linuxlab.io
Tutorials▾
  • Linux & networking
    File system, processes, TCP/IP, BGP and OSPF
    →
  • Terraform & IaC
    HCL, state, plan/apply on a LocalStack sandbox
    →
  • Git & GitHub
    Object model, plumbing, branching, GitHub Actions
    →
All tutorials →
PricingAboutSign inCreate account
/
  • Введение
  • Уроки
  • How it works
  • Симулятор
  • База знаний
  • Собеседование
Index
Categories
All entries
Footer
linuxlab-TutorialsPricingAboutPrivacy & cookies
Copyright © 2026 LinuxLab. All rights reserved.
Index

База знаний.
Концепции Linux и сетей в TL;DR-формате.

139 коротких статей по командам, протоколам и системным концепциям. TL;DR (англ. too long; didn't read) - суть темы на 2-3 минуты, без долгих преамбул. Каждая статья ссылается на интерактивный урок, где знание применяется в реальном sandbox.

$/
Categories

Категории

9 разделов, упорядочены от нижнего уровня абстракции к верхнему.

139 статей
filenamesizedistribution%hints
kb/filesystem.md18
13%inode, links, perms, mount
kb/processes.md29
21%PID, signals, cgroups, namespaces
kb/network-l2-l3.md16
12%IP, routes, ARP, ICMP
kb/network-l4.md14
10%TCP, DNS, NAT, TLS
kb/commands.md28
20%ip, ss, tcpdump, nft, vtysh
kb/protocols.md14
10%BGP, OSPF
kb/security.md8
6%-
kb/containers.mdбонус5
4%-
kb/observability.md7
5%-
total139
100%/kb
All entries

Все статьи

Полный индекс статей по категориям.

kb/filesystem.mdFile system

18
  • bind-mountbind mount: making a directory appear in another placebind mount is `mount --bind <src> <target>`. It makes a directory (or file) visible at a…
  • block-devicesBlock devices: disks in LinuxA block device is read and written in fixed-size blocks (usually 512B or 4K). Disks, SSDs…
  • btrfsbtrfs: copy-on-write, subvolumes, and snapshotsbtrfs is a copy-on-write filesystem with subvolumes, O(1) snapshots, native RAID 0/1/10,…
  • ext4ext4: the Linux filesystem workhorseext4 is the default filesystem on most distributions: journaling, extents, a fixed inode…
  • extended-attributesExtended attributes (xattr): arbitrary file metadataxattr are key-value metadata on an inode beyond stat. 4 namespaces: user (open), trusted…
  • file-permissionsFile permissions: rwx and chmodEvery file has three permission sets: for the owner, the group, and others. Each set is t…
  • fhsFilesystem Hierarchy Standard (FHS)FHS is the standard for what lives in which Linux root directory: /etc holds config, /var…
  • filesystemsFilesystems: ext4, xfs, btrfs, zfsext4 is the reliable default. xfs handles large files and parallel I/O. btrfs and zfs giv…
  • fsck-and-recoveryfsck and recovery: checking and repairing a filesystemfsck, a check of an unmounted filesystem. e2fsck (ext), xfs_repair (XFS), btrfs check (bt…
  • hard-linkHard linkHard link is a second name for the same [[inode]]. Both names are equal: the file lives a…
  • inodeInodeAn inode is a filesystem record that holds metadata and pointers to a file's data blocks.…
  • lvmLVM: Logical Volume ManagerLVM is a layer between [[block-devices]] and the filesystem: it pools disks and carves ou…
  • mount-and-fstabmount and /etc/fstab: attaching filesystems`mount` attaches a block device or filesystem to a mount point in the tree. `/etc/fstab`…
  • posix-aclPOSIX ACL: extended access permissionsPOSIX ACL extends the classic rwx permissions: you can grant access to many users and gro…
  • raidRAID: software RAID with mdadmRAID combines several [[block-devices]] into one logical device for redundancy or speed.…
  • sparse-filesSparse files: holes and apparent sizeA sparse file has "holes", blocks the filesystem never allocated. They read back as zeros…
  • symbolic-linkSymbolic linkA symlink is a separate shortcut file that stores a path to its target. Unlike a [[hard-l…
  • xfsXFS: extents and parallel I/OXFS is the RHEL 7+ default: allocation groups (parallel I/O), extent-based allocation, on…

