Step-by-step, task-oriented guides - do this, in this order, to get this result.
Building a working AppArmor profile from scratch with complain mode and the log-based profile generator, rather than guessing at rules upfront.
Configuring the Linux audit daemon to watch specific files, commands, and syscalls, then actually query the resulting logs for something useful.
Using bind mounts to expose one directory at multiple paths, and OverlayFS to layer a writable surface on read-only content - the base of containers.
Using bpftrace's scripting language to observe live kernel behavior - syscalls, function calls, scheduler events - with lower overhead than older tools.
Using systemd's resource-control unit directives to cap CPU, memory, and IO for a service, and confirming the kernel actually enforces them.
Packaging a kernel module with DKMS so it automatically rebuilds against every new kernel version, instead of breaking silently on the next kernel update.
Creating a separate network stack on the same machine to test firewall rules or networked software without touching the host's real network.
A complete walkthrough reading, changing, and persisting kernel runtime parameters - with a few of the most commonly tuned examples explained, not just listed.
Creating and running a lightweight systemd-nspawn container - useful for isolated testing environments without a full container runtime's overhead.
Creating, listing, mounting, and cleaning up APFS local snapshots directly - the same mechanism Time Machine uses, available for manual, ad-hoc use.