Unix Course

Welcome to the complete Unix course — your roadmap from absolute beginner to a confident, production-grade Linux & DevOps engineer who automates servers safely every day.

Unix is a multi-user, multitasking operating system born at Bell Labs in 1969 — it powers macOS, Linux, Android and 96% of the world's top web servers.

Linux is a free, open-source Unix-like kernel created by Linus Torvalds in 1991 — combined with GNU tools, it became the operating system of the cloud.

A shell is the program that reads your typed commands, asks the kernel to run them, and prints the result — bash, zsh and fish are popular modern shells.

You can run Linux today inside WSL on Windows, with Docker on any OS, on a free cloud VM (AWS / GCP / Azure), or natively on a laptop with Ubuntu or Fedora.

The terminal is the text window where you talk to the shell — knowing your prompt, cursor, history (↑) and tab-completion makes you 10× faster.

Core commands like pwd, ls, cd, cat, echo and man form the alphabet of every Linux engineer.

cp, mv, rm, mkdir and touch are the four-letter verbs you will type thousands of times — master their flags.

Paths can be absolute (start with /) or relative (start from $PWD) — confusing the two is the #1 source of cron failures.

cat, less, head, tail and tail -f let you read tiny configs, paginate huge logs, and stream live output.

nano is the friendly editor for beginners; vim is the universal editor every Linux server already has — at least learn i, :wq, :q!.

Linux is multi-user — every file has an owning user and group, and every process runs as some user.

Do one thing well, work with plain text, compose with pipes — these 1970s rules still produce the most powerful automation in 2026.

Tab completion, !!, !$, Ctrl+R reverse search, aliases and tmux turn the terminal into a productivity superpower.

Best practices like set -euo pipefail, quoting variables, validating input, and never running as root separate hobby scripts from production-grade engineering.

The Filesystem Hierarchy Standard (FHS) places config in /etc, logs in /var/log, users in /home and binaries in /usr/bin — same on every distro.

/ is the single root of the Linux tree — every drive, USB stick and network share is mounted somewhere underneath, never as D: or E:.

Every file has read, write and execute bits for owner, group and others — written as -rwxr-x--- or numerically as 750.

chmod changes permissions — numeric (chmod 644 file) or symbolic (chmod u+x script).

chown user:group file changes the file's owner and group — essential after creating files as root or moving them between users.

A symlink is a pointer to another path — like a desktop shortcut.

A hard link is a second name for the same inode on disk — both names share the data and only delete it when the last link is removed.

find / -name '*.log' -mtime +30 -size +100M locates large old logs in seconds — the swiss-army knife of Linux housekeeping.

grep -rn 'ERROR' /var/log recursively scans logs with line numbers — combine with --include and -A/-B for context.

tar -czf out.tar.gz dir/ bundles files into a portable, compressed archive — the universal Unix backup format.

gzip, bzip2, xz and zstd trade speed vs ratio — zstd is the modern default for log archives.

df -h shows free space per partition; du -sh * shows what is hogging space — together they keep your servers healthy.

export NAME=value sets a variable for child processes; env lists them all — the standard way to configure 12-factor apps.

$PATH is the colon-separated list of directories the shell searches for executables — putting /usr/local/bin first lets you override system tools.

Use umask, sticky bits, setuid/setgid sparingly, and ACLs (setfacl) for fine-grained control on shared servers.

A shell script is just a text file of commands the shell will run top to bottom — the easiest way to automate any repeatable task on Linux.

Create script.sh, add #!/bin/bash as the first line, chmod +x script.sh, then run with ./script.sh.

NAME=jane defines a variable; echo "$NAME" reads it — no spaces around =, always quote the read.

read -p "Name: " name prompts for input; for sensitive values use read -s to hide what is typed.

if [[ $count -gt 0 ]]; then ...; fi branches your script based on numbers, strings or file tests like -f, -d, -z.

for f in *.log; do ...; done, while read line, until — the three loop forms cover virtually every batch task.

my_func() { echo "$1"; } defines a function; call as my_func value.

arr=(a b c) creates an array; access with "\${arr[0]}" and iterate with for x in "\${arr[@]}".

while IFS= read -r line; do ...; done < file.txt is the safe way to process a file line by line without breaking on spaces.

$1, $2, ...

Every command returns 0 (success) or non-zero (failure).

set -e exits on any error, trap 'cleanup' EXIT guarantees cleanup, and || { echo fail; exit 1; } handles a single command.

Run with bash -x script.sh to see every expanded command — the fastest way to find why a script behaves differently from the terminal.

Avoid useless cat file | grep (use grep file), prefer built-ins, batch find with -exec ...

Real scripts: rotate logs, snapshot databases, restart unhealthy containers, sync S3 — each one a 30-line bash file that saves hours per week.

