Free, open-source kernel builder as a service. Pick an upstream Linux kernel, toggle the options you need on top of a stock config (or upload your own), and download bzImage, vmlinux and the .config.
Builds run on Cloudflare Containers through kernelbuild-buildkit, an open-source BuildKit LLB frontend that fetches, configures, compiles and packs the kernel: usable standalone with a stock docker build, with a shared per-version object cache here so an identical spec returns the existing artifact instantly.
"Compiled successfully" isn't "boots": every kernel is boot-tested under Firecracker on /dev/kvm before it's handed back (aarch64 is cross-compiled and boot-tested under emulated QEMU); the result tells you whether it actually reached userspace.
| version | channel | released | what changed | |
|---|---|---|---|---|
| mainline | 2026-10-18 | announcement · series | ||
| stable | 2026-10-15 | changelog · series | ||
| longterm | 2026-10-15 | changelog · series | ||
| longterm | 2026-10-15 | changelog · series | ||
| longterm | 2026-10-15 | changelog · series | ||
| longterm | 2026-10-15 | changelog · series | ||
| longterm | 2026-10-15 | changelog · series | ||
| longterm | 2026-10-15 | changelog · series | ||
"default" keeps the base config's value (shown on the right once the base is resolved). "on"/"off" run scripts/config --enable/--disable followed by make olddefconfig; anything that can't be applied fails the job at the configure step, before compiling.
| setting | option | what it is | needs | default |
|---|---|---|---|---|
USER_NS | User namespaces (rootless containers, bwrap, gVisor) | |
off | |
NET_NS | Network namespaces | |
on | |
PID_NS | PID namespaces | |
on | |
SECCOMP | seccomp | |
on | |
SECCOMP_FILTER | seccomp-bpf syscall filtering | SECCOMP |
on | |
SECURITY_LANDLOCK | Landlock unprivileged sandboxing LSM | |
off | |
SECURITY_APPARMOR | AppArmor LSM | |
off | |
SECURITY_SELINUX | SELinux LSM | SECURITY_NETWORK, AUDIT |
on | |
SECURITY_YAMA | Yama ptrace scope restrictions | |
off | |
CHECKPOINT_RESTORE | CRIU checkpoint/restore support | |
off | |
KEYS | Kernel keyring | |
on | |
AUDIT | Audit subsystem | |
on |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
CGROUPS | Control groups | |
on | |
MEMCG | Memory cgroup | CGROUPS |
off | |
CGROUP_PIDS | PID cgroup | CGROUPS |
on | |
CGROUP_CPUACCT | CPU accounting cgroup | CGROUPS |
on | |
CFS_BANDWIDTH | CPU bandwidth limits (cpu.max) | CGROUPS |
off | |
BLK_CGROUP | Block I/O cgroup | CGROUPS |
on | |
CGROUP_BPF | cgroup-attached BPF programs | BPF_SYSCALL, CGROUPS |
off | |
CGROUP_FREEZER | cgroup freezer | CGROUPS |
on | |
PSI | Pressure stall information | |
off |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
BPF_SYSCALL | bpf() syscall (eBPF programs/maps) | |
off | |
BPF_JIT | eBPF JIT compiler | BPF_SYSCALL |
off | |
BPF_LSM | BPF LSM hooks | BPF_SYSCALL |
off | |
BPF_UNPRIV_DEFAULT_OFF | Disable unprivileged bpf() by default | BPF_SYSCALL |
off | |
DEBUG_INFO_BTF | BTF type info (needed for CO-RE / bpftrace) | DEBUG_INFO |
off | |
KPROBES | kprobes | |
on | |
UPROBES | uprobes | |
on | |
FTRACE | ftrace framework | |
on | |
FUNCTION_TRACER | Function tracer | FTRACE |
off | |
PERF_EVENTS | perf events | |
on |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
IO_URING | io_uring | |
on | |
USERFAULTFD | userfaultfd (live migration, lazy restore) | |
off | |
TRANSPARENT_HUGEPAGE | Transparent huge pages | |
off | |
KSM | Kernel samepage merging | |
off | |
BINFMT_MISC | binfmt_misc (qemu-user, wasm loaders) | |
on | |
KEXEC | kexec | |
on |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
FUSE_FS | FUSE | |
off | |
VIRTIO_FS | virtiofs (FUSE over virtio) | FUSE_FS |
off | |
