Linux Tips, Tricks and Tutorials on Linuxize

Bash Pattern Matching: =~ Operator and Regular Expressions

hello@linuxize.com (Linuxize) — Wed, 07 Oct 2026 14:45:00 +0200

Much of the string work in shell scripts is matching: does this filename end in .log, does this version number begin with v2, does this input contain only digits? Bash supports shell glob patterns, including the extglob extension, and POSIX extended regular expressions. Knowing which to use saves you from calling grep every time you want to ask a yes-or-no question about a string.

This guide explains how to use glob patterns, extglob, and the =~ regex operator inside [[ ]], including how to capture groups with BASH_REMATCH. Run the examples in Bash; [[ ]] and =~ are not POSIX sh syntax.

Glob Patterns vs Regex

Globs and regexes look alike but are not the same:

A glob is what the shell uses when it expands *.txt or data?.csv. Wildcards are * (any string), ? (any single character), and [abc] (a bracket expression matching one listed character).
A regex uses anchors (^, $), quantifiers (+, *, {m,n}), and grouping ((...)). Its syntax differs from globs: * repeats the preceding expression, while .* matches any string.

Bash supports globs in filename expansion and in pattern-matching constructs (case, [[ string == pattern ]]). The =~ operator inside [[ ]] uses POSIX extended regex. A glob must match the entire string, while an unanchored regex can match just part of it.

Glob Matching with [[ ]]

The == operator inside [[ ]] treats the right-hand side as a glob pattern. Leave the wildcard unquoted to check whether a filename ends in .log:

sh
file="server.log"

if [[ "$file" == *.log ]]; then
 echo "log file"
fi

output

log file

The *.log pattern matches server.log because * covers the filename before the suffix. To check a substring instead, surround it with *:

sh
file="server.log.2026-01-15"

if [[ "$file" == *log* ]]; then
 echo "contains 'log'"
fi

output

contains 'log'

Here, *log* matches the whole string with any characters before and after log. Use != to test that a string does not match a pattern, such as [[ "$file" != *.log ]].

For literal equality, quote the right-hand side. This also prevents wildcard characters inside a variable from becoming a pattern:

sh
file="server.log"
expected="server.log"

if [[ "$file" == "$expected" ]]; then
 echo "exact match"
fi

The example prints exact match. Quoting only part of a pattern makes that part literal while leaving unquoted wildcards active. For example, [[ "$file" == *"$substring"* ]] searches for the literal value of $substring. For other comparison operators, see our guide on comparing strings in Bash .

Character Classes

Globs and regexes both support bracket expressions. For example, [0-9] matches one digit:

sh
version="v2.5"

if [[ "$version" == v[0-9]* ]]; then
 echo "version starts with v then a digit"
fi

output

version starts with v then a digit

The pattern matches a leading v, one digit, and any remaining characters. The * does not mean “more digits”; it can also match periods, letters, and other characters.

The POSIX named classes work in patterns too: [[:alpha:]], [[:digit:]], [[:alnum:]], [[:space:]], [[:upper:]], [[:lower:]], and [[:punct:]]. They describe character categories in the current locale. Here we check for a leading letter and a digit later in the string:

sh
input="abc123"

if [[ "$input" == [[:alpha:]]*[[:digit:]]* ]]; then
 echo "starts with a letter and contains a later digit"
fi

The example prints the message, but it also accepts a-7? because each * matches arbitrary characters. To require only letters followed by digits, use the anchored regex ^[[:alpha:]]+[[:digit:]]+$ with =~, as explained below.

Extended Globs

Turn on the extglob shell option to use extended glob patterns in filename expansion and case statements:

Terminal
shopt -s extglob

Enable the option before Bash parses a function or compound command containing those patterns. Put the shopt command on its own line before the construct. Modern Bash also supports extended glob matching on the right of == and != inside [[ ]] without enabling the option.

Extended globs provide these constructs:

?(pattern-list) matches zero or one occurrence.
*(pattern-list) matches zero or more.
+(pattern-list) matches one or more.
@(pattern-list) matches one of the given patterns.
!(pattern-list) matches anything except the patterns.

pattern-list is one or more patterns separated by |. This example checks a fixed list of names, so you can run it without creating any files:

sh
shopt -s extglob

for f in report.jpg report.png notes.txt; do
 case "$f" in
 report.@(jpg|png|webp))
 printf 'image: %s\n' "$f"
 ;;
 esac
done

output

image: report.jpg
image: report.png

The two image names match report.@(jpg|png|webp), while notes.txt does not.

You can also exclude names during filename expansion. The following loop previews regular files in the current directory, excluding names ending in .tmp or .bak:

sh
shopt -s extglob nullglob

for f in !(*.tmp|*.bak); do
 [[ -f "$f" ]] || continue
 printf 'would process: %s\n' "$f"
done

The -f check skips directories. nullglob makes the loop run zero times if no names match, rather than treating the pattern as a filename. These shell options remain enabled in the current shell. With dotglob off (the default), hidden names are not included, and the pattern does not search subdirectories.

The =~ Regex Operator

Inside [[ ]], =~ matches the left-hand string against a POSIX extended regular expression on the right:

sh
input="192.168.1.10"

if [[ "$input" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
 echo "looks like an IPv4 address"
fi

output

looks like an IPv4 address

The pattern matches four groups of digits separated by literal periods. This is only a shape check: it also accepts 999.999.999.999 and does not validate octet ranges or leading zeros.

The anchors (^ and $) require the regex to match the whole string; without them, the pattern can match anywhere in the input. Bracket expressions ([0-9]) and quantifiers (+, *, ?, {m,n}) work with POSIX extended regex syntax.

Leave regex operators unquoted when you want Bash to interpret them. A fully quoted regex ("[0-9]+") is matched as a literal string. You can also store the pattern in a variable and expand that variable unquoted:

sh
input="192.168.1.10"
pattern='^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$'

if [[ "$input" =~ $pattern ]]; then
 echo "match"
fi

This prints match. The single quotes in the assignment preserve the regex text, including its backslashes. The unquoted $pattern on the right of =~ lets Bash interpret that text as a regex. Inside [[ ]], the expansion does not undergo word splitting or filename expansion.

The test returns status 0 for a match, 1 for no match, and 2 for an invalid regex. POSIX ERE does not provide PCRE lookarounds, named captures, or non-capturing groups. Use [[:digit:]] or [0-9] for digits instead of the PCRE shorthand \d.

Capture Groups with BASH_REMATCH

=~ populates the BASH_REMATCH array with the matched substrings. BASH_REMATCH[0] is the full match, and subsequent indices are the capture groups in order:

sh
input="version=2.5.3-rc1"

if [[ "$input" =~ version=([0-9]+)\.([0-9]+)\.([0-9]+)(-([a-z0-9]+))? ]]; then
 major="${BASH_REMATCH[1]}"
 minor="${BASH_REMATCH[2]}"
 patch="${BASH_REMATCH[3]}"
 suffix="${BASH_REMATCH[5]}"

 echo "major=$major minor=$minor patch=$patch suffix=$suffix"
fi

output

major=2 minor=5 patch=3 suffix=rc1

Groups 1 through 3 capture the version components. Group 4 contains -rc1, including the hyphen, and the nested group 5 contains rc1. If the optional suffix is absent, those captures are empty. This pattern searches for a version within the input; add ^ and $ if the entire value must match.

Read or copy the captures immediately after a successful test. A later successful =~ test replaces them, and a test that returns “no match” clears the array. Keep the test and the code reading BASH_REMATCH in the same shell, since a subshell does not update its parent shell’s array. For indexed array syntax, see our Bash arrays guide.

The case Statement

For several alternatives, case reads better than chained if [[ ]] blocks. Each clause contains glob patterns, and ;; ends the statement after the matching clause runs. Here we classify a filename extension:

sh
ext="png"
case "$ext" in
 jpg|jpeg|png|webp)
 echo "image"
 ;;
 mp4|mkv|webm)
 echo "video"
 ;;
 md|txt|rst)
 echo "text"
 ;;
 *)
 echo "unknown"
 ;;
esac

This prints image because png matches the first clause. The *) branch is the catch-all. In a case pattern, ^ and $ are not regex anchors, and a bare + is not a regex quantifier. Extended glob forms such as +(pattern) have their own syntax and require extglob here. See our Bash case statement guide for argument parsing and other branching examples.

