Keyboard shortcuts

Press or to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

The Linux Encyclopedia

“Linux is a cancer that attaches itself in an intellectual property sense to everything it touches.” — Steve Ballmer, Microsoft CEO (2001)

“We’re all going to have to get used to the fact that Linux is a major force in the operating systems world.” — Steve Ballmer (2016)

Welcome to The Linux Encyclopedia — a comprehensive, continuously growing reference for everything Linux. From the lowest levels of kernel memory management to the highest abstractions of cloud-native orchestration, this encyclopedia aims to be the definitive technical reference for anyone who works with, studies, or is curious about the Linux operating system and its ecosystem.


What Is Linux?

At its core, Linux is a Unix-like operating system kernel first released by Linus Torvalds on September 17, 1991. But “Linux” has come to mean much more than a kernel. It refers to an entire ecosystem:

  • The Linux kernel — the monolithic kernel that manages hardware, processes, memory, and system calls
  • GNU/Linux systems — the combination of the Linux kernel with GNU userland tools (Bash, Coreutils, GCC, glibc) that forms a complete operating system
  • Linux distributions — curated collections of the kernel, userland, package managers, and desktop environments packaged for end users
  • The broader ecosystem — cloud platforms, containers, embedded systems, supercomputers, and mobile devices all running Linux
graph TD
    subgraph "The Linux Ecosystem"
        A[Hardware: CPU, Memory, Storage, Network]
        B[Linux Kernel]
        C[GNU Userland: Bash, Coreutils, glibc, GCC]
        D[System Libraries: glibc, systemd, D-Bus]
        E[Desktop Environments: GNOME, KDE, Xfce]
        F[Applications: Browsers, Editors, Servers]
        G[Package Managers: apt, dnf, pacman]
        H[Distributions: Ubuntu, Fedora, Arch, Debian]
        I["Cloud & Containers: Kubernetes, Docker"]
        J["Embedded & IoT: Yocto, Buildroot"]

        A --> B
        B --> C
        B --> D
        C --> D
        D --> E
        D --> F
        C --> G
        G --> H
        H --> E
        H --> F
        B --> I
        B --> J
    end

The Scale of Linux in 2025

The numbers tell the story of Linux’s dominance:

DomainLinux Presence
Top 500 Supercomputers100% run Linux (since 2017)
Cloud Infrastructure~90% of cloud workloads (AWS, GCP, Azure)
Web Servers~77% of web servers (Netcraft, 2025)
Mobile Devices~72% via Android (Linux kernel)
Embedded SystemsDominant in routers, TVs, cars, industrial controllers
Desktop~4.5% global market share, growing steadily (StatCounter, 2025)
ContainersVirtually all container workloads run on Linux

The Linux kernel itself has reached 40 million lines of code as of kernel 6.14-rc1 (January 2025), with contributions from over 4,800 developers per year. It is the largest collaborative software project in human history.


Who This Encyclopedia Is For

This encyclopedia is written for a broad audience, from students encountering Linux for the first time to seasoned kernel developers looking for a quick reference:

Beginners and Students

If you’re new to Linux, start with the Foundations section. It covers the history, philosophy, and basic concepts you’ll need. Then explore Shell Scripting and System Administration for practical skills.

System Administrators and DevOps Engineers

The System Administration, Networking, Security, and Performance sections provide deep dives into the topics you deal with daily. The Containers and Virtualization sections cover modern infrastructure.

Application Developers

The System Programming section covers POSIX APIs, file I/O, process control, threading, and IPC. The Shell section covers scripting from fundamentals to advanced patterns. The Compilers section covers build toolchains.

Kernel Developers and Contributors

The Kernel section is the deepest technical reference in this encyclopedia, covering architecture, subsystems, drivers, memory management, scheduling, networking, synchronization, and more. The Debugging section covers the tools you need for kernel development.

Security Professionals

The Security section covers SELinux, AppArmor, capabilities, seccomp, secure boot, cryptography, and hardening. The Debugging section covers BPF, tracing, and forensic tools.

Embedded Systems Engineers

The Embedded section covers device trees, cross-compilation, U-Boot, Buildroot, Yocto, real-time Linux, and ARM/RISC-V architectures.


How This Encyclopedia Is Organized

This encyclopedia is organized into 18 major parts, each covering a broad domain of Linux knowledge. Topics cross-reference each other extensively — if a concept mentions something unfamiliar, chances are there’s a dedicated page for it.

Use the search function (press S or click the search icon) to find any topic quickly.

