util-linux — Collection Overview

util-linux is the grab-bag kernel-adjacent userland package: everything that talks to block devices, terminal lines, process attributes, system clocks, and login sessions but is not part of coreutils or the C library. mount, fdisk, lsblk, dmesg, cfdisk, taskset, unshare, hwclock — the tools you reach for at the storage layer, the scheduler layer, and the boot layer all come from here. This collection gives each binary its own page; this overview carries the package-level picture, the inventory, and the shared concepts.

Package Shape and Lineage

util-linux grew out of the 1993 merge of assorted Linux utilities that had no other home, absorbed the 4BSD-derived tools (col, hexdump, look, ul, write, wall lineage) over the 2010s, and is today maintained upstream on GitHub. Debian then re-splits it into binary packages by operational role: util-linux (the core), util-linux-extra (newer or niche tools such as fincore, lsirq, hwclock docs), mount (the mount/umount/losetup/swapon/swapoff set), fdisk (the three partitioning tools), uuid-runtime (uuidgen, uuidparse, uuidd), eject, and bsdextrautils (the absorbed BSD terminal tools). A minimal container can have one slice without the others — that fact alone answers a family of interview questions about thin images.

The package is one of the most conservative in Linux: the mount/fdisk option grammar of 20 years ago still works, and each release adds a handful of new tools (setpriv, uclampset, hardlink) rather than changing old ones. Modern releases moved aggressively toward libmount-based table output (findmnt-style JSON), which is why so many pages here show --json options.

Two tools that upstream once shipped are gone: raw(8) was removed in util-linux 2.37 (deprecated block raw devices — bind mounts and O_DIRECT replaced the use case), and pg(1) left Debian packaging years ago. They appear here only as history notes because interviews occasionally mention them.

The Inventory

Storage: identify, inspect, freeze (10)

Storage: partition and wipe (8)

Storage: filesystems, loop, swap (13)

Scheduling, privileges, namespaces (15)

Terminals and sessions (17)

System, clock, hardware (18)

Shared Concepts

• libmount table output: findmnt, lsblk, lscpu, lsipc, lsns share the --json/--list/export output machinery — scripts should pick one stable format and stick to it.
• Namespace pair: unshare creates new namespaces and runs a command; nsenter enters another process’s namespaces. Container debugging is mostly these two plus setpriv — see Process Management and Linux Internals for kernel context.
• Partition kernel-vs-disk state: partx/resizepart/addpart/ delpart manipulate the kernel’s view without rewriting the table; the fdisk family rewrites it. Knowing which side a tool operates on is the classic partitioning interview trap.
• The su family: su (PAM session), runuser (no PAM session), and the login-collection’s sulogin differ in session setup and audit trail — the su page holds the comparison.
• Boot path: initramfs hands off through switch_root; chroot-era tooling used pivot_root; both pages trace the handoff.
• Debian package splits listed above — a tool’s absence from a minimal image is a packaging question, not an upstream one.

Reading Order For Interview Prep

1. Storage core: mount, umount, lsblk, findmnt, fdisk, wipefs.
2. Process/namespace core: taskset, chrt, nsenter, unshare, setpriv, flock.
3. Boot/repair: dmesg, hwclock, switch_root, fsck, agetty.
4. Breadth: the tables above; the BSD-terminal tools (col, ul, colcrt) are low-yield trivia except at old-school shops.

Interview Questions

Q: Why does lsblk show a partition the kernel does not actually have?

lsblk reads sysfs; after you rewrite a partition table on a disk that is in use, the kernel’s view may be stale until you run partx -u (or partprobe from a different package). The fdisk family warns “re-reading the partition table failed” for exactly this reason. Kernel view vs on-disk table vs userspace display are three different states — the partitioning pages cover the reconciliation commands.

Q: What is the difference between unshare and nsenter?

unshare starts a command in NEW namespaces (creation); nsenter attaches to EXISTING namespaces referenced by /proc/<pid>/ns/* (entry). Debugging inside a container without a shell is the canonical nsenter use; building a test isolation sandbox is the canonical unshare use. Both need matching capabilities, and neither mounts a rootfs by itself — that is pivot_root/switch_root territory.

Q: Which util-linux tools would you use to prove a disk is the bottleneck?

blkid/lsblk to identify topology, blockdev --getra and --setra for readahead, fsfreeze to take a consistent snapshot point, fstrim maintenance on SSDs, and dmesg to catch device errors. The expected follow-up is iostat — procps and sysstat territory — so this page set deliberately hands off to procps.

Q: Why does flock exist when fcntl locks exist?

flock(2) locks are per open-file-description, advisory, and simple to use from shell pipelines (flock /tmp/lock cmd); fcntl/lockf record locks are byte-range, survive across fork differently, and are what NFS historically supported. The flock page walks the failure modes; the one-line cron-mutex idiom is the interview favorite.

References

• Source — GitHub
• Source — Debian sources
• Man page index — manpages.debian.org