Filesystem, permissions, processes, pipes, packages, systemd, networking, and SSH — the foundation of everything running in production.
Everything is under /. One tree, three categories: system binaries, config & data, virtual kernel interfaces.
The Unix philosophy: one interface — open/read/write/close — for regular files, devices, sockets, pipes, and more.
/sys/proc/dev/null — discard output/dev/zero — infinite zero bytes/dev/random — random data/dev/stdin — your keyboard/proc/self — current processdrwxr-xr-x alice /home/alice -rw-r--r-- alice .bashrc lrwxrwxrwx root /bin → usr/bin crw-rw-rw- root /dev/null
Every file has an owner, a group, and a 9-bit permission mask split into three trios.
Every process runs as a user. sudo is privilege escalation — not a login, a temporary grant.
# create user with home dir useradd -m -s /bin/bash alice passwd alice # add to group (e.g. docker) usermod -aG docker alice # who am I / what groups? whoami id groups
/etc/passwd — user accounts/etc/shadow — password hashes (root only)/etc/group — group memberships/etc/sudoers — sudo rulesPermitRootLogin no)passwd -l userEvery running program is a process. They form a tree rooted at PID 1. Signals are the way to communicate with them.
Every process has three open file descriptors. Pipes connect stdout of one process to stdin of the next.
Packages are compressed archives containing binaries, libraries, and metadata. Repos are catalogues of packages with verified checksums.
# ── Debian / Ubuntu (apt) ────────────────── # update package index sudo apt update # upgrade all installed packages sudo apt upgrade # install a package sudo apt install nginx # remove (keep config) / purge (delete all) sudo apt remove nginx sudo apt purge nginx # search for a package apt search "http server" # show package info / files apt show nginx dpkg -L nginx # ── RHEL / Fedora / Amazon Linux (dnf) ───── sudo dnf install nginx sudo dnf update sudo dnf remove nginx rpm -ql nginx # list installed files # ── Add a third-party repo ───────────────── # apt: add .list file to /etc/apt/sources.list.d/ curl -fsSL https://repo.example.com/key.gpg | \ sudo apt-key add - echo "deb https://repo.example.com stable main" \ | sudo tee /etc/apt/sources.list.d/example.list sudo apt update && sudo apt install example-pkg
apt / dpkgdnf / rpmpacman# remove unused dependencies sudo apt autoremove # clear cached .deb files sudo apt clean
systemd is PID 1 — it starts, stops, and monitors services using declarative unit files.
# /etc/systemd/system/myapp.service [Unit] Description=My Web Application After=network.target postgresql.service Requires=postgresql.service [Service] Type=simple User=deploy WorkingDirectory=/opt/myapp ExecStart=/opt/myapp/venv/bin/uvicorn main:app ExecReload=/bin/kill -HUP $MAINPID Restart=on-failure RestartSec=5s EnvironmentFile=/etc/myapp/env StandardOutput=journal StandardError=journal [Install] WantedBy=multi-user.target # after creating/editing: systemctl daemon-reload systemctl enable --now myapp
systemctl start nginx systemctl stop nginx systemctl restart nginx systemctl reload nginx # HUP systemctl status nginx systemctl enable nginx # start on boot systemctl disable nginx
# follow live logs for service journalctl -u nginx -f # last 100 lines journalctl -u nginx -n 100 # since boot / since time journalctl -b journalctl --since "1 hour ago"
Interfaces, routing, DNS resolution, and the tools to inspect all of it.
Public-key auth, config files, and port forwarding — the three things that make SSH powerful.
The commands you'll reach for every day.
# ── Navigation ─────────────────────── pwd print working dir cd - previous directory ls -lah long + hidden + human sizes find . -name "*.log" find by name find . -mtime -1 modified in last day # ── Files ──────────────────────────── cp -r src/ dst/ recursive copy mv file newname rm -rf dir/ ⚠ careful ln -s target link symlink # ── Viewing / Searching ────────────── cat file less file paginate (q to quit) tail -f /var/log/syslog grep -r "error" /var/log/ grep -n "TODO" *.py with line numbers # ── Text Processing ────────────────── cut -d: -f1 /etc/passwd extract field awk '{print $1, $NF}' f sed 's/foo/bar/g' file replace text sort -k2 -n file wc -l file line count
# ── Disk & Storage ─────────────────── df -h disk usage by filesystem du -sh /var/log/* size of each item lsblk block devices tree mount /dev/sdb1 /mnt # ── Archives ───────────────────────── tar -czf archive.tar.gz dir/ create tar -xzf archive.tar.gz extract tar -tzf archive.tar.gz list contents zip -r archive.zip dir/ unzip archive.zip # ── System Info ────────────────────── uname -a kernel version + arch uptime free -h RAM usage top / htop process monitor lscpu CPU info # ── Useful combos ──────────────────── # top 10 largest files du -ah . | sort -rh | head -10 # who is listening on :8080? ss -tlnp | grep 8080 # what opened this file? lsof /var/log/nginx/access.log
The foundation that Docker, Kubernetes, and every production server runs on.
Write programs that do one thing well. Write programs that work together. Write programs that handle text streams — the universal interface. Pipes turn small tools into powerful pipelines.
Before installing a monitoring tool, try reading /proc/meminfo, /proc/net/tcp, and /sys/class/net/eth0/statistics/rx_bytes. The kernel exposes everything.