Overview of Parts

graph LR
    subgraph "Foundation Layer"
        A[Part I: Foundations]
        B["Part XVIII: History & Culture"]
    end

    subgraph "Kernel Layer"
        C[Part II: The Linux Kernel]
        D[Part XIII: Architecture-Specific]
    end

    subgraph "Development Layer"
        E[Part III: System Programming]
        F["Part IV: Shell & Scripting"]
        G[Part XII: Compiler Toolchains]
        H[Part XVII: Build Systems]
    end

    subgraph "Operations Layer"
        I[Part V: System Administration]
        J[Part VI: Networking]
        K[Part VII: Security]
    end

    subgraph "Modern Infrastructure"
        L[Part VIII: Virtualization]
        M[Part IX: Containers]
        N[Part X: Embedded Linux]
    end

    subgraph "Analysis Layer"
        O["Part XI: Debugging & Tracing"]
        P[Part XIV: Storage]
        Q[Part XV: Performance Tuning]
        R[Part XVI: Observability]
    end

    A --> C
    C --> E
    C --> I
    E --> I
    I --> J
    I --> K
    C --> L
    L --> M
    C --> N
    C --> O
    O --> Q
    Q --> R

Detailed Part Descriptions

PartTitlePagesDescription
IFoundations7History, philosophy, distributions, POSIX, Unix heritage, open source, licensing
IIThe Linux Kernel100+The deepest technical reference: architecture, processes, memory, filesystems, networking, drivers, synchronization, interrupts, block layer
IIISystem Programming20POSIX APIs, file I/O, process control, signals, threads, IPC, ELF, dynamic linking, io_uring
IVShell and Scripting12Bash, Zsh, Fish, POSIX shell, scripting fundamentals and advanced patterns, regex, sed/awk, grep, find, xargs
VSystem Administration20Package management, systemd, users/groups, permissions, networking config, disk management, LVM, RAID, backup, cron, logging, performance
VINetworking14OSI model, TCP/IP, DNS, DHCP, HTTP, TLS, SSH, VPN, routing, packet capture, troubleshooting, IPv6
VIISecurity20SELinux, AppArmor, capabilities, seccomp, PAM, audit, secure boot, cryptography, hardening, rootkits, Landlock, Yama, IMA, keyring
VIIIVirtualization9KVM, QEMU, libvirt, virtio, VFIO, virtual networking, virtual storage, Xen
IXContainers16Docker internals, Kubernetes, OCI, containerd, Podman, cgroups v2, namespaces, overlayfs, rootless, seccomp, security
XEmbedded Linux15ARM, RISC-V, device trees, U-Boot, Buildroot, Yocto, cross-compilation, Android, real-time, TEE, initramfs
XIDebugging and Tracing17GDB, ftrace, perf, BPF, eBPF, SystemTap, strace, Valgrind, KASAN, KFENCE, crash dumps, KGDB
XIICompiler Toolchains8GCC, Clang/LLVM, assembler, linker, make, CMake, Ninja, Rust for Linux
XIIIArchitecture-Specific7x86, ARM, RISC-V, MIPS, PowerPC, calling conventions, memory models
XIVStorage8Block I/O, SCSI, NVMe, RAID, LVM, SAN, Ceph, multipath
XVPerformance Tuning14CPU, memory, I/O, network, NUMA, kernel profiling, benchmarking, BPF CO-RE, PEBS, RAPL
XVIObservability9/proc, /sys, BPF/bpftrace, kprobes, tracepoints, metrics, Prometheus/Grafana, SystemTap
XVIIBuild Systems5Kernel build system, cross-compilation, package building, distro building, CI/CD
XVIIIHistory and Culture6Linus Torvalds, development model, notable versions, Tanenbaum debate, Unix timeline, subsystems

The Linux Operating System Architecture

Understanding Linux requires understanding the layered architecture from hardware to userspace applications. Here’s a high-level view of how the pieces fit together:

graph TB
    subgraph "User Space"
        APP1[Applications: nginx, Python, GCC]
        APP2[Desktop: GNOME, KDE]
        APP3[Containers: Docker, Podman]
        LIB[System Libraries: glibc, OpenSSL, zlib]
        INIT[Init System: systemd]
        SHELL[Shell: bash, zsh]
    end

    subgraph "Kernel Space"
        VFS[Virtual File System]
        SCHED[Process Scheduler]
        MM[Memory Manager]
        NET[Networking Stack]
        BLOCK[Block Layer]
        CHAR[Character Devices]
        IPC[IPC: pipes, sockets, shared memory]
        SECURITY[Security: LSM, capabilities, seccomp]
        IRQ[Interrupt Handling]
        MODULE[Module Loader]

