01 — Introduction & Architecture

┌─────────────────────────────────────┐
│          Applications               │  Firefox, nginx, your scripts
├─────────────────────────────────────┤
│     GNU Userspace (coreutils)       │  bash, ls, grep, awk, sed, gcc
├─────────────────────────────────────┤
│          System Libraries           │  glibc, systemd, PAM, NSS
├─────────────────────────────────────┤
│            Linux Kernel             │  scheduler, memory, drivers, VFS
├─────────────────────────────────────┤
│          Hardware (CPU/RAM/disk)    │
└─────────────────────────────────────┘

# Complex Implementation: count every syscall `ls` makes against /etc
# — reveals the true cost of "just listing a directory"
strace -c -e trace=openat,read,close,getdents64,statx ls /etc >/dev/null 2>&1

% time     seconds  usecs/call     calls    errors syscall
------ ----------- ----------- --------- --------- ----------------
  0.00    0.000000           0        10           openat
  0.00    0.000000           0        14           newfstatat
  0.00    0.000000           0         7           getdents64
  0.00    0.000000           0        31           close
  100.00    0.000000                    62           total

# NAIVE: 1 syscall per line — 1 million lines = 1 million syscalls
while IFS= read -r line; do
  printf '%s\n' "$line"
done < bigfile.txt
# ~10 seconds for 1M lines (syscall overhead dominates)

# PRODUCTION: batch I/O — read in chunks, process in userspace
# Use awk/sed (buffered I/O, orders of magnitude faster)
awk '{print}' bigfile.txt > /dev/null
# ~0.1 seconds for the same 1M lines — buffered read, no per-line syscall

# Complex Implementation: portable system identification — works across all distros
# /etc/os-release is FHS-specified (always present); lsb_release is not
. /etc/os-release                    # source it (sets $NAME, $VERSION_ID, etc.)
echo "Distro: $PRETTY_NAME"
echo "Kernel: $(uname -r)"
echo "Arch:   $(uname -m)"
echo "Kernel build: $(uname -v)"

# Edge case: $SHELL is your LOGIN shell, not your CURRENT shell
# If you ran `zsh` from bash, $SHELL still says /bin/bash
ps -p $$ -o comm=                   # the actual current shell

ls -ld /bin /sbin /lib              # show the symlinks
# lrwxrwxrwx 1 root root 7 ... /bin -> usr/bin
# lrwxrwxrwx 1 root root 7 ... /sbin -> usr/sbin
# lrwxrwxrwx 1 root root 7 ... /lib -> usr/lib

# Anti-Pattern: hardcoding /bin/bash in a shebang on a non-merged distro
# If the script is copied to an Alpine container (no /bin/bash, only /bin/sh),
# it breaks. Use #!/usr/bin/env bash for portability.

# Complex Implementation: detect if we're in a TTY, a terminal emulator, or SSH
# — drives behavior in scripts (color, interactive prompts)
if [ -t 1 ]; then
  # stdout is a terminal
  if [ "$(tty)" = "not a tty" ] 2>/dev/null; then
    echo "piped/redirected"
  else
    echo "interactive: $(tty)"
  fi
else
  echo "stdout redirected (not a tty)"
fi

# Detect SSH session
[ -n "$SSH_CONNECTION" ] && echo "SSH session" || echo "local"

# Complex Implementation: toggle a kernel parameter by writing to /proc/sys
# — IP forwarding for a router/VPN/Docker host
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward     # temporary (lost on reboot)
echo "net.ipv4.ip_forward = 1" | sudo tee /etc/sysctl.d/99-ip-forward.conf  # persistent
sudo sysctl -p /etc/sysctl.d/99-ip-forward.conf     # apply without reboot

# Read CPU info as a file (kernel generates content on-the-fly)
cat /proc/cpuinfo | head -5

# /dev/null — discard sink (writes vanish, reads give EOF)
echo "noise" > /dev/null
cat /dev/null > bigfile        # truncate bigfile to 0 bytes (common idiom)

# Edge Case: /proc and /sys are virtual — they exist in RAM, not on disk
ls -l /dev/sda /dev/null /etc /proc/cpuinfo
# brw-rw---- ... /dev/sda      (block device)
# crw-rw-rw- ... /dev/null     (character device)
# drwxr-xr-x ... /etc          (directory)
# -r--r--r-- ... /proc/cpuinfo (regular file — but virtual, generated on read)

# Anti-Pattern: backing up /proc, /sys, /dev
# du -sh /proc reports 0 or errors — it's all in-kernel
# tar must exclude them:
# sudo tar -czf backup.tar.gz --exclude=/proc --exclude=/sys --exclude=/dev /

man 5 crontab     # the crontab FILE format, not the command
man 2 open        # the open(2) SYSCALL, not any command
man -k cron       # search for "cron" across all sections