kb/processes.mdProcesses & resources

29
  • bash-strict-modeBash strict mode: set -euo pipefailThree flags at the top of a bash script that turn it from forgiving into fail-on-the-firs…
  • bpf-co-reBPF CO-RE: Compile Once Run EverywhereCO-RE means one compiled eBPF object runs on different kernels thanks to BTF (BPF Type Fo…
  • cgroupscgroups (v2)cgroups v2 is a hierarchical virtual FS under `/sys/fs/cgroup` that the kernel uses to li…
  • cgroups-v2-deepcgroups v2: unified hierarchy, PSI, eBPF controlcgroups v2 uses one tree instead of separate per-controller hierarchies. Clean semantics,…
  • chrony-and-ntpchrony and NTP: clock synchronizationNTP is the clock synchronization protocol (about millisecond accuracy over the internet).…
  • file-descriptorsFile descriptors (stdin, stdout, stderr)A file descriptor is an integer a process uses to reach an open file, socket, or pipe. Ev…
  • heredocHere-doc and here-string: data inside the scriptHere-doc (`<<EOF ... EOF`) feeds multi-line text to a command's stdin with no temp file.…
  • kernel-modulesKernel modules: LKM, modprobe, signing, DKMSAn LKM is code loaded into the kernel at runtime. modprobe resolves dependencies through…
  • capabilitiesLinux capabilities: privilege bitsCapabilities split root's power into 40+ independent bits: NET_ADMIN, SYS_PTRACE, and so…
  • namespacesLinux namespacesNamespaces are a kernel mechanism that gives a process its own isolated view of a resourc…
  • load-averageLoad averageLoad average is three numbers in `uptime`: exponential averages of the run-queue length (…
  • mmapmmap: files and shared memory`mmap()` maps a file (or an anonymous region) into a process virtual address space. Reads…
  • oom-killerOOM killerOOM killer is the kernel mechanism that picks and terminates a process when the system hi…
  • page-cachePage cache: disk in memoryPage cache is RAM that holds file contents. Every filesystem read and write goes through…
  • process-and-pidProcess and PIDA process is a running program with its own PID, memory, open descriptors, and UID. Every…
  • process-substitutionProcess substitution: <(cmd) and >(cmd)Bash syntax `<(cmd)` substitutes a command as a read-only pseudo-file. `>(cmd)` does it f…
  • seccompseccomp: a system call filterseccomp is a kernel-level syscall filter. A process declares "only these are allowed", an…
  • selinux-apparmorSELinux and AppArmor: Mandatory Access ControlSELinux and AppArmor are MAC: a control layer on top of normal permissions. They stop a p…
  • shebangShebang: the first line of a scriptA script's first line like `#!/usr/bin/env bash` tells the kernel which interpreter to st…
  • signalsSignals (SIGTERM, SIGKILL, SIGHUP)A signal is an asynchronous notification to a process from the kernel or another process.…
  • sudosudo: run a command as root`sudo` runs a command as another user (usually root) under the rules in `/etc/sudoers`. T…
  • swapSwap: when RAM runs outSwap is disk space where the kernel pushes out rarely used memory pages when RAM is neede…
  • systemd-drop-inssystemd drop-ins: override without editing the originalA drop-in is a `.conf` file in a `<unit>.d/` directory that merges into the unit file. It…
  • systemd-targetssystemd targets: runlevels the new wayA target is a `.target` unit that describes a desired system state as a set of dependenci…
  • systemd-timerssystemd timers as a cron replacementA systemd timer is a `.timer` unit that runs a paired `.service` on a schedule or after a…
  • systemd-unit-typessystemd unit typesA unit is a resource managed by systemd. The file extension equals the type: `.service` (…
  • systemd-resolvedsystemd-resolved: the local DNS stubsystemd-resolved is a DNS stub resolver. It listens on `127.0.0.53:53` and proxies querie…
  • systemdsystemd: the init system and service managersystemd is the Linux init system: PID 1 that starts everything else, tracks dependencies,…
  • virtual-memoryVirtual memory: virtual addresses, page tablesEach process sees its own 64-bit virtual address space. The MMU translates virtual addres…