        VFS --> EXT4[ext4]
        VFS --> XFS[XFS]
        VFS --> BTRFS[Btrfs]
        VFS --> PROC["/proc"]
        VFS --> SYSFS["/sys"]

        BLOCK --> IO_SCHED[I/O Schedulers]
        BLOCK --> DM[Device Mapper]
        BLOCK --> MD[Software RAID]

        NET --> TCP[TCP/IP]
        NET --> NETFILTER[Netfilter/iptables]
        NET --> XDP[XDP/eBPF]
    end

    subgraph "Hardware"
        CPU[CPU: x86, ARM, RISC-V]
        MEM[RAM]
        DISK[Storage: SSD, HDD, NVMe]
        NIC[Network: Ethernet, WiFi]
        GPU[GPU]
    end

    APP1 --> LIB
    APP2 --> LIB
    APP3 --> LIB
    LIB --> VFS
    LIB --> SCHED
    LIB --> MM
    LIB --> NET
    INIT --> SCHED
    SHELL --> LIB
    VFS --> BLOCK
    SCHED --> CPU
    MM --> MEM
    BLOCK --> DISK
    NET --> NIC
    CHAR --> GPU
    IRQ --> CPU

Kernel Space vs User Space

The most fundamental architectural distinction in Linux is between kernel space and user space:

  • Kernel space is where the kernel executes with full hardware access and no memory protection between components. The kernel manages hardware, schedules processes, handles interrupts, and provides system calls.
  • User space is where applications run with restricted privileges. Applications access hardware and kernel services through system calls — a well-defined API that acts as the boundary between user space and kernel space.
sequenceDiagram
    participant App as User Application
    participant Libc as glibc
    participant SC as System Call Interface
    participant K as Kernel Subsystem
    participant HW as Hardware

    App->>Libc: read(fd, buf, count)
    Libc->>SC: syscall(SYS_read, ...)
    SC->>K: vfs_read()
    K->>HW: DMA / PIO transfer
    HW-->>K: Data ready (interrupt)
    K-->>SC: Return bytes read
    SC-->>Libc: Return value
    Libc-->>App: Return bytes read (or error)

The Major Kernel Subsystems

The Linux kernel is organized into several major subsystems, each with its own maintainer team and mailing list. Understanding these subsystems is essential for navigating the kernel source tree and this encyclopedia:

Process Scheduler

The scheduler determines which process runs on each CPU core and for how long. Linux uses the EEVDF (Earliest Eligible Virtual Deadline First) scheduler (since kernel 6.6), replacing the earlier CFS (Completely Fair Scheduler). The scheduler supports real-time scheduling classes (SCHED_FIFO, SCHED_DEADLINE) and the new extensible scheduler framework (sched_ext).

→ See: Scheduler | CFS | EEVDF | Real-time Scheduling | sched_ext

Memory Management

The memory manager handles virtual memory, page tables, physical page allocation, slab caches, huge pages, NUMA balancing, swap, and the OOM killer. It is one of the most complex subsystems in the kernel.

→ See: Memory Overview | Virtual Memory | Page Allocator | Slab Allocator | Huge Pages | NUMA | OOM Killer

Virtual File System (VFS)

VFS provides an abstraction layer over all filesystems. It defines the interfaces (inode, dentry, superblock, file_operations) that filesystem implementations must provide. This allows Linux to support dozens of filesystem types simultaneously.

→ See: VFS | Inode | Dentry | ext4 | XFS | Btrfs

Networking Stack

The networking stack implements the full TCP/IP protocol suite, from socket interfaces through transport, network, and link layers. It includes Netfilter (firewalling), traffic control, XDP/eBPF for high-performance packet processing, and support for modern protocols.

→ See: Networking Overview | Sockets | TCP/IP | Netfilter | XDP | eBPF

Block Layer

The block layer sits between the filesystem and block device drivers. It handles I/O scheduling, request merging, device mapper (LVM, dm-crypt), and software RAID (md).

→ See: Block Overview | BIO | I/O Schedulers | Device Mapper

Device Drivers

The largest portion of the kernel source tree is device drivers — they account for over 60% of the code. Drivers are organized by bus type (PCI, USB, I2C, SPI) and device class (network, block, character, graphics).