Match File Extensions

A common task is splitting a filename into name and extension. Both globs and =~ work; pick what reads better.

Use parameter expansion to split off the last extension:

sh
file="report.tar.gz"
name="${file%.*}" # report.tar
ext="${file##*.}" # gz

The % operator strips the shortest suffix matching .*, leaving report.tar. The ## operator strips the longest prefix matching *., leaving gz. If there is no period, both expansions return the original value, so check the name before assuming it has an extension.

With =~, you can recognize several archive types and capture the base name:

sh
file="report.tar.gz"

if [[ "$file" =~ ^(.+)\.(tar\.gz|tar\.bz2|zip|7z)$ ]]; then
 base="${BASH_REMATCH[1]}"
 archive_type="${BASH_REMATCH[2]}"
 echo "archive base=$base type=$archive_type"
fi

output

archive base=report type=tar.gz

The second capture contains the complete tar.gz extension because it is one of the regex alternatives. Parameter expansion can also remove a known compound suffix directly: ${file%.tar.gz} gives report. Use the regex when you want to recognize several suffixes and capture which one matched. Our Bash parameter expansion guide covers the other prefix and suffix operators.

Anchoring and Whole-String Matches

Without ^ and $, =~ finds the pattern anywhere in the string:

sh
if [[ "abc1234def" =~ [0-9]+ ]]; then
 echo "contains digits"
fi

output

contains digits

The test succeeds because 1234 is a matching substring. To require the entire string to be digits, anchor both ends:

sh
if [[ "12345" =~ ^[0-9]+$ ]]; then
 echo "all digits"
fi

This prints all digits. Unlike =~, glob matching with == already checks the whole string; use * around a literal substring when you want to allow surrounding characters.

Bash regex matching can span newlines. In particular, . matches a newline, and ^ and $ anchor the complete string rather than each line. You can check this with a string containing an actual newline:

sh
input=$'a\nb'
pattern='^a.b$'

if [[ "$input" =~ $pattern ]]; then
 echo "matched across a newline"
fi

This prints matched across a newline. The $'a\nb' assignment creates the newline; writing \n in an ordinary single-quoted regex does not create one. If you need to match each line separately, read and test one line at a time.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Syntax	Purpose
`[[ "$value" == *.log ]]`	Match the entire value against a glob
`[[ "$value" == "$expected" ]]`	Compare literal strings
`[[ "$value" != *.log ]]`	Check that a value does not match a glob
`[[ "$value" =~ $pattern ]]`	Find a regex match anywhere in a value
`pattern='^[0-9]+$'`	Regex requiring one or more digits and nothing else
`${BASH_REMATCH[0]}`	Read the complete regex match after a successful test
`${BASH_REMATCH[1]}`	Read the first parenthesized capture
`${file%.tar.gz}`	Remove a known compound suffix

Troubleshooting

Quoted regex never matches
Quoting the entire right-hand side makes it literal. Store the regex in a variable and expand it as $pattern, not "$pattern", on the right of =~. You can still quote the string on the left.

Extglob patterns are a syntax error
For filename expansion or case, enable shopt -s extglob before Bash parses the construct containing the pattern. Enabling it inside the same function or compound command can be too late. For a bash -c command containing these patterns, use bash -O extglob -c '...' to enable the option before parsing.

Regex test returns status 2
The regex is syntactically invalid, and Bash prints an error such as [[: invalid regular expression. Check for unmatched brackets or parentheses and unsupported PCRE syntax such as (?:...). Bash may leave earlier captures in place after an invalid test, so read BASH_REMATCH only when the current test succeeds.

Captures are empty or belong to another match
Check the test result before reading BASH_REMATCH, and copy the values before another =~ test runs. If the match happens in ( ... ) or a command substitution, read the captures there rather than expecting them to reach the parent shell.

Conclusion

When you write a match, decide whether the whole value must conform to the pattern or whether a substring is enough, then check the right-hand quoting. If the match controls a script’s next action, put it inside an if statement and read any captures in the successful branch.

SSH Config Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 06 Oct 2026 18:20:00 +0200

File Locations

ssh reads the command line first, then your config, then the system config.

Path	Description
`~/.ssh/config`	Per-user client config
`/etc/ssh/ssh_config`	System-wide client config for every user
`/etc/ssh/ssh_config.d/*.conf`	System drop-ins, loaded by `Include` on Ubuntu and Debian
`chmod 600 ~/.ssh/config`	Recommended permissions; ssh rejects a file others can write
`ssh -F ~/alt-config host`	Use a different config file and skip the defaults
`ssh -F none host`	Ignore every config file

Inspect the Effective Config

Check what ssh will use before you connect.

Command	Description
`ssh -G host`	Print every option that applies to `host`, then exit
`ssh -G host \| grep -i proxyjump`	Check one option
`ssh -v host`	Show which config lines and keys are applied while connecting
`ssh -o User=admin host`	Override a config value for one connection
`ssh -T git@github.com`	Test a host without opening a shell

Host Patterns

A Host line starts a block that runs until the next Host or Match line.

Pattern	Matches
`Host web`	The alias `web` only
`Host web1 web2 db`	Any of the listed names
`Host *.example.com`	Every host under `example.com`
`Host 192.168.1.?`	Single-character wildcard
`Host *.example.com !legacy.example.com`	All but the negated host
`Host *`	Every host; put it at the end for defaults

The first value wins for most directives; repeated IdentityFile entries accumulate. Put specific blocks above general ones and Host * last.

Match Blocks

Match applies a block based on conditions, not just the name.

Directive	Description
`Match host db*`	Hostname after `HostName` is applied
`Match originalhost db*`	Name as typed on the command line
`Match user root`	Remote user
`Match localuser alice`	Local account running ssh
`Match host *.corp exec "nc -z vpn.corp 22"`	Apply only when a command exits 0
`Match all`	Close a conditional block and match everything again

Connection Basics

The directives most host blocks need.

Directive	Description
`HostName 203.0.113.10`	Real hostname or IP behind the alias
`User admin`	Remote login name
`Port 2222`	Remote port; default is `22`
`AddressFamily inet`	Force IPv4 (`inet6` for IPv6)
`ConnectTimeout 10`	Give up after 10 seconds
`ConnectionAttempts 3`	Retry the connection before failing
`Compression yes`	Compress traffic on slow links

Keys and Authentication

Pick the key per host and stop ssh from trying every key it has.

Directive	Description
`IdentityFile ~/.ssh/id_ed25519_work`	Private key for this host
`IdentitiesOnly yes`	Offer only the configured keys, not every agent key
`AddKeysToAgent yes`	Add the key to the running agent after first use
`CertificateFile ~/.ssh/id_ed25519-cert.pub`	SSH certificate to present
`PreferredAuthentications publickey`	Try public-key authentication only
`PasswordAuthentication no`	Disable password authentication; keyboard-interactive prompts can still occur
`KbdInteractiveAuthentication no`	Disable keyboard-interactive authentication, including its password prompts
`IgnoreUnknown UseKeychain`	Skip options that this ssh build does not know
`UseKeychain yes`	macOS only: store key passphrases in the keychain

Jump Hosts

Reach private hosts through a bastion.

Directive	Description
`ProxyJump bastion`	Connect through the `bastion` alias
`ProxyJump admin@bastion.example.com:2222`	Jump host with user and port
`ProxyJump bastion1,bastion2`	Chain several jump hosts in order
`ProxyJump none`	Disable jumping; place this before a matching broader block
`ProxyCommand ssh -W %h:%p bastion`	Older equivalent of `ProxyJump`
`ssh -J bastion internal`	Same jump from the command line

Keepalives

Stop idle sessions from being dropped by NAT or firewalls.

Directive	Description
`ServerAliveInterval 60`	Send a keepalive after 60 seconds without server data
`ServerAliveCountMax 3`	Disconnect after 3 unanswered keepalives
`TCPKeepAlive yes`	TCP-level keepalives; on by default

Multiplexing

Reuse one TCP connection for later sessions to the same host.

Directive or command	Description
`ControlMaster auto`	Open a master connection, or reuse an existing one
`ControlPath ~/.ssh/cm-%C`	Socket path; `%C` keeps it short and unique
`ControlPersist 10m`	Keep the master open 10 minutes after the last session
`ssh -O check host`	Check whether a master connection is running
`ssh -O exit host`	Close the master connection

Port Forwarding

Set up tunnels every time you connect to a host.

