Linux fundamentals

Linux is a free and open source operating system. Strictly speaking, it is the kernel Linus Torvalds created in 1991: the central program that manages the hardware, the memory and the processes. In everyday use, "Linux" means a complete system put together by a distribution (Ubuntu, Debian, RHEL), which adds the libraries, tools and applications around the kernel.

This guide gives you the essential vocabulary and landmarks to work on a Linux server: how the system is organised in layers, how its filesystem is structured, and how it boots. It is the groundwork of the Fundamentals part of the course: these notions come back in every guide of the section.

Recommended reading

To build lasting shell reflexes on top of these notions: The Linux Command Line, William Shotts starts from zero and goes all the way to scripts. It is the reference for beginners, and its 3rd edition is up to date.

Amazon affiliate link. Buying through it supports the site at no extra cost to you.

What you will learn

By the end of this guide, you will be able to:

• explain in what sense Linux is a kernel and what distributions add around it,
• describe how a simple command such as ls travels from the user layers down to the kernel,
• name the 7 boot stages of a modern Linux server, from UEFI to systemd,
• find your way around the / tree without hesitating over where a configuration file, a log or a script belongs.

What is Linux?

Strictly speaking, Linux refers only to the kernel, the central program created in 1991 by Linus Torvalds and distributed under the GPL licence. It manages the hardware, the memory, the processes and the files.

In everyday use, people say "Linux" to mean a complete system. That system is actually provided by a distribution, which bundles:

• the Linux kernel,
• system libraries (including the libc),
• GNU utilities and other tools,
• an init system (most often systemd),
• a package manager (APT, DNF, APK…),
• and additional applications.

Common distributions in server administration: Ubuntu Server, Debian, RHEL/Rocky Linux, Alpine Linux.

This split of roles explains the name GNU/Linux some people use. Linus Torvalds wrote the kernel; Richard Stallman and the GNU project provided most of the tools around it: compiler, shell and utilities. A distribution combines both, and much more, into a system you can actually use.

The components of a Linux system

A Linux system is not a single block but a stack of bricks, each one talking only to its direct neighbour. The table below lists them from the closest to the hardware to the closest to you. Above all, remember the Role column: when something breaks, it tells you which brick to question. A service that will not start belongs to init, a missing command to the system tools, a missing package to the package manager.

Component	Role	Example
Kernel	Manages hardware, memory, processes	Linux 6.x
Libraries	Interface between programs and the kernel	glibc, musl
Shell	Interprets commands	bash, zsh, sh
System tools	Handle files, networking, processes	coreutils, util-linux
Package manager	Installation and updates	apt, dnf, apk
Init / PID 1	Starts and supervises services	systemd

Swipe to see more

How is a Linux system built?

Rather than a list of abstract layers, let's start from a concrete example.

You type ls /etc in a terminal:

1. The shell (bash, zsh…) parses the line and locates the ls program.
2. The shell starts ls as a new process.
3. ls calls functions of the C library (glibc) to read the directory.
4. The libc turns these calls into system calls (openat, getdents64…).
5. The kernel receives these calls, queries the filesystem, and reads the entries on disk.
6. The data travels back up through the layers until it is displayed in your terminal.

This path illustrates the fundamental rule: the shell is not Linux. It is an ordinary user program. Linux is the kernel that arbitrates access to resources.

Kernel mode and user mode

Linux constantly separates two zones:

• Kernel mode: the kernel runs with full access to the hardware. A bug here can freeze the whole system.
• User mode: all your processes (shell, services, applications) run with restricted privileges. A crash in this space does not affect the rest.

The boundary between the two is crossed only through system calls: this is the central security mechanism of the Linux architecture.

Four confusions to clear up right away

These four shortcuts come up with everyone who starts out, and each one leads to a specific diagnostic mistake. Clearing them up now saves you from looking in the wrong place later.

• Linux is not a distribution: Debian, Ubuntu and RHEL are distributions, and Linux is the kernel they ship.
• The shell is not the terminal: the terminal displays and forwards your keystrokes, the shell interprets the line.
• /proc and /sys are not real data directories: they are virtual views of the kernel, computed when you read them.
• /tmp is not durable storage: never assume its content survives a reboot.

How does a Linux server boot?

On a modern Linux server, booting follows a precise sequence of 7 stages. Knowing it lets you diagnose a server that will not boot, or understand why a service does not start.

1. Firmware (BIOS / UEFI)

   At power-on, the firmware initialises the hardware (CPU, RAM, disks, network cards), then hands over to a boot loader. On a UEFI system with Secure Boot turned on, it first checks the cryptographic signature of what it launches: a modified loader or kernel is refused before it even runs.

2. Boot loader (GRUB2 / systemd-boot)

   The boot loader displays a menu, lets you pick one kernel among those installed, or pass parameters. It loads two things into memory: the compressed Linux kernel (vmlinuz) and an initramfs image.

   Installing a kernel does not make it run, and that is the best way into the topic. A machine hosts several kernels at the same time, and the one that runs is not necessarily the newest:

   ls /boot/vmlinuz*
   readlink /boot/vmlinuz
   uname -r

   On an Ubuntu 24.04 machine that has been running for a while, this shows two installed kernels, /boot/vmlinuz pointing to 6.8.0-136 while uname -r answers 6.8.0-134. /proc/cmdline confirms which one actually booted:

   grep -o 'BOOT_IMAGE=[^ ]*' /proc/cmdline

   A kernel installed but never booted, for lack of a reboot. That is exactly why a kernel security update has no effect until the machine reboots, and why compliance tools distinguish "patched" from "rebooted".