→ See: Driver Overview | PCI | USB | Network Drivers | Character Devices

Interrupt Handling

Interrupts are the mechanism by which hardware notifies the kernel of events. Linux divides interrupt handling into top halves (fast, hardware-specific) and bottom halves (deferred work via softirqs, tasklets, and workqueues).

→ See: Interrupt Overview | Hardware Interrupts | Softirqs | Workqueues

Synchronization Primitives

With multiple CPUs accessing shared data, the kernel needs robust synchronization. Linux provides spinlocks, mutexes, RCU (Read-Copy-Update), semaphores, seqlocks, atomic operations, and more.

→ See: Sync Overview | Spinlocks | Mutexes | RCU | Atomic Ops


How to Use This Encyclopedia

  • Search: Press S or click the search icon to search across all pages
  • Table of Contents: Each page has a table of contents in the sidebar
  • Cross-references: Blue links connect related topics across the encyclopedia
  • Breadcrumbs: The top navigation shows your location in the hierarchy

Reading Paths

Depending on your goals, here are suggested reading paths:

Path 1: “I’m New to Linux”

  1. What Is Linux?
  2. History of Linux
  3. Unix Heritage
  4. POSIX
  5. Distributions
  6. Shell Overview
  7. Bash
  8. System Administration Overview

Path 2: “I Want to Understand the Kernel”

  1. Kernel Overview
  2. Kernel Architecture
  3. Boot Process
  4. System Calls
  5. Processes and Threads
  6. Memory Overview
  7. VFS
  8. Networking Overview

Path 3: “I’m a System Administrator”

  1. Admin Overview
  2. systemd
  3. Package Management
  4. Users and Groups
  5. Permissions
  6. Networking Config
  7. Disk Management
  8. LVM
  9. Firewall
  10. Performance

Path 4: “I’m a Security Professional”

  1. Security Overview
  2. Security Model
  3. Capabilities
  4. SELinux
  5. AppArmor
  6. Seccomp
  7. Secure Boot
  8. Hardening
  9. Audit

Path 5: “I Want to Develop Kernel Modules”

  1. Kernel Overview
  2. Kernel Architecture
  3. Modules
  4. Driver Overview
  5. Character Devices
  6. Kernel Build System
  7. Debugging Overview
  8. KGDB

Quality Commitment

Every page in this encyclopedia aims to:

  • Explain what a concept is and why it exists
  • Cover implementation details and internal mechanics
  • Discuss trade-offs and design decisions
  • Provide working examples and command outputs
  • Include diagrams (Mermaid) where they aid understanding
  • Link to official references and further reading
  • Cross-reference related topics throughout the book

All technical claims are verifiable against kernel source code, official documentation, or authoritative published sources. Where behavior varies between kernel versions, the version is noted.


Conventions Used in This Encyclopedia

Code Examples

Code examples use the following conventions:

# Commands you type are shown with a $ prompt
$ ls -la /proc/self/maps

# Output is shown without a prompt
total 0
-r--r--r-- 1 root root 0 Jul 22 10:00 auxv
// Kernel and C code examples are shown in full
#include <linux/module.h>
#include <linux/kernel.h>

static int __init hello_init(void) {
    pr_info("Hello, kernel!\n");
    return 0;
}
module_init(hello_init);

Diagrams

Diagrams use Mermaid syntax and are rendered inline. They illustrate architecture, data flow, state machines, and relationships between components.

Cross-References

Related topics are linked inline with arrows:

→ See: Related Topic

Version Notes

When behavior differs between kernel versions:

Note: The EEVDF scheduler replaced CFS in kernel 6.6 (October 2023).

Command Output

Real command output is preferred over hypothetical examples. When specific hardware or configuration is required, it is noted.


A Brief History of Linux

Understanding Linux requires understanding its history. Here are the key milestones:

