Revision · Linux, Processes & the Shell

Part 1 is the substrate: everything above it — containers, CI runners, Kubernetes — resolves to a Linux process reading files, managed by a service manager, glued together by the shell. Its throughline is that Linux exposes its internals as files and text, which is exactly what makes it automatable.

What this part covered

The process model — a program on disk is inert bytes; a process is it running with a PID, born via fork()/exec(), dying with an exit code (0 = success), controlled with signals like SIGTERM (graceful) versus SIGKILL (uncatchable).
Filesystem and permissions — “everything is a file” means one owner/group/other × rwx model governs config in /etc, logs in /var/log, and processes in /proc; octal bits (600, 644, 755), chmod/chown, and least privilege keep blast radius small — never chmod 777, prefer auditable sudo over root.
The shell — small single-purpose tools composed over three streams (stdin/stdout/stderr) with pipes and redirection; exit status drives &&/||, and the grep/find/sed/awk quartet wrangles text into one-liners that answer real questions.
Writing safe scripts — a #!/usr/bin/env bash shebang plus set -euo pipefail and always-quoted "$var" turn ad-hoc commands into repeatable automation and avoid disasters like the empty-variable rm -rf bug.
Package management — the first reproducibility tool: apt/dnf resolve dependencies from signed repositories, and version pinning (nginx=1.24.0, apt-mark hold) is the antidote to “works on my machine” drift.
systemd and services — PID 1 supervises your app for the life of the box; a unit file declares ExecStart, User, and Restart=on-failure so the process self-heals across crashes and reboots, replacing the fragile python app.py &.
Service control and logs — systemctl start (now) is distinct from enable (at boot), a clean SIGTERM shutdown matters, and journald captures stdout/stderr for journalctl -u <svc> -f.
Logs and troubleshooting — replace guessing with a methodical loop (observe → hypothesize → test → change one thing → verify), a four-tool triage (top, df, free, ss), dmesg for the OOM killer, and capturing state before the evidence-destroying restart.

The takeaway

Get this layer solid and everything above it stops being magic: a container is these same primitives — namespaces, cgroups, a process, a filesystem — with walls added. Networking is next, and the sockets and ports it deals in come straight from the processes and ss output you met here.