Directive	Description
`LocalForward 8080 localhost:80`	Local port 8080 to port 80 on the remote side
`LocalForward 3307 db.internal:3306`	Reach a host that only the server can see
`RemoteForward 9000 localhost:3000`	Remote port 9000 to local port 3000
`DynamicForward 1080`	SOCKS proxy on local port 1080
`ExitOnForwardFailure yes`	Abort if a forward cannot be set up
`ForwardAgent yes`	Forward your agent; set it only for trusted hosts
`ForwardX11 yes`	Forward X11 for GUI applications

Host Key Checking

Control how ssh treats new and changed server keys.

Directive	Description
`StrictHostKeyChecking ask`	Prompt for new hosts; the default
`StrictHostKeyChecking accept-new`	Trust new hosts, still refuse changed keys
`StrictHostKeyChecking yes`	Refuse any host not in `known_hosts`
`UserKnownHostsFile ~/.ssh/known_hosts_lab`	Separate `known_hosts` file for a group of hosts
`UserKnownHostsFile /dev/null`	Do not record keys; for throwaway VMs only
`HashKnownHosts yes`	Hash hostnames written to `known_hosts`
`UpdateHostKeys yes`	Accept additional keys the server announces

Session and Environment

Change what happens after you log in.

Directive	Description
`RemoteCommand tmux new -A -s main`	Run a command instead of a login shell
`RequestTTY yes`	Allocate a terminal; needed with `RemoteCommand` for interactive tools
`SetEnv APP_ENV=prod`	Send a variable; the server must allow it with `AcceptEnv`
`SendEnv LANG LC_*`	Pass local variables by name
`LogLevel ERROR`	Hide warnings; `DEBUG` for troubleshooting
`Include ~/.ssh/config.d/*`	Load more files; put it at the top of the file

Tokens

Expanded in ControlPath, IdentityFile, RemoteCommand, and similar directives. Supported tokens vary by directive.

Token	Expands To
`%h`	Remote hostname after `HostName`
`%n`	Hostname as typed on the command line
`%p`	Remote port
`%r`	Remote user
`%u`	Local user
`%d`	Local home directory
`%C`	Hash of local host, remote host, port, remote user, and jump-host setting
`%%`	A literal `%`

ProxyCommand accepts only %%, %h, %n, %p, and %r.

Troubleshooting

Problem	Check
`Bad owner or permissions on ~/.ssh/config`	Check ownership with `ls -l ~/.ssh/config`; the owner must be you or root. Fix incorrect ownership, then run `chmod 600 ~/.ssh/config`
`Bad configuration option`	Typo, or an option this ssh version lacks; see `man ssh_config`
Option is ignored	An earlier block set it first; check `ssh -G host`
`Too many authentication failures`	Add `IdentitiesOnly yes` and an `IdentityFile`
`Permission denied (publickey)`	`ssh -v host` and look for `Offering public key`
`too long for Unix domain socket`	Shorten `ControlPath`; use `%C` instead of `%r@%h:%p`

Use these articles for full SSH client workflows.

Guide	Description
`Using the SSH Config File`	Host blocks, patterns, precedence, and examples
`SSH Command in Linux`	ssh options and connection examples
`How to Set Up SSH Tunneling`	Local, remote, and dynamic port forwarding
`SSH Folder Files and Permissions`	What lives in `~/.ssh` and the correct modes
`SSH Cheatsheet`	ssh, keys, agent, scp, and sftp commands

How to Resize and Extend a Linux Partition and Filesystem

hello@linuxize.com (Linuxize) — Tue, 06 Oct 2026 11:25:00 +0200

You resized the disk of your cloud server from 50 GiB to 100 GiB, rebooted, and df -h still shows the old size. This is one of the most common storage tasks on Linux: the disk grew, but the partition and the filesystem on top of it did not. Each layer has to be extended separately before the space becomes usable.

This guide explains how to grow a partition and its filesystem to fill new disk space, including the extra steps needed on LVM setups, and how to shrink a partition when you have to.

Warning

Take a backup or snapshot before changing partition boundaries. Confirm the disk, partition number, filesystem type, and mount point before every write operation. The device names below are examples; replace them with the devices on your system, and never change a partition’s start position to extend it.

Quick Reference

Task	Command
Preview growing partition 1 on /dev/sda	`sudo growpart --dry-run /dev/sda 1`
Grow partition 1 on /dev/sda	`sudo growpart /dev/sda 1`
Grow an ext4 filesystem	`sudo resize2fs /dev/sda1`
Grow an XFS filesystem mounted at /	`sudo xfs_growfs -d /`
Grow a single-device Btrfs filesystem mounted at /	`sudo btrfs filesystem resize max /`
Grow an LVM physical volume	`sudo pvresize /dev/sda3`
Extend an LVM volume and its ext4 or XFS filesystem	`sudo lvextend -r -l +100%FREE /dev/ubuntu-vg/ubuntu-lv`

Use only the commands that match your layout. +100%FREE consumes all free extents in the volume group; use a fixed increase when you need to keep space for other volumes or snapshots.

Disk, Partition, and Filesystem Layers

Storage on Linux is stacked . At the bottom is the disk (/dev/sda), which holds a partition table describing one or more partitions (/dev/sda1). A plain partition contains a filesystem such as ext4 or XFS. With LVM, a physical volume supplies space to a volume group, which allocates that space to logical volumes. The filesystem sits on a logical volume.

Enlarging a virtual disk only changes the bottom layer. To use the new space you extend each layer above it, in order: partition, LVM physical volume and logical volume if present, then filesystem. If only the filesystem is smaller than its partition, growing the filesystem alone is enough. If an LVM volume group already has free extents, you can extend a logical volume without enlarging the disk or partition.

The examples cover plain partitions and ordinary LVM logical volumes. Encrypted mappings, software RAID, and LVM thin pools need additional steps; do not apply this sequence unchanged to those layouts.

Step 1: Identify the Layout

Start by looking at what you have. The lsblk command shows the disks, partitions, filesystem types, and mount points:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS

output

NAME SIZE TYPE FSTYPE MOUNTPOINTS
sda 100G disk
└─sda1 50G part ext4 /

The disk sda is 100 GiB, but the partition sda1 holding the root filesystem is still 50 GiB. lsblk uses powers of 1024 for its size suffixes, so G here means GiB. We still need to check where the free space sits before growing the partition.

Next, check the filesystem type, because the grow command differs between ext4, XFS, and Btrfs:

Terminal
df -hT /

output

Filesystem Type Size Used Avail Use% Mounted on
/dev/sda1 ext4 49G 41G 5.6G 88% /

In this example the root filesystem is ext4 on /dev/sda1. On a data volume, replace / with its mount point. If lsblk shows entries of type lvm, follow the LVM section , which uses partition 3 rather than partition 1.

On NVMe devices, partition names include a p: partition 1 of /dev/nvme0n1 is /dev/nvme0n1p1. Virtio disks commonly use names such as /dev/vda and /dev/vda1.

If you enlarged the disk while the VM was running and lsblk still reports the old disk size, first confirm that the hypervisor or cloud provider completed the resize. For a SCSI device that exposes a rescan file, ask the kernel to rescan it:

Terminal
echo 1 | sudo tee /sys/class/block/sda/device/rescan

This path is specific to the device driver; it is not a general NVMe or virtio rescan command. If the file does not exist, follow your platform’s rescan procedure or reboot. Run lsblk again and confirm the larger disk size before continuing.

Next, inspect the partition boundaries and free regions with parted . If it is missing, install the parted package with your package manager:

Terminal
sudo parted /dev/sda -- unit MiB print free

The Free Space region you want must begin directly after the target partition. If another partition sits between it and the new space, growpart cannot move that partition out of the way. On an enlarged GPT disk, parted may offer to repair the backup header; see Troubleshooting before accepting that repair.

Step 2: Grow the Partition

The easiest way to grow a partition is growpart, a tool built for exactly this job. It supports MBR and GPT disks and can extend a partition in use when the kernel supports updating its size. It changes the end boundary without moving the start.