YearEvent
1969Unix developed at AT&T Bell Labs by Ken Thompson and Dennis Ritchie
1983Richard Stallman announces the GNU Project
1985Free Software Foundation (FSF) founded
1989GPL v1 released
1991Linux kernel 0.01 released by Linus Torvalds (September 17)
1992Linux relicensed under GPL v2 (February); first distributions (Slackware, Debian)
1993NetBSD, FreeBSD, OpenBSD fork from 386BSD
1994Linux 1.0 released (March 14); Red Hat Linux founded
1996Linux 2.0 released — symmetric multiprocessor (SMP) support
1998“Open Source” term coined; Netscape open-sources Navigator (Mozilla)
1999Linux 2.2 released; Apache dominates web servers
2001Linux 2.4 released — USB, LVM, RAID, ext3
2003Linux 2.6 released — O(1) scheduler, preemptibility, 64-bit support
2004Ubuntu 4.10 “Warty Warthog” released
2005Git created by Linus Torvalds; Open Source Development Labs merges with FSF
2007GPL v3 released; Android announced
2008Chrome OS announced; Linux dominates cloud computing
2011Linux 3.0 released; Android becomes world’s most popular smartphone OS
2012Linux Foundation reports kernel is worth $1.4 billion to recreate
2015Linux 4.0 released — live kernel patching
2016Linux 4.6 — cgroup v2; Microsoft joins Linux Foundation
2019Linux 5.0 — initial support for AMD Radeon GPUs; io_uring
2020Linux 5.6 — WireGuard VPN merged; 32-bit Arm deprecation begins
2021Linux 5.10 LTS — nftables; 5.15 LTS — NTFS3 driver
2022Linux 6.0 — Rust support initial merge; io_uring improvements
2023Linux 6.5 — initial Wi-Fi 7 support; EEVDF scheduler (6.6)
2024Linux 6.8 — Xe GPU driver; bcachefs merged; 6.12 LTS — sched_ext
2025Linux 6.14 — 40 million lines of code; Rust driver expansion continues

→ See: Full History | Notable Versions | Linus Torvalds | Unix Timeline


Linux in the Modern World

Cloud Computing

Linux is the foundation of cloud computing. Every major cloud provider — Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure — runs primarily on Linux. Cloud-native technologies like Kubernetes, Docker, and Prometheus are all Linux-native.

→ See: Containers | Kubernetes | Virtualization

Mobile and Embedded

Android, the world’s most popular mobile operating system, runs on the Linux kernel. Beyond phones, Linux powers smart TVs, automotive infotainment systems (Automotive Grade Linux), network routers, industrial controllers, and spacecraft (SpaceX, NASA).

→ See: Embedded Overview | Android | ARM | Device Trees

Supercomputing and HPC

Every system on the TOP500 supercomputer list has run Linux since November 2017. High-performance computing relies on Linux for its customizability, performance, and support for specialized hardware (InfiniBand, GPUs, FPGAs).

→ See: Performance | NUMA | Networking

Artificial Intelligence and Machine Learning

The AI/ML revolution runs on Linux. NVIDIA’s CUDA, PyTorch, TensorFlow, and virtually all ML frameworks target Linux first. Training large language models requires Linux for GPU driver support, container orchestration, and cluster management.

The Internet of Things (IoT)

From Raspberry Pi to industrial sensors, Linux is the OS of choice for connected devices. The Yocto Project and Buildroot provide tools for creating custom Linux distributions for embedded hardware.

→ See: Yocto | Buildroot | RISC-V


The Linux Kernel Development Model

The Linux kernel has one of the most successful open-source development models in history. Understanding it helps explain why Linux has thrived for over three decades:

The Release Cycle

The kernel follows a time-based release cycle of approximately 9-10 weeks:

  1. Merge window (2 weeks): New features merged from subsystem trees into Linus’s tree
  2. Release candidates (rc1 through rc7-rc8, ~7 weeks): Bug fixes only, increasingly strict
  3. Final release: The kernel is released and the cycle begins again
  4. Stable releases: Critical fixes are backported to stable and longterm branches
graph LR
    A["Merge Window<br>~2 weeks"] --> B[rc1]
    B --> C[rc2]
    C --> D[rc3]
    D --> E[rc4]
    E --> F[rc5]
    F --> G[rc6]
    G --> H[rc7-rc8]
    H --> I[Final Release]
    I --> J[Stable Backports]
    J --> A

The Maintainer Hierarchy

The kernel uses a hierarchical maintainer model:

  • Linus Torvalds — overall maintainer, merges subsystem trees
  • Subsystem maintainers — maintain specific areas (networking, memory, filesystems, etc.)
  • Driver maintainers — maintain specific device drivers
  • The MAINTAINERS file — lists every subsystem and its maintainer(s)
# Find who maintains a subsystem
$ scripts/get_maintainer.pl -f drivers/gpu/drm/i915/
# Output lists maintainers, reviewers, and mailing lists

The Contribution Process

Contributing to the kernel follows a well-defined process:

  1. Write code following the kernel coding style (Documentation/process/coding-style.rst)
  2. Test thoroughly
  3. Generate patches with git format-patch
  4. Send patches to the appropriate mailing list using git send-email
  5. Respond to review comments
  6. Once approved, the maintainer sends a pull request to Linus

