From Power-On to a Login Prompt
Eight handoffs stand between the power button and a shell, each one to a program that knows almost nothing about the last. Firmware, shim, bootloader, kernel, initramfs, the switch to…
Permissions and Privilege, Properly
Six independent layers stand between a process and a file, and every one of them can say no on its own. Mode bits, ACLs, capabilities, LSMs and user namespaces —…
The Life of a Packet: What Really Happens When Your Application Sends Data
From write() to the wire and back again — sockets, the routing decision, netfilter, conntrack, ARP, queueing disciplines, offloads and the container detour. The long version, because almost every hard…
What a Filesystem Journal Does During a Crash
A journal means you no longer wait an hour for fsck after a power cut. It does not mean the file you were writing survived — and understanding that gap…
Signals: How Processes Are Asked to Stop
Ctrl+C, kill, systemctl stop and a container shutting down are all the same mechanism. Knowing which signal is being sent, and who is allowed to ignore it, explains why some…
Memory, Swap and the OOM Killer
free says almost no memory is available and the machine is fine. Then one day a process disappears with no error in its own logs. Both of those make sense…
What Actually Happens When You Run a Program
You type a name and press enter. Between that and the first line of output sit fork, exec, an ELF header and a dynamic linker — and knowing the sequence…
Text Encodings and Locales: Why the Same Command Gives Different Answers
Linux stores text as bytes and records nothing about what they mean. What UTF-8 actually is, what the LC_ variables change, and why a script that works on your laptop…
What a TLS Certificate Actually Proves
A certificate binds a name to a key and nothing more. The chain of trust, where your machine keeps its root store, and why a site can work in a…
How a Name Is Actually Resolved on a Linux Box
Between your program and a DNS server sit nsswitch, the resolver library, and usually a local stub listener. Why dig can succeed while your application fails, and how to tell…