kb/network-l2-l3.mdNetworking: L2 / L3

16
  • arpARP: Address Resolution ProtocolARP answers the question "who has MAC = ?" for a given IP inside one network. Linux keeps…
  • bonding-and-teamingBonding and teaming: aggregating interfacesBonding combines several physical interfaces into one logical interface. Modes: active-ba…
  • broadcast-domainBroadcast Domain: What It Is and Who Lives in ItA group of devices where an L2 frame with dst MAC `FF:FF:FF:FF:FF:FF` (broadcast) reaches…
  • default-gatewayDefault gateway: leaving your own networkThe router IP in your subnet where the stack sends packets for every address that **is no…
  • ethernet-frameEthernet FrameAn Ethernet frame is the L2 transmission unit: dst-MAC, src-MAC, EtherType, payload (usua…
  • icmpICMP: Internet Control Message ProtocolICMP is the control protocol on top of IP for control messages: echo (ping), destination-…
  • ip-forwardingIP Forwarding: Turn a Host into a RouterLinux does not forward packets between interfaces by default. Enable it with `sysctl net.…
  • ipv4-addressingIPv4: Addressing and CIDRAn IPv4 address is 32 bits written as `a.b.c.d`. The **/N** suffix is the prefix length:…
  • linux-bridgeLinux Bridge: Software SwitchA bridge is a software L2 switch in the Linux kernel. It learns MACs in the FDB and forwa…
  • mac-addressMAC AddressMAC address is a 48-bit hardware identifier for a network interface, written as `aa:bb:cc…
  • policy-routingPolicy Routing: Rule-Based RoutingPolicy routing selects a routing table based on src-IP, fwmark, iif, or tos. ip rule + ip…
  • routing-tableRouting tableThe routing table lists where to send packets for each destination. The longest matching…
  • subnetting-cidrSubnetting and CIDRCIDR /N specifies how many of the 32 bits (or 128 for IPv6) belong to the network. /24 gi…
  • tracerouteTraceroute: How to See the Path a Packet Takes Across the InternetTraceroute shows every router on the path to a remote host. It works by sending packets w…
  • veth-pairveth pairA veth pair is two linked virtual Ethernet interfaces. Whatever enters one end exits the…
  • vlan-and-trunkVLAN: 802.1Q Virtual LAN and Trunk PortsVLAN logically splits one physical switch into multiple L2 segments. The 802.1Q tag adds…

kb/network-l4.mdNetworking: L4 and above

14
  • coapCoAP: REST for Constrained Devices over UDPCoAP is REST over UDP for low-power IoT devices. 4-byte header, GET/POST/PUT/DELETE, resp…
  • dhcp-protocolDHCP: Dynamic Host Configuration ProtocolDHCP gives a host its IP address, subnet mask, gateway, and DNS via broadcast. 4 packets:…
  • dns-resolutionDNS: ResolutionName-to-IP resolution goes through NSS: first `/etc/hosts`, then DNS via `/etc/resolv.con…
  • grpc-basicsgRPC: HTTP/2 + Protobuf RPC FrameworkgRPC = HTTP/2 + Protocol Buffers + code generation. Four RPC types: unary (like REST), se…
  • http-protocolHTTP/1.1, HTTP/2, HTTP/3HTTP/1.1 is a text-based protocol with keep-alive. HTTP/2 is binary with multiplexing ove…
  • http2-internalsHTTP/2: Binary Framing, HPACK, Stream MultiplexingHTTP/2 is binary multiplexing over a single TCP connection. HPACK compresses headers thro…
  • natNAT: Network Address TranslationNAT rewrites the src or dst address of a packet at a router. Masquerade is the common cas…
  • portPort: How Multiple Services Share One IPA 16-bit number (0-65535) that identifies the **destination process** on a host. IP says…
  • tcp-keepaliveTCP keepaliveKeepalive sends probes on an idle TCP connection to detect a dead peer (NAT timeout, cras…
  • tcp-statesTCP states (LISTEN, ESTABLISHED, TIME_WAIT)A TCP session moves through 11 states from LISTEN to CLOSED. The most important in produc…
  • tcp-handshakeTCP three-way handshakeTCP connection opens with three packets: SYN from the client, SYN-ACK from the server, AC…
  • tls-handshakeTLS HandshakeTLS is the encryption layer above TCP. Before data flows, both sides run a handshake: the…
  • udp-basicsUDP: User Datagram ProtocolUDP delivers datagrams without establishing a connection, without retransmits, and withou…
  • websocketWebSocket: Bidirectional Channel over HTTPWebSocket is a bidirectional channel over a single TCP connection. The upgrade from HTTP/…