→ See: Development Model | Kernel Build System | Contributing


Glossary of Key Terms

TermDefinition
KernelThe core of the operating system that manages hardware and provides services to user space
System callThe interface between user space and kernel space (e.g., read(), write(), fork())
ProcessA running program with its own address space, file descriptors, and execution context
ThreadA lightweight process sharing an address space with other threads in the same process
VFSVirtual File System — the kernel abstraction layer over all filesystem implementations
SchedulerThe kernel component that decides which process/thread runs on each CPU
PageThe unit of memory management, typically 4 KB on x86
inodeA filesystem data structure representing a file (metadata, not the filename)
dentryDirectory entry — maps filenames to inodes
Block deviceA device that reads/writes data in fixed-size blocks (disk, SSD)
Character deviceA device that reads/writes data as a stream of bytes (terminal, serial port)
ModuleA piece of kernel code that can be loaded and unloaded at runtime
BPFBerkeley Packet Filter — now eBPF, a virtual machine for running programs in the kernel
cgroupControl group — a mechanism for limiting, accounting, and isolating resource usage
NamespaceA mechanism for partitioning kernel resources so that different processes see different views
Device treeA data structure describing hardware, used especially on ARM and RISC-V
initramfsInitial RAM filesystem — a root filesystem loaded into memory during boot
systemdThe init system and service manager used by most modern Linux distributions

→ See: Full Glossary


The Linux Kernel Source Tree

The kernel source tree is organized into directories that mirror the subsystem structure. Understanding this layout is essential for navigating the code:

linux/
├── arch/           # Architecture-specific code (x86, arm64, riscv, etc.)
│   ├── x86/        # x86-specific: boot, vDSO, entry code, KVM
│   ├── arm64/      # ARM 64-bit: boot, device trees, exceptions
│   └── riscv/      # RISC-V: boot, vector extensions
├── block/          # Block layer: BIO, I/O schedulers, device mapper
├── certs/          # Signing certificates for secure boot
├── crypto/         # Cryptographic API and algorithms
├── Documentation/  # Kernel documentation (reStructuredText)
├── drivers/        # Device drivers (largest directory)
│   ├── gpu/        # Graphics drivers (DRM subsystem)
│   ├── net/        # Network device drivers
│   ├── scsi/       # SCSI subsystem drivers
│   ├── usb/        # USB subsystem drivers
│   └── ...         # 50+ driver subdirectories
├── fs/             # Filesystem implementations
│   ├── ext4/       # ext4 filesystem
│   ├── xfs/        # XFS filesystem
│   ├── btrfs/      # Btrfs filesystem
│   ├── proc/       # /proc filesystem
│   └── ...         # 50+ filesystem types
├── include/        # Header files
│   ├── linux/      # Core kernel headers
│   ├── uapi/       # User-space API headers
│   └── asm-generic/# Architecture-independent asm headers
├── init/           # Kernel initialization (main.c, do_mounts.c)
├── io_uring/       # io_uring subsystem
├── ipc/            # Inter-process communication (SysV IPC, POSIX)
├── kernel/         # Core kernel: scheduler, signals, time, BPF
├── lib/            # Kernel library routines (string, sort, etc.)
├── mm/             # Memory management
├── net/            # Networking stack
│   ├── ipv4/       # TCP/IP v4
│   ├── ipv6/       # TCP/IP v6
│   ├── netfilter/  # Packet filtering (iptables/nftables)
│   └── ...         # Protocol implementations
├── rust/           # Rust language support
├── scripts/        # Build scripts, helper tools
├── security/       # Security frameworks (LSM, SELinux, AppArmor)
├── sound/          # Audio subsystem (ALSA)
├── tools/          # User-space tools (perf, BPF, selftests)
├── usr/            # initramfs generation
└── virt/           # Virtualization (KVM)

The kernel tree contains over 40 million lines of code (as of 2025), with the drivers/ directory alone accounting for over 60% of the total. The Documentation/ directory contains thousands of files covering every subsystem and API.