On Ubuntu, Debian, and Derivatives, install it with:

Terminal
sudo apt update
sudo apt install cloud-guest-utils

On Fedora, RHEL, and Derivatives, use:

Terminal
sudo dnf install cloud-utils-growpart

growpart takes the whole disk and the partition number as separate arguments. Preview the change first:

Terminal
sudo growpart --dry-run /dev/sda 1

The preview reports the proposed change and the old and new partition tables without writing them. Check that partition 1 is the intended target and its start stays the same, then apply the change:

Terminal
sudo growpart /dev/sda 1

For partition 1 on an NVMe disk, the equivalent grow command is:

Terminal
sudo growpart /dev/nvme0n1 1

Run the command for your device, not both examples. A CHANGED message confirms that the partition table was updated. The partition grows into adjacent free space, stopping at the next partition or the last usable part of the disk. NOCHANGE means no qualifying growth was possible; it does not necessarily mean the filesystem fills the disk.

Alternative: Growing the Partition with parted

If parted is installed, you can use its resizepart command instead of growpart. Start it against the disk:

Terminal
sudo parted /dev/sda

At the prompt, inspect the layout again. If partition 1 is the last partition and free space follows it, resize its end to the last usable part of the disk:

txt
(parted) unit MiB
(parted) print free
(parted) resizepart 1 100%
(parted) print
(parted) quit

These are commands entered at the (parted) prompt, not shell commands. parted applies a resize immediately; quit does not save a staged change. If it asks about modifying an in-use partition, confirm only after checking the target and that you are extending its end. Do not use 100% when another partition follows the target.

Both tools only change the partition table. Recent versions of fdisk also provide an e resize command; check the m menu in your installed version.

Before growing the filesystem, confirm that the kernel sees the larger partition:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS /dev/sda

If the partition row still has its old size, try notifying the kernel with sudo partprobe /dev/sda. If that fails because the device is busy, reboot and verify with lsblk before proceeding.

Step 3: Grow the Filesystem

Run only the command for the filesystem type you found in step 1. Mounted ext4, XFS, and Btrfs filesystems can normally grow online, provided the kernel already sees the larger underlying device. LVM users should follow the next section first.

ext4

For ext4, run resize2fs against the partition device. Without a size argument it grows the filesystem to fill the partition:

Terminal
sudo resize2fs /dev/sda1

For the NVMe example, the filesystem device is /dev/nvme0n1p1, so you would use sudo resize2fs /dev/nvme0n1p1.

On mounted ext4, the output reports an online resize and the resulting block count. The tool also supports ext2 and ext3, but online resizing depends on filesystem and kernel support. If an offline check is required, unmount a data filesystem or use live media for a root filesystem. Never run e2fsck on a mounted filesystem.

XFS

XFS uses its own tool. Pass the mount point, and use -d to grow the data section to the maximum available size. The filesystem must be mounted:

Terminal
sudo xfs_growfs -d /

For a data filesystem, replace / with its mount point. If the command reports that the data size is unchanged, check the partition or logical volume size rather than rerunning it.

Btrfs

Btrfs also resizes by mount point. For a single-device filesystem, run:

Terminal
sudo btrfs filesystem resize max /

The max keyword grows the filesystem to fill the underlying device. It defaults to device ID 1. For a multi-device filesystem, find the enlarged device’s ID with sudo btrfs filesystem show /, then specify it explicitly, such as sudo btrfs filesystem resize 2:max / for device ID 2. Resizing one device does not resize every device in the filesystem.

If a grow command is missing, install its filesystem package: e2fsprogs for ext4, xfsprogs for XFS, or btrfs-progs for Btrfs.

Extending LVM Volumes

On an LVM system, identify the physical volume, volume group, and logical volume before changing anything:

Terminal
sudo pvs
sudo vgs
sudo lvs -o lv_path,vg_name,lv_size

Use the PV and LV Path values from your output rather than assuming the Ubuntu names below. VFree in the vgs output shows space the volume group can already allocate. If enough space is available there, skip the partition growth and pvresize steps.

In this example, /dev/sda3 is the physical volume. If it needs to grow and adjacent free space is available, preview and then extend partition 3:

Terminal
sudo growpart --dry-run /dev/sda 3

Check that the preview targets partition 3 and preserves its start, then apply it:

Terminal
sudo growpart /dev/sda 3

After verifying that the kernel sees the larger partition, lsblk looks like this:

Terminal
lsblk

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 100G 0 disk
├─sda1 8:1 0 1M 0 part
├─sda2 8:2 0 2G 0 part /boot
└─sda3 8:3 0 98G 0 part
└─ubuntu--vg-ubuntu--lv 252:0 0 48G 0 lvm /

The partition sda3 is already about 98 GiB, but the logical volume holding the root filesystem is still 48 GiB. The physical volume and logical volume need to expose the extra space to the filesystem.

First, extend the physical volume so LVM sees the larger partition:

Terminal
sudo pvresize /dev/sda3

output

 Physical volume "/dev/sda3" changed
1 physical volume(s) resized or updated / 0 physical volume(s) not resized

This makes the extra extents available in the volume group. Check sudo vgs again to confirm the increase in VFree. If the physical volume occupies a whole disk rather than a partition, skip growpart and give pvresize that whole-disk device instead.

For an ordinary logical volume with ext4 or XFS, extend it into the available space and grow its filesystem in the same command:

Terminal
sudo lvextend -r -l +100%FREE /dev/ubuntu-vg/ubuntu-lv

The options are:

-r - Resize the filesystem along with the logical volume, using the appropriate installed filesystem helper.
-l +100%FREE - Add all remaining free extents in the volume group to this logical volume.

If both parts succeed, you do not need a separate resize2fs or xfs_growfs run. To add 20 GiB while keeping the remaining space available, use sudo lvextend -r -L +20G /dev/ubuntu-vg/ubuntu-lv instead.

For Btrfs on a logical volume, extend the logical volume without -r, then run btrfs filesystem resize max on its mount point. The filesystem helpers used by lvextend -r do not provide a general Btrfs resize workflow.

Verifying the New Size

Whichever path you took, confirm the filesystem capacity:

Terminal
df -h /

output

Filesystem Size Used Avail Use% Mounted on
/dev/sda1 98G 41G 53G 44% /

For the plain ext4 example, the root filesystem now reports about 98 GiB. Its reported capacity is lower than the disk’s size because of filesystem overhead, and available space also accounts for ext4’s reserved blocks. On LVM, the Filesystem column shows the logical volume instead. For more ways to read this output, see our guide to checking disk space with df .

Shrinking a Partition

Shrinking is riskier than growing and supports fewer filesystems.

Warning

Shrinking works in the opposite order: shrink the filesystem first, then the partition. Shrinking the partition first can cut off filesystem data. Keep a backup, and stop if any check or resize command fails. This example is for an unencrypted ext4 data partition without LVM; shrinking an LVM setup also requires reducing its intervening layers in the correct order.

resize2fs can shrink ext2, ext3, and ext4 only while unmounted. For a root filesystem, boot from live media and make sure it has not automatically mounted the partition. Btrfs has its own mounted resize command. Current XFS documentation describes limited shrinking of the last allocation group, which is not a general way to shrink an arbitrary XFS filesystem. For a substantial XFS reduction, plan to back up, recreate a smaller filesystem, and restore.

For this ext4 example, assume /dev/sdb1 starts at 1MiB and is currently larger than 41 GiB. Inspect its actual start before proceeding:

Terminal
sudo parted /dev/sdb -- unit MiB print

The target filesystem size must leave enough room for the files and metadata. Stop processes using the data volume, then unmount it:

Terminal
sudo umount /dev/sdb1

Once unmounting succeeds, run a forced filesystem check :

Terminal
sudo e2fsck -f /dev/sdb1

Resolve any reported errors before continuing. Then shrink the filesystem to 40 GiB:

Terminal
sudo resize2fs /dev/sdb1 40G

Here G means GiB, or powers of 1024. Do not replace it with GB in the partition command: parted treats GB as decimal gigabytes. Also, resizepart takes an absolute disk endpoint, not a partition size.