3. Kernel decompression and initialisation

   The kernel decompresses itself, detects the available hardware and takes control of the CPU. It does not mount the real root of the system yet.

4. Initramfs / initrd

   The initramfs (Initial RAM Filesystem) is a compressed archive loaded into memory. It contains a minimal environment, drivers, scripts and tools, that lets the kernel:

   • load the drivers it needs (RAID, LVM, encryption…),
   • find and prepare the real root partition,
   • decrypt the volume if needed.

   This is the stage people forget, and it is critical: without an initramfs, the kernel would not know how to reach an LVM or encrypted disk.

5. Switch-root to the real root

   Once the real / partition is reachable, the kernel performs a switch-root: it leaves the initramfs environment and switches to the real filesystem installed on disk.

6. PID 1, systemd (or another init)

   The first process the kernel starts on the real root is PID 1. On nearly every modern server distribution, it is systemd. It manages everything that follows.

7. Services and the default target

   systemd reads its units (.service, .target, .socket…) and starts the services while honouring their dependencies. The default target (multi-user.target on a server without a graphical interface) decides which set of services is active once boot is complete.

Knowing this sequence pays off mostly on the day it stops. The 2 most frequent failure points are the initramfs stage, a missing driver or a volume that cannot be found, and the systemd stage, a failed service. Knowing which of the 7 stages failed lets you target the diagnosis instead of guessing.

What is the Linux filesystem hierarchy (FHS)?

Linux organises all its data in a single tree, defined by the Filesystem Hierarchy Standard (FHS). Everything starts from the root /. These are the main directories to know:

• Répertoire/ (root, starting point of the whole tree)

  • Répertoireetc/ configuration files for the system and services

    • …
  • Répertoirevar/ persistent variable data (logs, service state…)

    • …
  • Répertoireusr/ programs, libraries and documentation

    • …
  • Répertoirehome/ users' home directories

    • …
  • Répertoireboot/ kernel, initramfs, boot loader

    • …
  • Répertoiretmp/ temporary files, do not assume they persist

    • …
  • Répertoirerun/ volatile runtime data (reset at boot)

    • …
  • Répertoireproc/ virtual view of the kernel and processes

    • …
  • Répertoiredev/ representation of the devices

    • …

Remember 3 reflexes first; they cover most of the daily searches on a server:

• looking for a configuration starts in /etc/;
• analysing a problem starts in /var/log/;
• finding a runtime file, a socket or a PID file, starts in /run/.

The FHS directory tree guide then details each area, with the differences between distributions and the commands to check them. It is meant to be read after the guides on shells and commands, once these landmarks are in place.

Put it into practice

These landmarks stick by practising, not by rereading the guide. The lab opens a disposable shell where you identify the kernel, the distribution and the key directories of the tree with the system's own commands: your output is compared, line by line, with the expected result.

Guided lab Practice

Learn how to do it

Map Linux: kernel, distribution and key directories

$ dsoxlab run l1-discover-linux-map

Environment: Shell·Duration: ~20 min

How it is checked: the output you produce is compared with the expected result.

First time? What DSOXLab is and how to install it

DSOXLab is the command line that prepares a disposable environment (an isolated shell or a VM), runs the lab scenario, then checks the real state of the system and computes a score. Nothing is installed or broken on your workstation.

It needs Python 3.11 or later, uv or pipx, and git. The installation guide details these prerequisites; on Windows, or on a Mac without Python, use the appliance instead.

Install the CLI and add the catalogue, once:

uv tool install dsoxlab   # or: pipx install dsoxlab
dsoxlab catalog add https://github.com/stephrobert/linux-dsoxlab-training

Before you run the lab, check:

• DSOXLab installed
• catalogue available
• compatible environment (isolated shell or VM)

To check, nothing is probed from this page: run dsoxlab doctor. Read the diagnosis

Run this lab, then validate your work:

dsoxlab run l1-discover-linux-map
dsoxlab check l1-discover-linux-map

See every lab: dsoxlab list-labs. Track your progress: dsoxlab progress. The full dsoxlab guide covers scoring and the pitfalls.

Key points

• Linux, strictly speaking, is a kernel. A distribution combines this kernel with libraries, tools and an init system into a usable system.
• The shell is an ordinary user program. The boundary between kernel and user space is crossed only through system calls.
• A modern boot goes: firmware → boot loader → kernel → initramfs → switch-root → PID 1 / systemd → services.
• The initramfs is essential to prepare the real root, especially on LVM, RAID or an encrypted volume.
• The FHS defines a standard tree: /etc for configuration, /var for variable data, /usr for programs, /boot for booting. The FHS directory tree guide details each area.

Knowledge check

Check that the essentials of this guide stuck. The questions cover only what has just been explained here.

Knowledge check

Check what you have learned with this interactive quiz

6 questions

6 min

70% to pass

How it works

• The timer starts when you click Start
• Multiple choice, true/false and short answer questions
• You can move between questions
• Detailed results are shown at the end

Start the quiz

Starts the quiz and the timer

FAQ: frequently asked questions

These are the questions that come up most often when discovering Linux, and they cover points the course deals with later on: what a distribution is, the architecture around the kernel, boot, then processes, services, users and files.

What is Linux?

What are the main components of Linux?

What is a Linux distribution?

How is the Linux system architecture organised?

What are the steps of the Linux boot process?

How do you manage processes on Linux?

How does service management work on Linux?

How does user management work on Linux?

What is the Linux filesystem?

×

See in the glossary →