Key Files

FilePurpose
MAINTAINERSLists every subsystem, its maintainer(s), and mailing list
COPYINGGPL v2 license text
KconfigKernel configuration system definitions
MakefileTop-level build system
READMEBuild instructions and overview
CREDITSContributors to the kernel
Documentation/process/coding-style.rstKernel coding style guide
# Count lines of code in the kernel tree
$ find . -name '*.c' -o -name '*.h' | xargs wc -l | tail -1
# As of 6.14-rc1: ~40,000,000 lines

# Count the number of source files
$ find . -name '*.c' | wc -l
# Approximately 80,000+ C source files

# See the MAINTAINERS file for a subsystem
$ head -50 MAINTAINERS

Getting Started with Linux

If you’re completely new to Linux, here’s how to get hands-on experience:

Option 1: Use a Distribution in a Virtual Machine

The easiest way to experiment without affecting your main system:

# Install VirtualBox, VMware, or use QEMU
# Download an ISO from a major distribution:
#   - Ubuntu: https://ubuntu.com/download
#   - Fedora: https://fedoraproject.org/
#   - Debian: https://www.debian.org/

# Create a VM with:
#   - 2+ CPU cores
#   - 4+ GB RAM
#   - 20+ GB disk
# Boot from the ISO and follow the installer

Option 2: Windows Subsystem for Linux (WSL)

On Windows 10/11, WSL provides a full Linux environment:

# In PowerShell (Administrator)
> wsl --install -d Ubuntu
# Restart, then open Ubuntu from Start menu

Option 3: Use a Live USB

Most distributions offer a “live” mode that runs entirely from a USB stick without installing:

# Download the ISO
# Write to USB with dd (Linux/macOS) or Rufus (Windows)
$ sudo dd if=ubuntu-24.04-desktop-amd64.iso of=/dev/sdX bs=4M status=progress
# Boot from USB (change boot order in BIOS/UEFI)

Option 4: Cloud Instance

Spin up a Linux server in the cloud:

# AWS: Launch an EC2 instance with Amazon Linux or Ubuntu
# GCP: Create a Compute Engine instance
# Azure: Create a Virtual Machine
# DigitalOcean: Create a Droplet ($4/month)

Essential First Steps

Once you have a Linux system, try these commands:

# See what kernel version you're running
$ uname -a
Linux myhost 6.8.0-40-generic #40-Ubuntu SMP x86_64 GNU/Linux

# See system information
$ cat /etc/os-release
NAME="Ubuntu"
VERSION="24.04 LTS (Noble Numbat)"

# Explore the filesystem hierarchy
$ ls /
bin  boot  dev  etc  home  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var

# See running processes
$ ps aux

# See disk usage
$ df -h

# See memory usage
$ free -h

# Get help on any command
$ man ls
$ man 2 read    # Section 2: system calls
$ man 3 printf  # Section 3: library functions

Linux Distributions: Choosing Your Starting Point

A Linux distribution (“distro”) packages the kernel, userland, package manager, and usually a desktop environment into a coherent system. Hundreds of distributions exist, but most are derived from a handful of major base distributions:

Major Distribution Families

graph TD
    DEB[Debian] --> UBUNTU[Ubuntu]
    DEB --> MINT[Linux Mint]
    DEB --> RASP[raspbian]
    UBUNTU --> POP[Pop!_OS]
    UBUNTU --> KUBUNTU[Kubuntu]
    UBUNTU --> WSL[Ubuntu on WSL]

    RHL[Red Hat Linux] --> FEDORA[Fedora]
    RHL --> RHEL[RHEL]
    RHEL --> CENTOS[CentOS Stream]
    RHEL --> ROCKY[Rocky Linux]
    RHEL --> ALMA[AlmaLinux]
    FEDORA --> FEDORA_CORE[Fedora CoreOS]

    SLACK[Slackware]
    ARCH[Arch Linux] --> MANJARO[Manjaro]
    SUSE[SUSE Linux] --> OPENSUSE[openSUSE]
    GENTOO[Gentoo]
    ALPINE[Alpine Linux]

Distribution Comparison

DistributionBasePackage ManagerBest For
UbuntuDebianapt (.deb)Beginners, servers, cloud
FedoraIndependentdnf (.rpm)Developers, cutting-edge
DebianIndependentapt (.deb)Stability, servers
Arch LinuxIndependentpacmanAdvanced users, learning
RHELFedoradnf (.rpm)Enterprise servers
openSUSEIndependentzypper (.rpm)Enterprise, desktop
AlpineIndependentapkContainers, minimal systems
GentooIndependentPortage (source)Maximum customization
NixOSIndependentNixReproducible builds
Linux MintUbuntuapt (.deb)Desktop, Windows switchers

→ See: Distributions | Package Management


The POSIX Standard and Portability

POSIX (Portable Operating System Interface) is a family of IEEE standards (IEEE 1003) that define the API, shell, and utility interfaces for Unix-like operating systems. POSIX compliance is what makes it possible to write software that runs on Linux, macOS, FreeBSD, and other Unix-like systems with minimal changes.