We will leave a 1 GiB margin by making the partition 41 GiB long. With the verified start at 1MiB, its endpoint is 1 + (41 * 1024) = 41985MiB. If your partition starts elsewhere, calculate its endpoint from that actual start instead. Open parted on the disk:

Terminal
sudo parted /dev/sdb

Confirm the start again, change only the end, accept the shrink warning only after the filesystem resize succeeded, then print the result:

txt
(parted) unit MiB
(parted) print
(parted) resizepart 1 41985MiB
(parted) print
(parted) quit

Verify that the kernel sees the new 41 GiB partition. If necessary, run sudo partprobe /dev/sdb and check again:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS /dev/sdb

While the filesystem is still unmounted, check it again:

Terminal
sudo e2fsck -f /dev/sdb1

After a successful check, grow the filesystem to fill the new partition exactly:

Terminal
sudo resize2fs /dev/sdb1

You can now mount the filesystem at its original mount point and verify its capacity with df -h. The GNU Parted unit reference explains why explicit binary units are useful when setting exact boundaries.

Troubleshooting

growpart prints NOCHANGE
There may be no adjacent free space, another partition may block growth, or the increase may be below the tool’s threshold. Confirm that the disk itself grew, then inspect parted’s print free output. If the partition already uses the available space, check the LVM and filesystem layers instead. NOCHANGE returns exit status 1; it is not a successful resize.

df still shows the old size after growing the partition
Compare the sizes in lsblk and df -hT. If the partition is larger but the filesystem is unchanged, run its matching grow command. On LVM, verify that the physical volume and logical volume grew before resizing the filesystem.

The table changed, but lsblk still shows the old partition size
The kernel has not adopted the new boundary. Try sudo partprobe /dev/sda. If it reports that the device is busy, reboot and check the partition size before growing the next layer. Do not repeatedly rewrite the table to fix a kernel reread failure.

lsblk does not show the new disk size
Confirm that the provider completed the resize. Use the SCSI rescan from step 1 only if your device exposes that file; NVMe and virtio devices may need their platform’s procedure or a reboot.

parted warns about unusable space on a GPT disk
GPT keeps a backup header at the end of the disk. After a disk grows, the header may still be at its former end. If the warning explicitly refers to the disk’s newly available space or the backup table’s old location, confirm the disk and backup, then accept Fix. Do not accept an unrelated corruption warning as routine resize maintenance.

lvextend grew the volume but failed to resize the filesystem
Check sudo lvs -o lv_path,lv_size and df -hT before retrying. The logical volume may already have the requested capacity. Install the missing filesystem helper or resolve the reported error, then grow ext4 on the logical-volume device or XFS on its mount point. Do not repeat a relative -L +20G increase without checking, since it can allocate another 20 GiB.

growpart cannot create its temporary directory
The filesystem holding /tmp may be full. Free a little space and try again. If deleting files does not recover capacity, check our guide to fixing No space left on device .

Conclusion

Before another capacity increase, save the lsblk and df -hT output so you can see which layer changed. Keeping free extents in an LVM volume group also gives you room to extend individual volumes later without resizing the disk again.

SQLite Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 04 Oct 2026 16:55:00 +0200

Open and Inspect

For worked examples, see our sqlite3 command guide .

Command	Description
`sqlite3 tasks.db`	Open a database; create the file on the first write if it is missing
`sqlite3 -readonly tasks.db`	Inspect an existing database without allowing writes
`sqlite3 :memory:`	Open a database that disappears when the shell exits
`sqlite3 --version`	Show the installed SQLite version
`.databases`	Show open databases and their file paths
`.tables`	List tables and views
`.schema tasks`	Show the SQL that defines a table
`.help`	Show available dot commands
`.quit`	Exit the SQLite shell

Run SQL

End SQL statements with a semicolon. Dot commands do not need one. Use WHERE to limit which rows an update changes.

SQL	Description
`CREATE TABLE tasks (id INTEGER PRIMARY KEY, title TEXT NOT NULL, done INTEGER DEFAULT 0);`	Create a task table with automatically assigned IDs
`INSERT INTO tasks (title) VALUES ('Check backups');`	Add a task with the default `done` value of `0`
`SELECT * FROM tasks LIMIT 10;`	Preview up to ten rows
`SELECT title FROM tasks WHERE done = 0;`	List unfinished tasks
`SELECT count(*) FROM tasks;`	Count all rows
`UPDATE tasks SET done = 1 WHERE id = 1;`	Mark one task as completed

Output Formats

Set the mode before changing headers. Column spacing and alignment can vary by SQLite version.

Command	Description
`.mode list`	Separate columns with pipes
`.mode column`	Align values in columns
`.mode box`	Add table borders
`.mode json`	Print results as JSON
`.mode csv`	Format results as CSV
`.headers on`	Include column names where the mode supports them
`.headers off`	Hide column names where the mode supports it

CSV Import and Export

Imports append rows. Use --skip 1 for a CSV header when the target table already exists. To export, set .mode csv and .headers on before .once. Choose an unused output filename.

Command	Description
`.import --csv contacts.csv contacts`	Import CSV; a new table uses the first row as column names
`.import --csv --skip 1 contacts.csv contacts`	Skip the header when importing into an existing table
`.once report.csv`	Send the next query result to a file
`SELECT id, title FROM tasks;`	Run after `.once` to export the selected columns
`.output report.csv`	Send query results to a file until output is changed
`.output`	Send query results back to the terminal

Transactions and Locks

Back up first and preview the matching rows before deleting. Use ROLLBACK to discard changes or COMMIT to keep them.

Command	Description
`BEGIN;`	Start a transaction
`SELECT * FROM tasks WHERE done = 1;`	Preview completed tasks before deletion
`DELETE FROM tasks WHERE done = 1;`	Delete completed tasks inside the transaction
`ROLLBACK;`	Undo the uncommitted changes
`COMMIT;`	Keep the changes; they can no longer be rolled back
`.timeout 5000`	Wait up to five seconds for a lock; does not release another connection’s lock

Backup and Restore

Run these commands in your terminal. Choose unused backup filenames and restore SQL into a new database. Use .backup for a live database, including committed data still in its WAL file.

Command	Description
`sqlite3 -readonly tasks.db ".backup backup.db"`	Create a consistent database copy
`sqlite3 -readonly tasks.db .dump > backup.sql`	Export the database as SQL statements
`sqlite3 -bail restored.db < backup.sql`	Restore SQL into a new database and stop on errors
`sqlite3 -readonly backup.db "PRAGMA integrity_check;"`	Check database structure; `ok` means the check passed

sqlite3 Command Line: Create and Query SQLite Databases

hello@linuxize.com (Linuxize) — Sun, 04 Oct 2026 14:20:00 +0200

When you need to inspect an application’s database or query a CSV file, you do not always need a database server. SQLite stores a database in a file, with no service to configure, and the sqlite3 command gives you an interactive SQL shell for working with it.

This guide explains how to use the sqlite3 command-line shell to create databases, run queries, import and export data, and make backups.

Installing sqlite3

On Ubuntu, Debian, and Derivatives, install the command-line shell with the following command:

Terminal
sudo apt install sqlite3

On Fedora, RHEL, and Derivatives, the package is named sqlite:

Terminal
sudo dnf install sqlite

Verify the installation:

Terminal
sqlite3 --version

The output shows the SQLite version, release date, and source identifier. The installed version depends on your distribution.

Opening and Creating a Database

The sqlite3 command has the following syntax:

txt
sqlite3 [OPTIONS] [DATABASE_FILE] [SQL_OR_DOT_COMMAND...]

Pass a filename to open a database. If the file does not exist, SQLite creates it when you first write to the database:

Terminal
sqlite3 tasks.db

You are now in the interactive shell at the sqlite> prompt. Opening a nonexistent database and quitting immediately leaves no database file behind. Running sqlite3 with no filename opens a temporary in-memory database, useful for trying out SQL that you do not want to keep.

Two kinds of input work at the sqlite> prompt: SQL statements, which end with a semicolon, and dot commands like .help and .quit, which start with a dot and control the shell itself. Put each dot command on its own line without a semicolon. Exit with .quit or Ctrl+D.

The examples below use a new tasks.db database. Enter commands marked with sqlite> inside the SQLite shell, and commands marked with $ in your Linux terminal. You do not need to type either prompt.

Creating Tables and Inserting Data

Create a table and add a few rows:

Terminal
CREATE TABLE tasks (
 id INTEGER PRIMARY KEY,
 title TEXT NOT NULL,
 priority INTEGER DEFAULT 3,
 done INTEGER DEFAULT 0
);
INSERT INTO tasks (title, priority) VALUES ('Rotate backup drives', 1);
INSERT INTO tasks (title, priority) VALUES ('Update nginx config', 2);
INSERT INTO tasks (title) VALUES ('Clean up /tmp scripts');

An INTEGER PRIMARY KEY column receives an ID automatically when you omit it from an insert. In this new table, the rows receive IDs 1, 2, and 3. SQLite normally chooses one more than the largest existing ID, so it can reuse an ID after the row with the highest ID is deleted. The separate AUTOINCREMENT keyword prevents reuse of previously committed IDs, but adds overhead and is usually unnecessary.

