Operating systems, infrastructure, emulation, and technical history.
The difference between an oops and a full panic, how to read an oops call trace to identify the responsible driver, and when it's safe to ignore.
Recovering a Linux system that panics or hangs during boot right after a kernel or driver update, using boot menu options that don't require external rescue media.
A service failing only with SELinux enforcing needs the actual denial read from audit.log and fixed with a targeted policy module, not disabled protection.
Editing /etc/resolv.conf directly on a systemd-resolved system silently fails or reverts — the correct way to override DNS settings that persists.
systemctl reports start-limit-hit when systemd's crash-loop protection trips — clearing the rate limit is a distinct step after fixing the real cause.
Why a zombie process is actually harmless dead weight rather than a resource leak, and how to find the parent process that's actually responsible for clearing it.
Building a working AppArmor profile from scratch with complain mode and the log-based profile generator, rather than guessing at rules upfront.
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
Using bind mounts to expose one directory at multiple paths, and OverlayFS to layer a writable surface on read-only content — the base of containers.
Using bpftrace's scripting language to observe live kernel behavior — syscalls, function calls, scheduler events — with lower overhead than older tools.