kb/commands.mdCommands

28
  • cmd-awkawk: field-oriented processing of structured textawk splits a line into fields by FS (default is whitespace) and applies pattern { action…
  • bash-scriptingbash scripts: basics and idiomsA bash script is a text file with shebang `#!/usr/bin/env bash` and `chmod +x`. Start eve…
  • cmd-cron-crontabcron and crontab: scheduling taskscron is a daemon that reads crontab files and runs jobs on a schedule. Format: `min hour…
  • cmd-curlcurl: HTTP client from the terminal`curl` is a CLI for HTTP, HTTPS, FTP, and more. Send requests, inspect headers, certifica…
  • cmd-digdig: DNS queries with full detaildig queries DNS. Ask for any record type from any server. +short gives compact output. +t…
  • cmd-findfind: search files by predicates`find` walks a directory tree and applies predicates (name, type, time, size, permissions…
  • cmd-grepgrep: search lines by pattern`grep` searches stdin or files for lines matching a regex. Key modes: `-E` (ERE), `-P` (P…
  • cmd-htophtop: interactive process monitorhtop is an interactive TUI process monitor. F-keys: F3 search, F4 filter, F5 tree, F6 sor…
  • cmd-ipip: Swiss army knife for network configuration`ip` is the iproute2 frontend that replaces the old ifconfig, route, and arp tools. Subco…
  • cmd-iperf3iperf3: measuring bandwidth`iperf3` measures TCP/UDP throughput between two endpoints. Run a server on one host and…
  • cmd-iptablesiptables: netfilter rules (legacy)iptables is the userland interface for netfilter. Five tables (filter/nat/mangle/raw/secu…
  • cmd-journalctljournalctl: systemd journal`journalctl` reads the binary journal written by systemd-journald. It is the central log…
  • cmd-jqjq: JSON queries and transformationjq is a query language for JSON in the shell. Use .field, .array[], select(...), map(...)…
  • cmd-lsblk-blkidlsblk and blkid: block devices and UUIDslsblk shows the block device tree (disk -> partition -> LVM/crypt -> mountpoint). blkid p…
  • cmd-lsoflsof: who has what open`lsof` (List Open Files) shows every open file across all processes. In Linux everything…
  • cmd-mtrmtr: traceroute + ping in one toolmtr = traceroute + ping. It probes every hop continuously and shows loss% and latency. Us…
  • cmd-nftnft: modern firewall (nftables)`nft` is the single CLI for modern netfilter. Replaces iptables/ip6tables/ arptables/ebta…
  • cmd-psps: process snapshotps prints a snapshot of processes at the moment it runs. Two dialects: BSD (`aux`, no das…
  • cmd-rsyncrsync: incremental file synchronizationrsync copies only the changed blocks of files, locally or over SSH. `-avz` is the baselin…
  • cmd-sedsed: stream editorsed is a stream editor: it applies commands (`s/a/b/`, `d`, `p`, ...) to each line. `-i`…
  • cmd-ssss: who is listening and who is connected`ss` is the modern replacement for netstat. It shows sockets in LISTEN and ESTABLISHED st…
  • cmd-stracestrace: what syscalls a process makes`strace` shows in real time which system calls a process makes and with what arguments. T…
  • cmd-sysctlsysctl: kernel tunables`sysctl` reads and writes kernel parameters through the virtual filesystem `/proc/sys/`.…
  • cmd-systemctlsystemctl: managing systemd services`systemctl` is the main CLI for managing systemd units: services, timers, mounts, and soc…
  • cmd-tctc: traffic control`tc` manages packet queues on network interfaces: bandwidth limits, delay, loss, and clas…
  • cmd-tcpdumptcpdump: packet capturetcpdump captures packets from a network interface using a BPF filter. It supports writing…
  • cmd-vtyshvtysh: CLI for FRR (BGP/OSPF)vtysh is the Cisco-style CLI for FRRouting. It lets you configure all routing daemons (ze…
  • xargs-and-find-execxargs and find -exec: bulk operationsTwo ways to apply a command to a set of files: `find ... -exec cmd {} +` (inside find) an…

kb/protocols.mdProtocols

14
  • apache-httpdApache httpd: the web serverApache httpd is a web server. On RHEL the package is `httpd`, config `/etc/httpd/conf/htt…
  • bgpBGP: Border Gateway Protocol**BGP** is the routing protocol between autonomous systems (AS). It is the language ISPs…
  • bind-dns-serverBIND: Authoritative and Caching DNS ServerBIND (Berkeley Internet Name Domain) is the most widely deployed DNS server on Linux. The…
  • ftp-sftpFTP and SFTP: file transferFTP is an old protocol with control plus data connections (active/passive modes) and no e…
  • ipsec-ikeIPsec and IKEv2: the enterprise VPN standardIPsec is the L3 VPN standard. ESP encapsulates and encrypts, IKEv2 exchanges keys. Tunnel…
  • kerberosKerberos: network single sign-onKerberos is an SSO system built on tickets and time-based cryptography. You enter your pa…
  • ldap-basicsLDAP: directory services fundamentalsLDAP is a query against a hierarchical directory. A DN is the coordinate of an object (cn…
  • nfsNFS: Network File SystemNFS is a network file system from Sun. v3 is stateless, v4.1+ is stateful with delegation…
  • openvpnOpenVPN: TLS-based VPNOpenVPN is a userspace TLS VPN built on X.509 certificates. Modes: tun (L3, default) or t…
  • ospfOSPF: Open Shortest Path First**OSPF** is a link-state IGP inside one autonomous system. Each router knows the full top…
  • quic-http3QUIC: Modern Transport over UDPQUIC is a transport over UDP. TLS 1.3 is built in (1 RTT, 0-RTT for resume). Multiplexing…
  • smtp-mtaSMTP: MTA and Email DeliverySMTP is a text-based mail delivery protocol. Port 25/tcp is server-to-server, 587 is subm…
  • sshSSH: Secure ShellSSH is an encrypted channel to a remote host: shell, file copy, port-forwarding. Standard…
  • wireguardWireGuard: Modern UDP VPNWireGuard is a UDP VPN built into the Linux kernel. A Curve25519 key pair, peers with All…

