workflow: on-premises, in the cloud, or hybrid. Integrates with existing Slurm and PBS Professional deployments.
Kubernetes for the AI era. CIQ Stratum Kubernetes Engine (SKE) installs, joins, upgrades, and snapshots a cluster from one signed binary on Enterprise Linux 9 or later, with a built-in dashboard and a built-in MCP server that lets AI agents work with the cluster within limits you set. CIQ Stratum Pro adds fleet management across every SKE cluster, single sign-on through your identity provider, an app catalog, a CIS profile with a per-control report, and CIQ support.
Enterprise-grade stateless cluster provisioning. Warewulf Pro manages the full lifecycle of bare-metal compute nodes via a web UI. Nodes boot from a known image every time, so configuration drift does not accumulate and new clusters deploy in days rather than weeks.
Enterprise infrastructure automation built on AWX. Ascender Pro delivers workflow orchestration, configuration management, compliance reporting, and drift remediation at fleet scale. CVE dashboards and exportable audit records are generated as a byproduct of normal operations, not a separate staff project.
A commercially supported edition of Apptainer (formerly Singularity), the Linux Foundation open source container runtime for HPC and scientific computing. Apptainer Pro builds on that runtime and adds long-term support releases, preflight checks that validate GPU, driver, and MPI requirements before launch, execution records for every production run, and image delivery management across the cluster. CIQ is now accepting early customers.
Platform Tools
A compatibility bridge enabling organizations to run RHEL-certified software on Rocky Linux without requalification. CIQ Bridge closes the gap between upstream Rocky Linux and certified enterprise software ecosystems, and provides a migration path from CentOS 7.
A searchable catalog of software and hardware verified compatible with CIQ's product portfolio. C3 gives architects and procurement teams a trusted reference for validated integrations, reducing evaluation risk when building on the CIQ stack.
The central hub for CIQ product access. Organizations use the CIQ Portal to manage licenses, download ISOs and installers, access documentation, and evaluate products before purchase, from a developer license to an enterprise trial to full production deployment.
Installation guides, configuration references, and release notes for every CIQ product, including FIPS certification status for RLC Pro. The canonical source engineers reach for once a product is deployed.
Troubleshooting articles, how-tos, and known-issue write-ups from CIQ's support engineers. Searchable answers to the questions customers actually open tickets about.