The kernel primitives, init systems, and tooling behind the world's most-deployed OS.
Understand Linux capability sets, exec transitions, file attributes, systemd and container boundaries, with a least-privilege audit workflow.
The correct order of operations for repairing a corrupted Linux filesystem, and what to do when the repair tool reports it can't fix something automatically.
Load average climbs while top shows idle CPU — this usually means processes stuck waiting on I/O, not CPU; here's how to find which one.
The difference between an oops and a full panic, how to read an oops call trace to identify the responsible driver, and when it's safe to ignore.
Recovering a Linux system that panics or hangs during boot right after a kernel or driver update, using boot menu options that don't require external rescue media.
A service failing only with SELinux enforcing needs the actual denial read from audit.log and fixed with a targeted policy module, not disabled protection.
Editing /etc/resolv.conf directly on a systemd-resolved system silently fails or reverts — the correct way to override DNS settings that persists.
systemctl reports start-limit-hit when systemd's crash-loop protection trips — clearing the rate limit is a distinct step after fixing the real cause.
Why a zombie process is actually harmless dead weight rather than a resource leak, and how to find the parent process that's actually responsible for clearing it.
Building a working AppArmor profile from scratch with complain mode and the log-based profile generator, rather than guessing at rules upfront.