Not another cheat sheet. These are the longer reads — the ideas, habits and hard-won reflexes behind the commands. Written by people who spend their days in a shell, for anyone who wants to think about Linux, not just type it.
List open sockets, find which process owns a port, filter by state, and monitor live connections. The modern iproute2 replacement for netstat.
read →Write a complete .service unit file from scratch, enable it on boot, and configure automatic restart on failure. Run any script or app as a Linux daemon.
read →Filter systemd logs by unit, time window and priority level — and follow services live. Includes one-liners for on-call debugging and journal cleanup.
read →Check how full your filesystems are with df, then drill down to the exact directory eating space with du. Includes the sort pipeline, inode checks, and a one-liner cron alert.
From shebang to a working backup tool — variables, arguments, conditionals, loops, functions, and the set -euo pipefail safety trio that stops silent failures.
The in-kernel SMB server's EA handler overwrites kernel heap in compound SMB2 requests — no credentials, CVSS 9.8. Check if ksmbd is loaded and patch now.
read →Replace cron with a .timer + .service pair — OnCalendar, persistence, and journald debugging.
read →Create, list, and extract archives with gzip, bzip2, and xz compression. Plus piped SSH transfers, incremental backups, and deployment artifact packaging.
read →Turn any list of filenames, URLs or strings into command arguments — xargs, -I{}, -P for parallel runs, and -0 to handle spaces safely. With copy-paste recipes.
Download files, probe REST APIs, send JSON payloads, set headers and tokens, follow redirects, and debug HTTP connections — all from the terminal.
read →Read, set and persist environment variables — from export and ~/.profile to systemd, cron, Docker and .env files, plus the security caveats.
New Hardware Enablement images for Mint 22.3 "Zena" land kernel 7.0 with updated GPU and firmware support, plus a series-tracking Kernel Manager with auto-cleanup and protected-kernel marking.
read →Greg Kroah-Hartman's August 9 release patches use-after-free bugs in SCTP, TIPC, and mac80211, closes USB serial heap overflows, and fixes AMD/Intel/VMware GPU driver issues.
read →Sessions survive disconnection, windows are tabs, panes are splits — master the three-concept model that makes long-running remote work bulletproof.
read →Define services, networks, volumes and environment variables in one docker-compose.yml, then bring a whole multi-container app up with a single command.
read →Substitute, delete, insert and transform text from the command line — sed works on any file size, composes into pipelines, and runs on every Linux system with no dependencies.
read →Split lines into fields, filter by pattern, compute totals and group with arrays — awk turns a wall of text into a structured answer without leaving the terminal.
read →The August 2026 ISO ships the first experimental Server Edition installer profiles, rewrites the Shelly package manager from C# to Zig, and migrates the chwd kernel-manager backend from C++ to Rust.
read →Generate an ed25519 keypair, copy it to your server, and turn off password logins — the standard, safer way to reach a Linux box.
read →RC7 restores the Btrfs COW fixup worker removed during the merge window, ending silent data loss with no user-visible warning, and closes an eight-year-old use-after-free race in the kernel page-table walker. Stable 7.2 targets mid-August.
read →Developer osy releases Triton v0.2.1 — the first open-source DirectX 11 GPU driver for QEMU/KVM. DDI-level translation routes D3D11 through Neptune VirtIO to DXVK on the Linux host, skipping DLL replacement entirely and passing anti-cheat checks.
read →The 8 August development release patches Wayland's double-sRGB colour wash and 4:3 fullscreen offset, closes a 2006 MSXML3 crash, adds BCrypt KDF algorithms, and brings ARM64EC MinGW support in 41 bug fixes.
read →A hands-on walkthrough: pick a base image, layer in COPY, RUN and CMD, build and run — then make it production-shaped with .dockerignore, a non-root user and a multi-stage build.
The 5 August quarterly drop lands VK_EXT_mesh_shader in NVK, Rusticl crosses OpenCL 3.1, Vulkan 1.4 arrives on Apple Silicon via KosmicKrisp, and the new KRAID compiler replaces the old shader path on Arm Mali.
Greg Kroah-Hartman signed off Linux 7.1.6 on August 3 with 741 commits from 403 developers — 646 carry a Fixes: tag. Networking (169 patches), AMD GPU, KVM/SVM, CIFS, OpenVPN and 150+ memory-safety fixes. How to update any distro and verify the running kernel.
