Linux basics

01

What Linux is made of: kernel, shell, distributions and licenses

It helps to picture Linux as an onion. At the center is the hardware: the CPU, memory, disks and network card. Wrapped around it is the kernel, which manages that hardware directly. Outside the kernel sits the shell (bash, for example), which interprets the commands you type, and on the very outside are the programs you actually use.

Programs never touch the hardware themselves. When one needs to read a file or send something over the network, it asks the kernel with a system call, and the kernel deals with the hardware and hands back the result. That way, even if one program goes wrong, the kernel keeps the hardware and every other program safe. Try switching the command in the scene below.

Distributions: the kernel bundled with tools

Strictly speaking, "Linux" is the name of the kernel. A kernel alone isn't something you can use, so it ships bundled with a shell, command-line tools, a package manager and an installer. That bundle is called a distribution (or distro). There are two big families, and whenever their commands differ, this guide shows them side by side.

You read a kernel version like 5.15.0 as "major.minor.patch." There used to be a rule that an even minor number meant a stable release, but that rule is no longer used. Today kernel.org publishes the latest development release (mainline), stable releases (stable) and long-term support releases (longterm).

Free software and the GPL

Linus Torvalds released the Linux kernel in 1991, and many of the tools around it came from the GNU Project, started by Richard Stallman. Stallman also founded the Free Software Foundation (FSF), whose flagship license is the GPL. Anyone can use, change and redistribute a GPL program, but if you distribute a modified version, you have to release its source code under the same GPL terms. This approach, which makes sure the freedom gets passed on to the next person, is called copyleft.

You've seen what Linux is made of. Next, let's see the order in which these layers wake up when you press the power button.

02

What happens when you power on: the boot sequence

Between pressing the power button and seeing the login screen, several stages run one after another. It's a relay race where each stage finds the next one and hands over the baton, so if you know which stage it stopped at, you also know what broke.

BIOS/MBR and UEFI/GPT: the old way and today's way

Four names can look like a lot, but it gets simple once you sort them into two pairs. BIOS and UEFI are firmware: the program built into the motherboard that runs first when you power on. MBR and GPT are partition table formats: a table of contents at the very front of the disk that says "here's how this disk is divided." The usual old pair is BIOS + MBR, and today's pair is UEFI + GPT. What sets them apart is how they find the next stage, the boot loader.

On Linux, the EFI system partition is usually mounted at /boot/efi. Exams love to ask about it as "where the boot loader lives when booting with UEFI."

The GRUB2 boot loader

The boot loader that gets found and run this way is GRUB2. LILO was also used in the past, but GRUB2 is the standard today. Here's the part that trips people up when you change its settings: you don't edit grub.cfg, the file that's actually read at boot, by hand. Instead, you edit the source file, /etc/default/grub, and then run grub2-mkconfig (update-grub on Ubuntu), which generates a fresh grub.cfg.

From runlevels to targets

The old init system divided system states into numbered "runlevels." systemd replaced them with targets, and it maps the old numbers to them so the old names still work.

You check the default target with systemctl get-default and change it with systemctl set-default. There are two modes for when something's broken. rescue.target is rescue mode: it mounts the file systems and lets the administrator in alone with a minimal set of services. emergency.target is emergency mode, which starts even less (the root file system is mounted read-only). When a wrong /etc/fstab stops the boot, you usually land in emergency mode.

In boot steps 3 and 4, the kernel found the "root file system" and mounted it. Now let's see how disks are split up and attached.

03

Splitting up and attaching disks: partitions, file systems and the directory structure

You can't use a new disk straight out of the box. It takes three steps. First you split the disk into sections (partitions). Then you create a format for holding files on each partition (a file system) with mkfs. Finally, you mount it at a spot in the directory tree with mount. Unlike Windows, there are no separate C: and D: drives. Every disk attaches as a branch of a single tree that starts at /.

File systems and swap

The most common Linux file systems are ext4 and XFS. Both are journaling file systems: they write the changes they're about to make into a journal first, then apply them. So even if the power suddenly goes out, the file system is less likely to get corrupted, and checking it is faster too. The RHEL family uses XFS by default. XFS is easy to grow, but think of shrinking it as practically impossible (there's only a feature that shrinks a little off the very end). Swap is disk space the system borrows for a while when memory runs short. It isn't attached to a directory; you turn it on with swapon.

/etc/fstab: where to mount at every boot

Anything you attach with the mount command is gone after a reboot. To mount it at every boot, add a line for it to /etc/fstab. Each line has six fields.

# device (or UUID)                         mount point  fs type     options   dump  fsck order
UUID=4c2f…a91e                             /home        xfs         defaults  0     0
/dev/sdb1                                  /data        ext4        defaults,nofail  0  2

If a disk listed here is missing, the boot stops in emergency mode (chapter 2). Add nofail to disks the system can live without. Device names like /dev/sdb1 can change depending on the order disks are plugged in, so it's safer to use the UUID, which doesn't change.

The directory structure (FHS)

On any distribution, each directory has a set job (the Filesystem Hierarchy Standard, FHS).

Now that the disk is attached, let's look at the files on it. A file's name and its contents actually live in separate places.