Linux, the shell and scripting

Almost every server, container and pipeline runner is Linux. These are the commands and ideas you use daily.

File permissions

Also called chmod, chown, rwx

What: Each file has an owner, a group and read, write and execute bits for owner, group and others. chmod 640 means owner read-write, group read, others nothing. chown changes the owner.
Why: Wrong permissions either break apps (a service cannot read its config) or leak secrets (a private key readable by everyone).

Shell

ls -l app.env
chmod 600 ~/.ssh/id_ed25519
chmod +x deploy.sh
sudo chown -R www-data:www-data /var/www/app

Watch out

chmod -R 777 to make an error go away: it hides the real problem and lets any user modify the files.

Users, groups and sudo

Also called root, superuser, sudo

What: Linux runs everything as some user. root can do anything; sudo lets permitted users run single commands as root. Services usually get their own unprivileged user.
Why: Running apps as unprivileged users limits the damage when one is compromised, and sudo leaves an audit trail of who did what.

Processes and signals

Also called ps, kill, SIGTERM, SIGKILL, SIGHUP, signal

What: A process is a running program with a PID. Signals ask it to act: SIGTERM requests a clean shutdown, SIGKILL ends it immediately, SIGHUP often means reload config.
Why: Deploys, containers and Kubernetes stop apps with SIGTERM and then SIGKILL after a grace period, so apps must handle SIGTERM to finish requests.

Shell

ps aux | grep node
top
kill -TERM 4821
kill -9 4821

Watch out

Reaching for kill -9 first, which skips cleanup and can leave corrupted files or half-finished work.

systemd services

Also called systemctl, unit file, systemd

What: systemd is the init system on most distributions. It starts services from unit files, restarts them on failure and orders them at boot.
Why: It is how you keep an app, agent or reverse proxy running on a VM without a terminal open.

Shell

sudo systemctl status nginx
sudo systemctl restart nginx
sudo systemctl enable --now myapp
journalctl -u myapp --since "1 hour ago" -f

System logs

Also called journalctl, /var/log, journal

What: systemd collects service output in the journal, read with journalctl. Many apps still write files under /var/log, rotated by logrotate.
Why: Logs are the first place to look when a service will not start or keeps crashing.

Watch out

Logs that never rotate fill the disk and take the whole server down.

Pipes, grep, sed and awk

Also called pipeline, redirection, pipe

What: A pipe | sends one command's output into the next. grep filters lines, sed edits text streams, awk works with columns, and sort | uniq -c counts.
Why: Small tools chained together answer most operational questions about logs and output in one line.

Shell

grep " 500 " access.log | wc -l
awk '{print $1}' access.log | sort | uniq -c \
  | sort -rn | head
sed -i 's/^PORT=.*/PORT=8080/' .env
df -h; du -sh /var/log/*

Safe Bash scripts

Also called shell script, set -euo pipefail, Bash script

What: A Bash script is a file of commands with a shebang line. set -euo pipefail stops on errors, on unset variables and on failures inside pipes.
Why: Scripts glue deploys, backups and checks together. Without strict mode a failed step is ignored and the script carries on with broken state.

Shell

#!/usr/bin/env bash
set -euo pipefail

backup_dir="/backups/$(date +%F)"
mkdir -p "$backup_dir"
pg_dump "$DATABASE_URL" > "$backup_dir/db.sql"
echo "saved to $backup_dir"

Watch out

Unquoted variables such as rm -rf $dir/* break on spaces and, if empty, can delete the wrong files.

cron and systemd timers

Also called crontab, scheduled jobs, systemd timer, cron

What: cron runs commands on a schedule written as five fields: minute, hour, day of month, month, day of week. systemd timers do the same with logging and dependency handling.
Why: Backups, cleanups, certificate renewals and reports all run on schedules.
Example: 0 2 * * * /opt/scripts/backup.sh runs at 02:00 every day. */15 * * * * runs every 15 minutes.

Watch out

cron runs with a minimal environment and PATH, so a script that works in your shell fails silently at 2am.

Go deeper