Key POSIX standards:

  • POSIX.1 (IEEE Std 1003.1): Core system calls and functions (fork(), exec(), read(), write(), open(), etc.)
  • POSIX.1b (Real-time extensions): Real-time signals, timers, message queues, semaphores
  • POSIX.1c (Threads): pthreads API (pthread_create(), pthread_mutex_lock(), etc.)
  • POSIX.2 (Shell and Utilities): Command-line utilities (ls, grep, sed, awk, etc.)

Linux is largely POSIX-compliant but not certified. It adds many extensions beyond POSIX (epoll, io_uring, inotify, etc.) that provide superior performance or functionality.

// A POSIX-compliant program that works on Linux, macOS, FreeBSD, etc.
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/wait.h>

int main(void) {
    pid_t pid = fork();
    if (pid == 0) {
        // Child process
        printf("Child: PID %d\n", getpid());
        exit(0);
    } else if (pid > 0) {
        // Parent process
        int status;
        waitpid(pid, &status, 0);
        printf("Parent: child %d exited with %d\n", pid, WEXITSTATUS(status));
    } else {
        perror("fork");
        exit(1);
    }
    return 0;
}

→ See: POSIX | System Calls | Process Control


The Shell: Your Interface to Linux

The shell is the command-line interface to Linux. It reads commands, interprets them, and executes programs. Understanding the shell is essential for every Linux user and administrator.

Linux offers multiple shells:

ShellDescriptionDefault On
BashBourne Again Shell — the most widely used shellMost distributions
ZshZ Shell — advanced features, Oh My Zsh ecosystemmacOS (since Catalina), Kali
FishFriendly Interactive Shell — user-friendly, auto-suggestionsSome desktop distros
DashDebian Almquist Shell — fast, POSIX-compliantUbuntu (as /bin/sh)
mkshMirBSD Korn Shell — lightweight, embedded systemsAndroid (as /system/bin/sh)
# Basic shell operations
$ echo "Hello, Linux!"
Hello, Linux!

# Pipes and redirection
$ ps aux | grep nginx | wc -l
3

# Command substitution
$ echo "Today is $(date +%A)"
Today is Wednesday

# Control structures
$ for f in /etc/*.conf; do echo "$f"; done
/etc/adduser.conf
/etc/ca-certificates.conf
...

# Scripting
$ cat > hello.sh << 'EOF'
#!/bin/bash
echo "Hello from $0"
echo "Arguments: $@"
EOF
$ chmod +x hello.sh
$ ./hello.sh world
Hello from ./hello.sh
Arguments: world

→ See: Shell Overview | Bash | Scripting Fundamentals | POSIX Shell


How Linux Boots: From Power Button to Login Prompt

Understanding the boot process helps with troubleshooting and system configuration:

sequenceDiagram
    participant FW as Firmware<br>(BIOS/UEFI)
    participant BL as Bootloader<br>(GRUB/systemd-boot)
    participant K as Kernel
    participant IR as initramfs
    participant INIT as Init System<br>(systemd)
    participant DM as Display Manager

    FW->>BL: Load bootloader from disk
    BL->>K: Load kernel + initramfs into memory
    K->>K: Decompress, initialize hardware
    K->>IR: Mount initramfs as root
    IR->>IR: Load essential drivers
    IR->>K: Mount real root filesystem
    K->>INIT: Execute /sbin/init (PID 1)
    INIT->>INIT: Start services (units)
    INIT->>DM: Start graphical login
    DM->>DM: User logs in

The key stages are:

  1. Firmware (BIOS or UEFI) performs POST and loads the bootloader
  2. Bootloader (GRUB, systemd-boot, or U-Boot on embedded) loads the kernel
  3. Kernel initializes hardware, mounts the root filesystem, starts PID 1
  4. Init system (systemd on most modern distros) starts all services
  5. User space — login shell or graphical desktop

→ See: Boot Process | systemd | GRUB | initramfs


Contributing to This Encyclopedia

This is a living document. If you find errors, gaps, or areas that could be improved, contributions are welcome. Every page follows a consistent structure:

  1. Introduction — What is this topic and why does it matter?
  2. Background — Historical context and motivation
  3. Technical Details — How it works internally
  4. Examples — Working code and command examples
  5. Diagrams — Visual representations where helpful
  6. Trade-offs — Design decisions and their implications
  7. References — Links to authoritative sources

References


This encyclopedia is released under the GNU Free Documentation License v1.3. Last updated: July 2025.