SQLite uses flexible typing for ordinary columns. For example, the priority column can hold text that cannot be converted to an integer. The INTEGER PRIMARY KEY column is an exception and must contain an integer. If you need stricter type checks, SQLite 3.37.0 and later support tables declared with STRICT.

Check what you have:

Terminal
.tables
.schema tasks

SQLite lists the table name and its definition:

output

tasks
CREATE TABLE tasks (
id INTEGER PRIMARY KEY,
title TEXT NOT NULL,
priority INTEGER DEFAULT 3,
done INTEGER DEFAULT 0
);

.tables lists all tables in the database, and .schema prints the SQL that defines them, which is the fastest way to orient yourself in an unfamiliar database file.

Querying Data

To list unfinished tasks in priority order, run a SELECT statement. We explicitly select list mode and turn headers off to get the same pipe-separated output across SQLite versions:

Terminal
.mode list
.headers off
SELECT * FROM tasks WHERE done = 0 ORDER BY priority;

The output is:

output

1|Rotate backup drives|1|0
2|Update nginx config|2|0
3|Clean up /tmp scripts|3|0

Each line contains the task ID, title, priority, and completion flag. All three tasks have a done value of 0, so they are included.

SQLite 3.52.0 and later use a boxed table by default in interactive sessions. Earlier versions use pipe-separated list output, which remains the default for batch scripts. Setting the mode explicitly avoids relying on that default. See the SQLite output formatting documentation for details.

For aligned columns with column names, switch to column mode and enable headers:

Terminal
.mode column
.headers on
SELECT * FROM tasks WHERE done = 0 ORDER BY priority;

The output will look similar to this:

output

id title priority done
-- --------------------- -------- ----
1 Rotate backup drives 1 0
2 Update nginx config 2 0
3 Clean up /tmp scripts 3 0

The rows are unchanged, but the headers and spacing make the columns easier to read. Column spacing and alignment can vary by SQLite version. You can also use .mode box for table borders, .mode json for JSON output, and .mode csv for CSV export. The mode stays in effect until you change it or exit the shell.

Updating and Deleting Rows

To mark the second task as completed, use UPDATE with a WHERE clause, then check the matching row:

Terminal
UPDATE tasks SET done = 1 WHERE id = 2;
SELECT * FROM tasks WHERE done = 1;

The query shows task 2 with a done value of 1. Without a WHERE clause, an UPDATE or DELETE statement affects every row in the table.

Before deleting rows from an important database, make a backup. You can try a deletion inside a transaction and undo it with ROLLBACK. The following example temporarily deletes completed tasks, shows the remaining rows, and restores the deleted data:

Terminal
BEGIN;
DELETE FROM tasks WHERE done = 1;
SELECT * FROM tasks ORDER BY id;
ROLLBACK;

The query shows tasks 1 and 3, but ROLLBACK brings task 2 back. To keep the deletion, run the transaction again and replace ROLLBACK; with COMMIT; after checking the result. Once committed, the deletion cannot be undone with ROLLBACK.

Running Queries from the Shell

Run the commands in this section from your Linux terminal. If you are still at the sqlite> prompt, leave the SQLite shell first:

Terminal
.quit

For scripting, skip the interactive prompt entirely by passing SQL as an argument:

Terminal
sqlite3 tasks.db "SELECT title FROM tasks WHERE priority = 1;"

The output is:

output

Rotate backup drives

The query returns the title of the task with priority 1, then the command exits.

Formatting options give you the same control as the dot commands. For a readable report that also opens the database read-only, run:

Terminal
sqlite3 -readonly -header -column tasks.db "SELECT * FROM tasks ORDER BY id;"

The options used here are:

-readonly - Open the database without allowing writes. The file must already exist.
-header - Include column names in the output.
-column - Align the output in columns.

Use -json or -csv instead of -column when another program needs to read the results. This one-shot form is useful in cron jobs and shell pipelines: the command opens a file, runs the query, and exits.

Importing and Exporting CSV

For this example, save the following contents as contacts.csv in the same directory as tasks.db:

contacts.csvtxt
name,email
Alice,alice@example.com
Bob,bob@example.com

Reopen the database from your terminal:

Terminal
sqlite3 tasks.db

To load the CSV file, use .import --csv inside the SQLite shell. If the target table does not exist, SQLite creates it and uses the first row as column names:

Terminal
.import --csv contacts.csv contacts
.mode column
.headers on
SELECT * FROM contacts;

The output will look similar to this:

output

name email
----- -----------------
Alice alice@example.com
Bob bob@example.com

The first CSV row supplied the name and email column names. Only Alice and Bob were imported as data.

If the target table already exists, the first row is imported as data too. Use --skip 1 when the CSV file has a header. For example, we can create a separate table and import the same file into it:

Terminal
CREATE TABLE mailing_list (name TEXT, email TEXT);
.import --csv --skip 1 contacts.csv mailing_list

This imports the two data rows without adding a row containing the column labels. Importing the same file again appends more rows; it does not replace existing data.

To export unfinished tasks, set CSV mode, enable headers, and send the next query to a file with .once. Choose an unused filename because an existing output file will be overwritten:

Terminal
.mode csv
.headers on
.once report.csv
SELECT title, priority FROM tasks WHERE done = 0 ORDER BY priority;

The result lands in report.csv with a header row. Subsequent queries print to the terminal again, still in CSV mode. Use .output report.csv instead of .once when several queries should go to the same file, and .output alone to return to the terminal.

Backing Up and Restoring

Run the backup and restore commands below from your Linux terminal. Use .quit first if you are still in the SQLite shell.

The .backup command creates a consistent copy of the database, including committed data that is still in a write-ahead log (WAL). Choose an unused backup filename because .backup can overwrite an existing database:

Terminal
sqlite3 -readonly tasks.db ".backup tasks-backup.db"

The backup is a database file you can open directly with sqlite3. To check its structure, run:

Terminal
sqlite3 -readonly tasks-backup.db "PRAGMA integrity_check;"

For a database that passes the check, the output is:

output

ok

This checks the database structure. It does not confirm that the backup contains every row you expected, so also check important tables before relying on it.

For a plain-text SQL backup, use .dump. The shell redirection also overwrites an existing file, so choose an unused filename:

Terminal
sqlite3 -readonly tasks.db .dump > tasks-backup.sql

Restore the SQL into a new database file. Make sure restored.db does not already exist. The dump contains statements to recreate the tables and insert the rows:

Terminal
sqlite3 -bail restored.db < tasks-backup.sql

The -bail option stops processing if a statement fails. The SQL dump is plain text, so you can inspect or compress it before restoring. If you also work with MySQL, see our guide to backing up and restoring databases with mysqldump .

Use .backup for databases that an application is using. Copying only the .db file can miss committed data stored in a -wal file, and copying files during a write can produce an inconsistent backup. See SQLite’s backup guidance for the conditions needed to make a safe file copy.

Quick Reference

For a printable quick reference, see the SQLite cheatsheet .

Task	Command
Open or create a database	`sqlite3 file.db`
Inspect an existing database read-only	`sqlite3 -readonly file.db`
Run one query and exit	`sqlite3 file.db "SELECT ...;"`
List tables	`.tables`
Show table definitions	`.schema`
Readable output	`.mode column` then `.headers on`
JSON or CSV output	`.mode json` / `.mode csv`
Import CSV into a new table	`.import --csv data.csv tablename`
Import CSV with a header into an existing table	`.import --csv --skip 1 data.csv tablename`
Export a query to a file	`.once out.csv` before the query
Back up as SQL	`sqlite3 -readonly file.db .dump > backup.sql`
Restore SQL into a new database	`sqlite3 -bail new.db < backup.sql`
Safe binary backup	`.backup backup.db`
Check database structure	`PRAGMA integrity_check;`
Exit the shell	`.quit`

Troubleshooting

Database is locked
Another connection may be holding a write transaction. Finish it with COMMIT or ROLLBACK, or wait for the application to finish. Inside your SQLite session, .timeout 5000 makes operations wait up to five seconds for a lock before failing. It does not release another connection’s lock.