kb/security.mdSecurity

08
  • auditdauditd: syscall and file auditauditd writes kernel events to /var/log/audit/audit.log: file watches (-w), syscall rules…
  • cis-benchmark-hardeningCIS Benchmark and system hardening (lynis, OpenSCAP)CIS Benchmark is the Linux hardening standard. Lynis is a fast local audit with a score,…
  • fail2banfail2ban: automatic bans from logsfail2ban reads logs (sshd, nginx, postfix), uses a regex to catch N failed attempts in a…
  • firewalld-vs-nftablesfirewalld vs nftables: what to choosefirewalld is a daemon wrapper with zones, services, and rich rules; the backend since RHE…
  • pamPAM: Pluggable Authentication ModulesPAM is the authentication framework in Linux. Programs (sudo, login, sshd) do not check p…
  • secrets-managementSecrets management: Vault, k8s Secrets, sealed-secretsKeep secrets out of git and out of env vars in code. Options: HashiCorp Vault (general pu…
  • selinux-policySELinux policy: types, domains, audit2allowSELinux: every process has a domain, every object has a type. The policy defines which do…
  • ssh-hardeningSSH hardening: locking down the serverSSH hardening: keys only (PasswordAuthentication no), disable root login, AllowUsers/Allo…

kb/containers.mdContainers (bonus)бонус

05

Раздел вне основного курса, для расширения кругозора.

  • docker-storage-driversDocker storage drivers: overlay2, btrfs, zfsA storage driver is how Docker keeps image layers and container changes on disk. overlay2…
  • kubelet-internalskubelet: the Kubernetes node agent architecturekubelet is a daemon on every node. It receives the PodSpec through the API, starts contai…
  • kubernetes-pod-lifecycleKubernetes pod lifecycle: from Pending to TerminatedA pod moves through phases Pending, Running, Succeeded/Failed/Unknown. Init containers ru…
  • oci-specOCI spec: the container standardOCI is three specs: Image (layers + manifest), Runtime (config.json + rootfs for runc), D…
  • runc-and-runscrunc, runsc, kata: container runtimesrunc is the standard OCI runtime: namespaces+cgroups+seccomp. runsc/gVisor is a userspace…

kb/observability.mdObservability & monitoring

07
  • pyroscope-continuous-profilingContinuous profiling: Pyroscope, eBPF, flame graphs in productionContinuous profiling is an always-on CPU/memory profiler in production through eBPF. 1-2%…
  • loki-grafana-loggingLoki: label-based logs, LogQL, Promtail/Vector pipelineLoki is log aggregation with a label-based index, not full-text like Elastic. Cheap on S3…
  • metric-typesMetric types: counter, gauge, histogram, summaryFour metric types: counter (up only), gauge (any value), histogram (buckets for p99), sum…
  • metrics-vs-logs-vs-tracesMetrics vs logs vs traces: the three pillars of observabilityMetrics are aggregated numbers over time, cheap, for alerts. Logs are discrete events wit…
  • opentelemetryOpenTelemetry: signals, OTLP, Collector pipelineOpenTelemetry is the CNCF standard for metrics, traces, and logs in one SDK. The OTLP pro…
  • service-discovery-prometheusService discovery in Prometheus: k8s, Consul, file_sd, relabelProm discovers targets through the k8s API, Consul, or file_sd (static). relabel_configs…
  • sli-slo-error-budgetSLI / SLO / error budget: SRE metrics without the noiseSLI is a user-facing metric (availability, p99 latency). SLO is a target over a period (9…
$ 139 / 139 статей-cd ../lessons-curl /api/kb
Footer
linuxlab-
Copyright © 2026 LinuxLab. All rights reserved.
Tutorials
Pricing
About
Privacy & cookies