The kernel primitives, init systems, and tooling behind the world's most-deployed OS.
How Linux capabilities split root's monolithic power into dozens of independent privileges, and why that's a meaningfully better security model than the traditional all-or-nothing setuid-root pattern.
The correct order of operations for repairing a corrupted Linux filesystem, why running fsck on a mounted filesystem is dangerous, and what to do when the repair tool itself reports it can't fix something automatically.
Load average is climbing but top shows plenty of idle CPU. This almost always means processes stuck waiting on I/O, not a CPU problem — here's how to actually find which one.
The difference between an oops and a full panic, how to read the call trace in an oops message well enough to identify the responsible driver, and when an oops is safe to ignore versus a sign of real trouble ahead.
Recovering a Linux system that panics or hangs during boot right after a kernel or driver update, using boot menu options that don't require external rescue media.
A service that works fine with SELinux disabled fails mysteriously with it enforcing. Here's how to read audit.log, generate a targeted policy module, and fix the actual denial instead of disabling protection.
Why editing /etc/resolv.conf directly often silently fails to change actual DNS behavior on systemd-resolved systems, and the correct way to override DNS settings that actually persists.
A service refuses to start at all, and systemctl reports start-limit-hit — this is systemd's own crash-loop protection, and it requires clearing the rate limit as a distinct step after fixing the real cause.
Why a zombie process is actually harmless dead weight rather than a resource leak, and how to find the parent process that's actually responsible for clearing it.
Building a working AppArmor mandatory access control profile from scratch using complain mode and the log-based profile generator, rather than guessing at rules upfront.