Automation means turning manual SSH-and-type rituals into versioned scripts — fewer mistakes, faster recovery, audit trails for free.

Cron is the classic Unix scheduler — five time fields plus a command, run by the crond daemon every minute.

crontab -e opens your jobs in an editor; crontab -l lists them; jobs run with a minimal environment.

Schedule a backup at 2 AM with 0 2 * * * /usr/local/bin/backup.sh — always use absolute paths and redirect output to a log.

A 10-line bash script can collect CPU, RAM and disk every 5 min and alert when thresholds break — the foundation of every observability stack.

Automate daily tar.gz snapshots, weekly off-server rsync to S3, and monthly restore drills — backup that isn't tested doesn't exist.

logrotate compresses, renames and deletes old logs on a schedule — without it, log files grow until your disk dies at 3 AM.

find /tmp -mtime +7 -delete in cron keeps temp dirs sane; same pattern for old artifacts, build caches and rotated logs.

echo body | mail -s 'subject' ops@co sends an alert from a script — combined with thresholds it powers a poor-man's PagerDuty.

deploy.sh = pull artifact, stop service, swap symlink, start, health-check — atomic and reversible in one bash file.

df -P | awk 'NR>1 && $5+0 > 90' in cron paged ops before disks ever fill — three lines of bash, infinite peace of mind.

Restart crashed workers with systemd Restart=always, or a watchdog script that pgreps and systemctl restarts them.

Pin jobs to a non-root user, log to dated files, use flock to prevent overlapping runs, and document each cron line with a comment.

Never hard-code secrets — pull from .env with restricted perms, use SSH keys not passwords, and audit cron + sudoers regularly.

Real production combines bash scripts + systemd timers + Ansible playbooks + GitHub Actions — every piece versioned, reviewed and observable.

Advanced bash means parameter expansion (\${var//old/new}), here-docs, process substitution and arithmetic — power features that replace a lot of awk/sed.

sed is the stream editor: sed -i 's/old/new/g' file replaces in place — perfect for config tweaks across many servers.

awk is a column-aware mini language: awk '$3 > 100 {print $1}' filters and projects in one expression.

Regex powers grep, sed and awk — anchors, classes, quantifiers and groups let you match any text pattern in seconds.

ps, top, htop, nice, renice and cgroups control which processes run, when, and with what priority.

cmd &, jobs, fg, bg, nohup and disown let you launch long jobs and survive disconnects.

|, >, >>, 2>&1, <<EOF — five operators that compose every Unix tool into a custom pipeline.

kill -l lists 30+ signals; SIGTERM (15) is graceful, SIGKILL (9) is forceful, SIGHUP (1) often reloads config without restart.

Pipes, FIFOs (mkfifo), Unix sockets and shared memory let processes talk — the same primitives that power Docker, Postgres and Nginx.

Combine cut, tr, paste, join, sort -k and uniq -c to massage CSVs, logs and reports without ever opening Excel.

Parse Nginx, syslog and JSON logs with awk, jq and grep to count errors, find slow endpoints, and detect intrusions.

Profile with time, avoid sub-shells, prefer built-ins, batch I/O — a tuned bash pipeline can outperform a naive Python script 10×.

Split scripts into lib/ functions sourced with source ./lib/log.sh — testable, reusable and grep-able like real code.

Enterprise shell means linting with shellcheck, unit testing with bats, packaging into .deb/.rpm and shipping via internal repo.

Production-grade scripts use set -euo pipefail, trap handlers, structured logs, idempotent operations and exit codes that drive automation upstream.

Linux networking is built on TCP/IP — every connection is an IP+port, and the kernel routes packets via the routing table you can inspect with ip route.

SSH (Secure Shell) is the encrypted protocol every engineer uses to log into Linux servers — ssh user@host opens a shell over the network.

scp file user@host:/path copies files over SSH; rsync -avz is smarter — only sending changed bytes.

iptables and the modern nftables filter packets per rule chain; ufw wraps them with friendly commands like ufw allow 443.

Layer-by-layer: ping for IP, traceroute for routing, dig for DNS, curl -v for HTTP — solves 90% of 'site is down' alerts.

ping host tests reachability and latency; traceroute host shows every hop — together they isolate which network is broken.

ss -tulpn (modern) lists every TCP/UDP socket, the listening port and the owning process — indispensable for 'who's using port 8080?' Beginner analogy: think of Unix as a kitchen.

Disable unused accounts, enforce strong passwords with PAM, expire stale logins with chage, and audit with last + lastb.

Restrict /etc/shadow to root, remove world-write bits with find / -perm -o+w, and lock down /tmp with noexec mount option.

Generate keys with ssh-keygen -t ed25519, copy with ssh-copy-id, then disable password login in sshd_config — the gold standard for server access.