Unable to open the database file
Check the path and permissions. SQLite can create a database file, but it cannot create a missing parent directory. For writes, you also need permission to create journal or WAL files in the database directory. With -readonly, the database file must already exist.

No such table
Check .databases to see which file is open and .tables to see its tables. A relative path is resolved from your current directory, so a typo can open a new, empty database. Use an absolute path or -readonly when inspecting an existing database.

SQLite keeps showing the continuation prompt
A SQL statement is incomplete. Add the missing semicolon or close an unmatched quote or parenthesis. Press Ctrl+C to cancel the current input, then enter the statement again. Dot commands must start on their own line and cannot be entered in the middle of an unfinished SQL statement.

Conclusion

When inspecting an existing application database, start with -readonly and .tables. Before changing its data, make a .backup copy and check that you can open it.

Fix npm Error: unable to get local issuer certificate

hello@linuxize.com (Linuxize) — Sat, 03 Oct 2026 14:10:00 +0200

You run npm install and the command fails with npm error code UNABLE_TO_GET_ISSUER_CERT_LOCALLY and the message unable to get local issuer certificate. The registry may open normally in a browser, but npm cannot verify its HTTPS connection.

This guide explains what the error means and how to fix it by trusting the correct certificate authority while keeping TLS verification enabled.

What the Error Means

A typical failure looks like this:

output

npm error code UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm error errno UNABLE_TO_GET_ISSUER_CERT_LOCALLY
npm error request to https://registry.npmjs.org/express failed, reason: unable to get local issuer certificate

When npm connects to a registry over HTTPS, Node.js checks the server’s certificate against a list of trusted certificate authorities. To trust the server, Node must follow the chain from the server certificate up to a root CA it already has. UNABLE_TO_GET_ISSUER_CERT_LOCALLY means it could not find an issuer needed to complete that chain, so the connection fails.

Common causes include:

A corporate proxy, firewall, or antivirus that inspects HTTPS and signs certificates with an internal CA.
A private registry whose certificate was issued by a CA that Node does not trust.
A registry or proxy that does not send a required intermediate certificate.
An outdated CA bundle, or an npm setting that points to the wrong certificates.

Node.js normally uses its own bundled root certificates. Your browser may trust an internal CA through a different certificate store, which explains why the browser works while npm fails. The Node.js enterprise network guide describes the available trust settings.

Check the npm Configuration

Before we change certificate settings, check the Node.js version and npm configuration from the directory where the install fails:

Terminal
node --version
npm config get registry
npm config get cafile
npm config get ca
npm config get strict-ssl

The public registry is https://registry.npmjs.org/. The ca and cafile settings normally return null, and strict-ssl should return true. A configured cafile is not necessarily wrong, but the file must contain the CA certificates needed for your registry. If you previously disabled verification, restore it before testing the connection.

npm reads settings from several places. A project’s .npmrc overrides your user configuration, usually ~/.npmrc. Environment variables and command-line options can override both, so check those sources if a setting differs from what you expect.

Scoped packages can use a separate registry. Replace @myorg with your package scope and check its mapping:

Terminal
npm config get @myorg:registry

If this returns a URL, packages under that scope use that registry. Also check the URL in the original error: the failed connection may be to a package download host rather than the default registry.

Find the Missing Certificate

On a managed workstation, ask your IT team for the root CA used by the HTTPS inspection proxy. For a private registry, ask its administrator which CA issued the certificate. Obtain the CA from a trusted source; do not copy a certificate from the failed connection and assume it is safe to trust.

The CA file must be in PEM format, with a -----BEGIN CERTIFICATE----- header. A .crt or .cer extension alone does not tell you how the certificate is encoded.

To inspect the certificates presented by the public registry, run:

Terminal
openssl s_client -connect registry.npmjs.org:443 \
 -servername registry.npmjs.org -showcerts </dev/null

For another registry, replace both occurrences of registry.npmjs.org with the hostname from the failed URL. The -servername option sends the hostname so the server can select the right certificate, and -showcerts prints the certificates it sends. The input redirection closes the session without waiting for keyboard input.

Compare the subject and issuer names in the output. An internal CA name can help identify an inspection proxy, but this is not a verified chain, and servers normally omit the root certificate. OpenSSL also uses its own trust settings, so a successful OpenSSL check does not prove that Node trusts the same CA. See the s_client documentation for details.

If npm connects through an explicit HTTP proxy, use that proxy when inspecting the connection. Replace proxy.example.com:8080 with its hostname and port:

Terminal
openssl s_client -proxy proxy.example.com:8080 \
 -connect registry.npmjs.org:443 -servername registry.npmjs.org \
 -showcerts </dev/null

OpenSSL does not read npm’s proxy configuration. Without -proxy, you may inspect a direct connection that presents different certificates from the connection npm uses.

Method 1: Trust the CA Certificate

Save the verified CA file somewhere your user can read it. Replace /path/to/company-ca.pem in the examples below with its absolute path.

To add the CA to Node’s bundled roots, set NODE_EXTRA_CA_CERTS, then test the registry connection:

Terminal
export NODE_EXTRA_CA_CERTS="/path/to/company-ca.pem"
npm ping

A successful npm ping reports PONG. It checks the configured registry without installing packages. Node reads NODE_EXTRA_CA_CERTS when a process starts, so start a new npm command after setting it. For other running Node tools, restart the process too.

To keep the setting across terminal sessions, add the export line to your shell configuration, such as ~/.bashrc for Bash or ~/.zshrc for Zsh. In CI, set the variable in the job environment before npm starts and make the certificate file available to the runner.

Set a CA Bundle for npm Only

If you want the certificate setting to apply to npm only, use cafile instead:

Terminal
npm config set cafile "/path/to/company-ca.pem" --location=user
npm ping

This writes the setting to your user npm configuration. The file can contain one or more PEM CA certificates. Unlike NODE_EXTRA_CA_CERTS, npm’s cafile supplies an explicit CA list that replaces Node’s default trusted roots for those connections. If you need both internal and public CAs, use a bundle that contains the required authorities.

Note

An explicit npm ca or cafile setting takes precedence over NODE_EXTRA_CA_CERTS. Setting the environment variable will not add certificates to npm’s configured CA list. The same applies to Node tools that supply their own TLS ca option.

To switch back to NODE_EXTRA_CA_CERTS, remove the ca and cafile entries you previously added to your user configuration:

Terminal
npm config delete ca cafile --location=user

This changes the user configuration only. Run npm config get ca and npm config get cafile again from your project directory. If either setting is still present, check the project’s .npmrc, the global configuration, and environment variables such as npm_config_cafile. Remove the conflicting setting from the source that defines it.

Once npm ping succeeds with verification enabled, retry the install:

Terminal
npm install

If the install still fails, compare its error URL with the registry checked by npm ping. Packages can be downloaded from other hosts, which may need a different certificate chain.

Method 2: Use the System CA Store

If the system certificate bundle is missing or outdated, reinstall it and rebuild the store. You can also add an internal CA to the system store when other applications need it.

Ubuntu, Debian, and Derivatives

Reinstall the ca-certificates package and rebuild the store:

Terminal
sudo apt update
sudo apt install --reinstall ca-certificates
sudo update-ca-certificates

To add a verified internal CA, copy it into /usr/local/share/ca-certificates/ with a .crt extension, then update the store:

Terminal
sudo cp /path/to/company-ca.pem /usr/local/share/ca-certificates/company-ca.crt
sudo update-ca-certificates

The certificate must be PEM encoded, with one certificate per file. If your CA bundle contains several certificates, install them as separate .crt files. The update-ca-certificates manual explains these requirements.

Fedora, RHEL, and Derivatives

Reinstall the certificate package and regenerate the trust store:

Terminal
sudo dnf reinstall ca-certificates
sudo update-ca-trust extract

To add a verified internal CA, place it in the system’s trust anchors directory:

Terminal
sudo cp /path/to/company-ca.pem /etc/pki/ca-trust/source/anchors/company-ca.pem
sudo update-ca-trust extract

The second command rebuilds the trust store with the added CA. Red Hat documents this process in its guide to shared system certificates .

