The rung, and the rungs either side
| Option | Who keeps the OS patched | What you can install | Choose it when |
|---|---|---|---|
| Shared hosting | Provider | Whatever the control panel offers | You want a website, not a server |
| Managed VPS | Provider, up to your own code | The provider's stack, on request | You need the isolation but not the pager |
| Unmanaged VPS | You, continuously | Anything Linux will run | A specific service or runtime is the reason |
| Dedicated server | You, firmware included | Anything, kernel included | Sustained load or compliance pins you to one machine |
A hypervisor is what makes the slice possible, partitioning one physical machine into several independent guests, each with its own kernel, its own address and a reserved allocation that a busy neighbour cannot help itself to the way it can on shared hosting. From the inside the result is indistinguishable from a small server of your own, which is the attraction and the hazard in one, because nobody is watching the box except you. Kernel updates, the firewall, SSH keys, log rotation, certificate renewal, backups held somewhere other than the same disk, and the restore rehearsal proving those backups work: all yours. So is the alert when a runaway process fills the volume on a public holiday. The first week is mostly a checklist, and it is much the same checklist for everybody: make a user who is not root, put your SSH key on it, switch password logins off, close every port except 22, 80 and 443, enable automatic security updates, add swap so a memory spike throttles the database instead of killing it, make sure the clock syncs, then install the web server and wire up certificates. One careful afternoon, written down as you go. What goes wrong afterwards is duller than any attack. Disks fill with logs nobody rotates. A distribution reaches end of life and stops receiving patches, so an upgrade everyone postponed turns into an emergency migration. A database port faces the open internet because a tutorial said to bind it to every interface. Backups exist, have never once been restored, and prove to contain an empty dump. That list is the standard fate of a server bought without a reason to own it. Two details catch people out. Provider snapshots are convenient and are not a backup strategy, since they rest on the very platform whose failure you meant to insure against. And reserved is a relative word: processor time on a virtualised host is still shared out, so contention surfaces as steal time in top rather than as an error anyone thinks to send you. The skills involved are learnable and portable, which makes a small VPS holding nothing important one of the finest classrooms in this industry, and a live checkout the worst possible one. When the truthful answer to who will patch this in six months is nobody, managed hosting is not a climbdown. It is the correct purchase.