Understand the Linux machine—not just its commands.
Eight chapters build from identity and files to processes, networking, security, and incident diagnosis. Follow them in order for a complete foundation, or open any chapter as a working reference.
Learn the objects, watch the mechanism, then prove it.
- ModelName the kernel objects and boundaries involved.
- MechanismWork through a concrete state change or decision.
- EvidenceConnect commands and output to the state they expose.
- PracticeResolve a failure and answer a mechanism check.
Place every later chapter inside one machine
HTTPS Ingress Flow: An Ethernet frame arrives on eth0. The NIC driver uses DMA to write to the RX ring buffer and triggers NAPI. Kernel Netfilter evaluates PREROUTING, the routing table confirms destination 10.0.1.17, and the TCP payload is queued in the socket buffer. epoll_wait() wakes up nginx worker PID 421 to read the HTTP request.
Eight chapters, in dependency order
Each chapter stands alone, but later chapters deliberately reuse the objects established earlier.
Build the machine model
Learn how Linux names principals and data, then connect paths, permissions, mounts, inodes, and open files.
Start here if usernames, groups, sudo, SSH, and file permissions feel like one security feature. This chapter separates account lookup, process credentials, authentication, and authorization.
- Lessons
- 8
- Applied task
- Diagnose why nginx UID 33 cannot read /srv/site/config.json without reaching for chmod 777.
This chapter turns the “everything is a file” shortcut into a precise model of names, open handles, cached pages, filesystems, mounts, and block devices.
- Lessons
- 8
- Applied task
- Explain why df reports a full filesystem after a deleted log disappears from du.
Run and connect software
Follow programs as processes, services, sockets, packages, and shell pipelines without losing the kernel objects underneath.
A program file is passive. This chapter follows it through process creation, execution, scheduling, descriptors, signals, service supervision, and failure.
- Lessons
- 9
- Applied task
- Determine why nginx is installed but has no healthy worker or listening socket.
This chapter builds from sockets and routes to DNS, firewall hooks, listener scope, and network namespaces so “the port is open” stops being the whole diagnosis.
- Lessons
- 9
- Applied task
- Prove why a service that listens on 127.0.0.1:443 is healthy locally but unreachable remotely.
A package manager is a trust, dependency, filesystem, and lifecycle system. This chapter follows software from repository metadata to a running, linked service.
- Lessons
- 7
- Applied task
- Find the first broken boundary when a package is installed but its service will not accept connections.
The shell is a parser and process orchestrator, not a text macro. This chapter makes expansion order, descriptors, pipes, exit status, and safe automation visible.
- Lessons
- 9
- Applied task
- Explain why an error bypasses grep and why a failing producer can still leave a zero pipeline status.
Protect and operate the host
Layer security controls, read operational evidence, and isolate failures before changing a live system.
Linux security is a set of applicable decisions, not one onion where passing an inner layer defeats an outer layer. This chapter separates DAC, ACLs, capabilities, LSMs, seccomp, network policy, and audit evidence.
- Lessons
- 7
- Applied task
- Explain a file read where DAC allows but an enforcing LSM denies.
This chapter combines the previous seven. Start from the caller symptom, preserve evidence, localize the first broken boundary, and change one variable at a time.
- Lessons
- 7
- Applied task
- Diagnose eight “site down” fixtures without restarting the service as the opening move.
The Foundation of Cloud & Containers
Modern cloud infrastructure rests on these exact primitives. Containers do not run separate kernels; they are regular Linux processes running under namespaces and cgroups on this shared host.
From Boot to a Running Service
- Firmware & Bootloader: Initializes hardware and loads kernel image + initramfs into RAM.
- Kernel Initialization: Mounts root filesystem, initializes device drivers, and starts PID 1.
- Init System (systemd): Reads unit files, manages dependency trees, and starts services.
- Application Worker: Master process forks unprivileged worker processes and binds sockets.
Containers skip steps 1–3: the host kernel directly executes the container entrypoint inside isolated namespaces.
From / to a Resource
/etc · system configurationhome · user workspacesvar · dynamic logs & databasesproc · virtual kernel state & PIDssys · hardware & device attributesdev · device node special files“Everything is a file” is a useful shorthand, not a literal rule: many resources can be operated through file descriptors, while pathnames, sockets, devices, and kernel objects still have distinct semantics.