Linux & distributions

Configuration lives under /etc, persistent state under /var/lib and logs under /var/log. The split is by mutability and ownership: /usr holds static package-owned code, /etc holds locally editable configuration, /var holds data the machine writes while it runs.

A hard link is an extra name for the same inode, so every name is equal and the data survives until the last one is removed. A symbolic link is a separate small file holding a path string, resolved at every access.

Kernel names like /dev/sdb1 depend on device discovery order, so a new disk or a slow controller can renumber them and mount the wrong filesystem. Prefer UUID= from the filesystem superblock, or PARTUUID= from the partition table.

A loadable kernel module is kernel code — typically a driver or filesystem — shipped as a separate .ko file and inserted into the running kernel on demand. Code built in with =y is part of the kernel image itself and can never be unloaded.

/proc is procfs, a virtual filesystem with no storage behind it. The kernel generates each file's contents at the moment a process reads it, so the reported size is 0 while the data returned is a live snapshot of kernel state.

An Ubuntu version number is its release date in YY.MM form, so 24.04 means April 2024. A release ships every April and October; the April release of each even-numbered year is an LTS supported five years, while interim releases get nine months.

A snap is a self-contained, read-only squashfs image that the snapd daemon mounts under /snap and runs under confinement. It bundles its own dependencies, is versioned by revision rather than by the archive, updates itself automatically, and reaches the rest of the system only through declared interfaces.

A PPA is a Personal Package Archive: packages built and published on Launchpad by an individual or team, per Ubuntu series. Adding one means trusting that person's signing key with root on your machines, outside Canonical's security process, and it complicates every future release upgrade.

Nothing breaks on the day support ends, which is the danger: the release's security pocket simply goes quiet, so newly disclosed vulnerabilities in installed packages are never patched. The options are upgrading one LTS at a time, rebuilding on a current image, or buying Ubuntu Pro's ESM.

The snapd daemon auto-refreshes installed snaps from the Snap Store several times a day by default, so a snap can change version without any deploy. You can shift the schedule, hold refreshes, choose a slower channel or track, and revert a bad revision, but you cannot simply switch updating off forever.

Debian uploads always land in unstable (sid) and migrate automatically into testing after a few days without new release-critical bugs and with builds on every release architecture. Testing is periodically frozen and published as the next stable.

No. Debian freezes the upstream version deliberately and backports security and critical fixes into it, bumping only the Debian revision. When you truly need newer software, the sanctioned route is the backports suite, opted into one package at a time.

The prompt comes from debconf, driven by the package's config maintainer script. Set DEBIAN_FRONTEND=noninteractive to stop it asking, and preseed the answers you actually want with debconf-set-selections before the install so defaults are not silently chosen for you.

Debian gives you a freeze-based, released-when-ready platform with roughly two-year cycles, frozen package versions, community governance and no vendor subscription. Derivatives import Debian's source packages and rebuild them with their own patches, cadence and support terms. Choose on support obligations, release predictability and currency.

Only main is Debian proper: everything in it meets the Debian Free Software Guidelines and depends on nothing outside main. contrib holds free software that needs non-free components; non-free holds software failing the guidelines; non-free-firmware carves hardware firmware out of non-free. Redistribution terms differ per area.

A RHEL subscription gates access to Red Hat's package repositories, security errata and support — not the right to run the code. An unregistered host boots and runs normally, but has no update source until it is registered to an account.

CentOS Stream sits upstream of RHEL, not downstream: it is the rolling preview of the next RHEL minor release rather than a free rebuild of the current one. The downstream rebuilds are now AlmaLinux and Rocky Linux.

RHEL hosts can be pinned to a minor release with subscription-manager release --set, so updates come from that minor's content path. Without an Extended Update Support entitlement, that stream stops receiving fixes once the next minor ships, freezing you on known-vulnerable packages.

RHEL ships SELinux in enforcing mode with its targeted policy by default, so access is checked against policy as well as against ownership and mode bits. Ubuntu leaves most custom services unconfined, which is why the same file permissions behave differently on the two hosts.

Decide per workload, not per fleet. Segment the estate by what actually requires the vendor relationship — ISV certification, validated cryptography, an escalation path, life-extension options — keep those on RHEL, and move the rest, weighing the standing cost of operating two platforms.

zypper patch installs only issued advisories, zypper update moves installed packages to their newest versions, and zypper dup realigns the whole system with the enabled repositories, allowing downgrades and removals — it is the required update path on rolling Tumbleweed.

Tumbleweed is a rolling release carrying the newest tested packages, Leap is a fixed-release distribution built from SUSE Linux Enterprise sources, and SLES is the subscription product that adds certification and long-term maintenance on the same core.

SUSE's default Btrfs root has snapper take pre- and post-snapshots around every zypper transaction. The GRUB menu can boot the pre-update snapshot, and snapper rollback makes it permanent — reverting system state, not application data.

YaST is SUSE's integrated administration framework: modules for partitioning, network, users, services, bootloader and software behind one menu. On a headless server it runs as a text-mode interface over SSH, and its modules write the normal system configuration files.

Alpine ships musl libc, so the glibc dynamic loader the binary names in its ELF interpreter field is absent. The kernel's ENOENT refers to that missing loader, not to your file. Rebuild against musl, link statically, or install gcompat.

BusyBox is a single small binary that implements dozens of standard Unix commands as built-in applets, reached through symlinks named after each command. Alpine's userland is BusyBox, so the tools exist but support only a subset of GNU options.

musl implements its own built-in stub resolver instead of glibc's Name Service Switch. It ignores /etc/nsswitch.conf entirely, so NSS plugins never load, and it queries every nameserver in /etc/resolv.conf in parallel rather than in order.

Two musl defaults: its allocator is designed for small size and low fragmentation rather than multithreaded scalability, so allocation-heavy threads contend; and its default thread stack is far smaller than glibc's 8 MiB, so deep recursion in a spawned thread overruns it.

Alpine ships stable branches (v3.20 and friends) and one rolling branch called edge, each split into repositories: main, community, and testing which exists only on edge. Mixing edge into a stable system drags dependencies along and effectively converts it to a rolling system.