Logs live in /var/log and journalctl — auth.log, syslog, kern.log and per-app dirs tell you what happened and when.

fail2ban bans brute-force IPs, auditd records every syscall, and journalctl -p err surfaces kernel errors — basic SOC on a single VM.

Secure automation: vault secrets in HashiCorp Vault or aws secretsmanager, never echo them, and rotate SSH keys quarterly.

Production security = key-only SSH + ufw default-deny + unattended-upgrades + fail2ban + nightly lynis audits + offsite encrypted backups.

Enterprises layer SELinux/AppArmor, central LDAP/AD auth, MFA via PAM, SIEM-streamed audit logs, and CIS benchmarks across thousands of Linux hosts.

DevOps unites code + infrastructure + operations under one workflow — Linux + git + bash + a CI runner is the minimum viable DevOps stack.

CI runs tests on every commit, CD ships every green build to production — both run as bash scripts on Linux runners (GitHub Actions, GitLab, Jenkins).

Modern deploys: build artifact → push to registry → SSH into target or call k8s → swap version → health-check → roll back if red — all bash and curl.

Spin up Linux servers reproducibly with cloud-init, Terraform, Ansible or Pulumi — bake an AMI/image and treat servers as cattle, not pets.

docker build -t app:$SHA .

kubectl apply, helm upgrade and kustomize build in bash drive Kubernetes — and a one-line kubectl rollout undo recovers fast.

Pair Prometheus node_exporter on every Linux box with Grafana dashboards and Alertmanager — bash install.sh bootstraps it all.

Ship logs with vector, fluent-bit or journalctl --output=json to Loki / ELK / CloudWatch for searchable, retained, alertable logs.

AWS, GCP and Azure all expose CLIs that you call from bash: aws s3 sync, gcloud compute, az vm — automation in 5 lines.

Auto-runbooks: detect → page → snapshot logs → restart service → open ticket — every step a versioned bash script, fully audited.

Modern SaaS deploys 50× a day: PR → CI → preview env → merge → blue/green to prod → instant rollback — Linux + Docker + bash all the way down.

Enterprise monitoring stitches together Prometheus, Grafana, Loki, Tempo and PagerDuty — every component running on Linux and configured by bash + Ansible.

Lean startups run on Vercel/Fly.io/Render previews, GitHub Actions, a single Postgres on Linux and a 100-line deploy.sh — that's the entire ops team.

Real pipelines tag a release, build a Docker image, run integration tests, deploy to staging, gate on metrics, then promote to prod — orchestrated by bash.

Enterprises layer self-hosted runners, golden Linux images, secret stores, policy gates and audit pipelines on top of the same Unix primitives — at thousand-server scale.

Hands-on drills: navigate the filesystem, manage permissions, pipe commands, and write a 20-line backup script — repeat until automatic.

Challenges: write a script that finds the 10 largest files, parses Nginx logs into top URLs, and rotates logs older than 30 days.

Automation drills: schedule a healthcheck cron, build a 1-line backup-to-S3, write an idempotent install script for a new VM.

Admin tasks: add a user, configure ufw, install nginx via package manager, set up systemd service, and ship logs to journald.

Debug drills: a cron job works manually but fails at 2 AM, a service is using port 8080, a script consumes 100% CPU — find and fix in < 10 min.

Common interview questions: difference between hard and soft links, what happens during fork(), how pipes work, how to find a file using 100% disk.

A mock DevOps interview asks scenario questions: 'production is down — walk me through your Linux debugging from SSH to root cause in 10 minutes.' Beginner analogy: think of Uni…

Real scenarios: disk full, fork bomb, leaked SSH key, runaway cron — for each, the senior path from detection to remediation to postmortem.

Security drills: harden a fresh Ubuntu VM, audit sudoers, detect a brute-force attempt in auth.log, and rotate compromised SSH keys fleet-wide.

Performance tasks: profile a slow bash pipeline, replace a fork-heavy loop with built-ins, and tune a Postgres or Nginx host with sysctl.

Infrastructure drills: provision a 3-node cluster with Terraform, configure with Ansible, deploy a sample app, and add monitoring — end-to-end in < 1 hour.

Scripting assessments measure your fluency with set -euo pipefail, trap, getopts, idempotency and exit-code discipline — the senior bar.

CI/CD tasks: write a GitHub Actions workflow that lints + tests + builds Docker, gates merges on green, and deploys to a Linux preview environment.

Enterprise scenarios: 10K-server fleet patching, audit-log compliance for SOC2, golden-image bake pipelines, and centralised secret rotation.

Production automation drills: build an idempotent installer, an atomic deploy, a self-healing service watcher, and a one-button disaster-recovery restore.