The kernel primitives, init systems, and tooling behind the world's most-deployed OS.
A service failing only with SELinux enforcing needs the actual denial read from audit.log and fixed with a targeted policy module, not disabled protection.
Editing /etc/resolv.conf directly on a systemd-resolved system silently fails or reverts - the correct way to override DNS settings that persists.
systemctl reports start-limit-hit when systemd's crash-loop protection trips - clearing the rate limit is a distinct step after fixing the real cause.
Why a zombie process is actually harmless dead weight rather than a resource leak, and how to find the parent process that's actually responsible for clearing it.
Building a working AppArmor profile from scratch with complain mode and the log-based profile generator, rather than guessing at rules upfront.
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
Using bind mounts to expose one directory at multiple paths, and OverlayFS to layer a writable surface on read-only content - the base of containers.
Using bpftrace's scripting language to observe live kernel behavior - syscalls, function calls, scheduler events - with lower overhead than older tools.
Using systemd's resource-control unit directives to cap CPU, memory, and IO for a service, and confirming the kernel actually enforces them.
Packaging a kernel module with DKMS so it automatically rebuilds against every new kernel version, instead of breaking silently on the next kernel update.