MIT CSAIL's TONTOU attack (CVE-2026-68480) fires a timed interrupt into the two-instruction window where AMD's Safe-RET isn't yet safe, leaking kernel memory as an unprivileged user. Affected Zen 1–4, the six-byte window, and the patched kernels to reboot into.
A 16-bit length wraparound in the Open vSwitch datapath (CVE-2026-64531, CVSS 7.8) lets any local user reach root — and the module autoloads even on hosts that never touch OVS. Patched kernels, the unshare door, and how to blacklist the module today.
Search files and pipelines by pattern with -i, -r, -n and -w, invert with -v, count with -c, and print context with -A/-B/-C — plus the regex gotcha (-F for literal strings) that trips everyone up.
The Aug 5 point releases patch a GDM autologin bypass and login-daemon DoS, plus GLib CVE-2026-15588 — a D-Bus pre-auth flaw that ships far beyond the desktop. What to update, and the lsof step people skip.
The Rust-written linker that wants to out-run mold reached 0.10 on Aug 4. New: --gdb-index for quicker debugger startup, a Btrfs/VFAT mmap fix that speeds up your builds for free, plus early 32-bit and WebAssembly work.
The Aug 5 out-of-band release patches a kernel privilege-escalation bug (CVE-2026-64560) and 21 Expat XML flaws (DSA-6404-1). Both sit on stock Debian and Ubuntu too — what to check, update and reboot.
Search by -name, -type, -size, -mtime and -perm, combine tests with -o and !, then act on the matches with -exec, -delete and xargs — with safe, copy-paste examples and the off-by-one -mtime gotcha explained.
The July 31 release adds a startup check: nano now refuses to run when its output isn't a real terminal — quietly fixing hung git commit, cron and CI jobs that set EDITOR=nano. Plus a --newbuffer synonym and crash fixes.
Google now publishes official aarch64 .deb and .rpm Chrome packages — Widevine included — closing a six-year gap for Raspberry Pi, Ampere and cloud Arm Linux users.
CVE-2026-46242 is a use-after-free race in ep_remove() that turns any unprivileged user into root on kernels 6.4+. The exploit is public and ~99% reliable — what's hit and how to patch it.
The five time fields, crontab -e, @daily shortcuts, and the two silent killers — a bare PATH and unread output — that break jobs. Plus when a systemd timer fits better.
Copy, mirror and back up with one command that moves only what changed. The flags that matter — -avh, --dry-run, --delete — syncing over SSH, and the trailing-slash rule everyone gets wrong.
What -rwxr-xr-- really means, how chmod's symbolic and octal modes map to the same nine bits, plus chown, umask and the setuid/setgid/sticky bits behind every "Permission denied".
Start, stop, enable and debug daemons from one command. The systemctl moves every admin actually uses — plus --now, masking, drop-in overrides and daemon-reload.
Stop retyping long ssh commands. A few lines in ~/.ssh/config turn every host into a one-word alias — with keys, jump boxes and connection reuse handled for you.
Interfaces get redesigned every year, yet the shell you learned still runs. A look at why text keeps beating the button — and how to make the terminal feel like home.
read →An outage leaves fingerprints. Here is a repeatable method for turning a wall of journalctl noise into the single line that actually explains what broke.
The pipes, filters and glue you use to keep servers alive are most of a data pipeline already. This is the short path from grepping logs to answering real questions with them.
read →The tutorials teach you the syntax. The blog is where we sit with the ideas — why a tool exists, how to reason under pressure, and where the command line goes next.
The habits that separate someone who tolerates the shell from someone who's fluent in it — aliases, muscle memory, and the small ergonomic choices that compound over a career.
How to stay calm and systematic when a box is on fire. Reading logs, isolating variables and following a timeline instead of guessing — the detective work behind every clean fix.
Where the command line meets analytics and machine learning. Turning logs into datasets, running models locally, and the surprisingly short bridge from sysadmin to data work.
The Labs track follows the same tools you already trust — pipes, cron, containers — one step further, into analytics and AI you can run on the machines you administer.
Treat access logs and CSVs as tables you can query on the spot.
Keep the whole workflow on your own hardware — private and repeatable.
Move a script from your laptop to something that runs itself.