OVERLAY_FS | OverlayFS | |
off | |
EXT4_FS | ext4 | |
on | |
XFS_FS | XFS | |
off | |
BTRFS_FS | Btrfs | |
off | |
EROFS_FS | EROFS (read-only images) | |
off | |
SQUASHFS | SquashFS | |
off | |
ISO9660_FS | ISO 9660 | |
on | |
VFAT_FS | VFAT | |
on | |
NFS_FS | NFS client | |
on | |
9P_FS | 9P filesystem | NET_9P_VIRTIO |
on | |
NET_9P_VIRTIO | 9P over virtio transport | 9P_FS |
on | |
TMPFS_POSIX_ACL | tmpfs POSIX ACLs | TMPFS_XATTR |
on | |
TMPFS_XATTR | tmpfs extended attributes | |
on | |
BLK_DEV_LOOP | Loop block device | |
on | |
BLK_DEV_NBD | Network block device | |
off | |
DM_CRYPT | dm-crypt | |
off | |
ZRAM | zram compressed RAM block device | |
off |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
TUN | TUN/TAP | |
off | |
VETH | veth pairs | |
off | |
BRIDGE | Ethernet bridging | |
off | |
MACVLAN | macvlan | |
off | |
VXLAN | VXLAN | |
off | |
NETFILTER | Netfilter framework | |
on | |
NF_TABLES | nftables | NETFILTER |
off | |
IP_NF_IPTABLES | iptables (IPv4) | NETFILTER |
on | |
NF_NAT | NAT | NETFILTER, NF_CONNTRACK |
on | |
NF_CONNTRACK | Connection tracking | NETFILTER |
on | |
IPV6 | IPv6 | |
on | |
WIREGUARD | WireGuard | |
off | |
UNIX_DIAG | Unix socket diagnostics (ss) | |
off | |
INET_DIAG | INET socket diagnostics (ss) | |
off | |
NET_SCHED | QoS / packet scheduling (tc) | |
on | |
VSOCKETS | AF_VSOCK | |
off | |
VIRTIO_VSOCKETS | virtio vsock transport | VSOCKETS |
off | |
IP_PNP | Kernel IP autoconfiguration (ip= on cmdline) | |
on | |
IP_PNP_DHCP | DHCP during IP autoconfiguration | IP_PNP |
on |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
KVM_GUEST | KVM guest support (kvmclock, PV features) | |
on | |
PVH | PVH boot entry in vmlinux (Firecracker / Cloud Hypervisor direct ELF boot); on by default here | PARAVIRT |
on | |
PARAVIRT | Paravirtualization | |
on | |
VIRTIO_MMIO | virtio MMIO transport (Firecracker default) | |
off | |
VIRTIO_MMIO_CMDLINE_DEVICES | virtio MMIO devices from cmdline (legacy) | VIRTIO_MMIO |
off | |
VIRTIO_PCI | virtio PCI transport | |
on | |
VIRTIO_BLK | virtio block | |
on | |
VIRTIO_NET | virtio net | |
on | |
VIRTIO_CONSOLE | virtio console | |
on | |
VIRTIO_BALLOON | virtio balloon | |
off | |
HW_RANDOM_VIRTIO | virtio RNG | |
off | |
PTP_1588_CLOCK_KVM | KVM PTP clock (chrony/phc) | KVM_GUEST |
on | |
ACPI | ACPI | |
on | |
PCI | PCI (needed for ACPI boot on x86) | |
on | |
SERIAL_8250_CONSOLE | 8250 serial console | |
on | |
BLK_DEV_INITRD | initrd / initramfs support | |
on | |
X86_MPPARSE | MPTable parsing (legacy Firecracker boot) | |
on | |
SERIO_I8042 | i8042 (Firecracker clean shutdown) | |
on | |
KEYBOARD_ATKBD | AT keyboard (Firecracker clean shutdown) | SERIO_I8042 |
on | |
BLK_DEV_NVME | NVMe | |
off |
| setting | option | what it is | needs | default |
|---|---|---|---|---|
MODULES | Loadable module support | |
on | |
IKCONFIG | Embed .config in kernel | |
off | |
IKCONFIG_PROC | Expose /proc/config.gz | IKCONFIG |
off | |
DEBUG_INFO | Debug info (large vmlinux) | |
off | |
SMP | SMP | |
on | |
NUMA | NUMA | |
on | |
X86_MSR | /dev/cpu/*/msr | |
on | |
CPU_ISOLATION | CPU isolation | |
on | |
PREEMPT | Preemptible kernel (low latency) | |
off | |
HZ_1000 | 1000 Hz tick | |
on | |
NO_HZ_FULL | Full dynticks | |
off | |
SCHEDSTATS | Scheduler statistics | |
on | |
TASKSTATS | Per-task statistics | |
on | |
DEVTMPFS | devtmpfs | |
on | |
DEVTMPFS_MOUNT | Auto-mount devtmpfs at /dev | DEVTMPFS |
on |
| setting | option | what it is |
|---|
Extra .config lines, one per line (e.g. CONFIG_CMDLINE="console=ttyS0"):
First build of a kernel version compiles everything (about 7-12 min on 4 cores); later builds hydrate that version's shared object cache and only recompile what the changed options touch.