Enable System Certificates in Node.js

Updating the system store does not automatically change the certificates used by most Node.js installations. On Node.js 22.19.0 or later in the 22.x series, or Node.js 24.6.0 and later, enable system CAs with:

Terminal
export NODE_USE_SYSTEM_CA=1
npm ping

This adds system CAs alongside Node’s bundled roots. As with NODE_EXTRA_CA_CERTS, an explicit npm ca or cafile setting overrides that trust list. Older Node versions can use the CA file through NODE_EXTRA_CA_CERTS; if the bundled public roots are outdated, update Node.js to a supported release.

Keep TLS Verification Enabled

Setting strict-ssl to false or NODE_TLS_REJECT_UNAUTHORIZED to 0 bypasses certificate verification. It hides the problem by allowing a connection whose certificate cannot be verified.

Warning

Disabling TLS verification allows a third party to impersonate the registry and tamper with package downloads. Trust the correct CA or fix the server’s certificate chain while keeping verification enabled.

If you previously disabled verification, restore it with:

Terminal
npm config set strict-ssl true --location=user
unset NODE_TLS_REJECT_UNAUTHORIZED
npm config get strict-ssl

The last command should return true. If it does not, check for an override in the project’s .npmrc or environment. Also remove any NODE_TLS_REJECT_UNAUTHORIZED=0 assignment from your shell configuration or CI settings so it does not return in the next session.

Troubleshooting

NODE_EXTRA_CA_CERTS does not fix the error
Check for an overriding ca or cafile setting first. Confirm that the file is readable and contains PEM certificates, then start a new npm command. A running Node process does not reload the variable when you change it.

npm ping works, but npm install still fails
Check the URL in the install error. A scoped registry, a tarball URL in package-lock.json, or a Git dependency may connect to another host. An install script may also run a tool with its own certificate settings. Diagnose that connection separately.

The install works locally but fails in CI or a container
The runner or container has its own environment and certificate store. Copy the trusted CA into that environment, set the certificate variable before npm starts, and confirm the path is readable there. A host’s user .npmrc or system CA store is not automatically available inside a container.

A private registry sends an incomplete chain
Ask its administrator to configure the registry or reverse proxy to send the server certificate and required intermediate certificates. Adding a root CA on the client does not replace a missing intermediate in the server’s chain.

Conclusion

In most cases, the fix is trusting the right CA through NODE_EXTRA_CA_CERTS or cafile, not turning off strict-ssl. For more on inspecting certificate chains, see our guide on using OpenSSL . The npm command reference covers package installation and the other commands you will use after the connection is working.

How to Diagnose OOM Killer Events in Linux

hello@linuxize.com (Linuxize) — Wed, 30 Sep 2026 17:05:00 +0200

A service disappears without warning. There is no crash report, just a process that was running and now is not, sometimes followed by systemd restarting it. Before assuming an application bug, check whether it was killed because of memory pressure.

When the kernel cannot reclaim enough memory to satisfy an allocation, it may invoke the out-of-memory (OOM) killer. The killed process cannot catch the signal or write a final error message, so you need to look outside its own logs.

This guide explains how to confirm an OOM event, read what the kernel recorded, and choose a fix based on the cause.

Quick Reference

Task	Command
Search the kernel ring buffer	`sudo dmesg -T \| grep -iE 'oom\|out of memory\|killed process'`
Search this boot’s kernel journal	`sudo journalctl -k -g 'oom\|out of memory\|killed process'`
Search the previous boot	`sudo journalctl -k -b -1 -g 'oom\|out of memory\|killed process'`
Check userspace OOM kills	`sudo journalctl -u systemd-oomd --since '2 hours ago'`
Show a running process’s OOM score	`cat /proc/PID/oom_score`
Show current memory and swap use	`free -h`

Replace PID with a running process ID. Run the log checks on the affected host; a container may not have access to the host’s kernel log.

What the OOM Killer Does

Linux can allow applications to reserve more virtual memory than the system can back with RAM and swap. This behavior depends on the overcommit policy. Reserving an address range does not mean that the application is using that much physical memory.

An OOM event occurs when the kernel cannot satisfy an allocation after attempting to reclaim memory. This can affect the whole host or be restricted to a service or container that has reached its memory limit. An OOM kill does not necessarily mean that every byte of RAM and swap on the host was in use.

Under the usual selection policy, the kernel considers eligible processes within the affected memory domain and scores them using their memory use and oom_score_adj settings. It does not know which application matters most to your business. The chosen process receives SIGKILL, which it cannot handle or ignore.

Confirm an OOM Event

Start with the kernel log. The dmesg command prints the kernel ring buffer, and -T adds human-readable timestamps. Search for both OOM messages and the line identifying the killed process:

Terminal
sudo dmesg -T | grep -iE 'oom|out of memory|killed process'

An abbreviated example looks like this:

output

[Wed Sep 30 09:14:22 2026] node invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
[Wed Sep 30 09:14:22 2026] Out of memory: Killed process 2417 (node) total-vm:4185672kB, anon-rss:3923116kB, file-rss:0kB, shmem-rss:0kB
[Wed Sep 30 09:14:22 2026] oom_reaper: reaped process 2417 (node), now anon-rss:0kB, file-rss:0kB, shmem-rss:0kB

The first line names the process whose allocation invoked the OOM killer. That process is not necessarily the victim or the main source of memory pressure. The Killed process line identifies the victim, here PID 2417 running node.

The total-vm value is its virtual address space, not its RAM use. The anon-rss value shows anonymous resident memory, about 3.7 GiB in this example. file-rss and shmem-rss report resident file-backed and shared memory. The final line records the OOM reaper’s progress reclaiming the victim’s memory.

On systemd systems, you can also search the journal. This is useful when the ring buffer no longer contains the event:

Terminal
sudo journalctl -k -g 'oom|out of memory|killed process'

The -k option selects kernel messages from the current boot. The -g option filters messages with a regular expression; an all-lowercase pattern matches without regard to case. The wider pattern also catches messages such as Memory cgroup out of memory.

If the machine rebooted after the incident, search the previous boot:

Terminal
sudo journalctl -k -b -1 -g 'oom|out of memory|killed process'

This works only if logs from that boot were retained. See the journalctl guide for boot selection and persistent logging. The timestamps from dmesg -T can be inaccurate after suspend and resume, so use journal timestamps when comparing events across logs.

For a systemd service, check its journal around the same time. Replace app.service with the affected service:

Terminal
sudo journalctl -u app.service --since '2 hours ago'

Look for the process exit and any restart at the time of the OOM message. A status=9/KILL entry records a SIGKILL exit, and a shell exit status of 137 is also consistent with that signal. Neither establishes who sent it. A manual kill or another supervisor can produce the same result.

Read the Process Table in the Log

The OOM report normally includes a process table when vm.oom_dump_tasks is enabled. A cgroup OOM report is restricted to that cgroup’s eligible tasks. The filtered commands above hide most of this context, so read the full kernel journal around the event:

Terminal
sudo journalctl -k --since '2026-09-30 09:13:00' --until '2026-09-30 09:16:00'

Use the date and time of your incident, and add -b -1 if it happened during the previous boot. An abbreviated table might contain these rows:

output

[ pid ] uid tgid total_vm rss ... oom_score_adj name
[ 2417] 1000 2417 1046418 980779 ... 0 node
[ 1183] 999 1183 210334 45211 ... 0 mysqld

The total_vm and rss columns are in pages. On a system with 4 KiB pages, the Node.js process’s rss of 980779 corresponds to 3923116 KiB, matching the kill message. Do not assume the page size is always 4 KiB; check it with:

Terminal
getconf PAGESIZE

The result is the page size in bytes. Use the table to identify large consumers, but do not treat the largest value as proof of a leak. Several processes may have exhausted the available memory together, or a legitimate workload may have exceeded a configured limit.

Check Service and Container Memory Limits

A service can hit a cgroup memory limit while the host still has available RAM. Look for Memory cgroup out of memory or constraint=CONSTRAINT_MEMCG in the kernel report, along with the affected cgroup path.

For a systemd service, inspect its current memory use, configured limits, and cgroup path:

Terminal
systemctl show app.service -p MemoryCurrent -p MemoryHigh -p MemoryMax -p ControlGroup

Numeric memory values are in bytes. MemoryMax=infinity means the unit has no explicit hard limit of its own; a parent slice can still impose one.

On cgroup v2, use the reported ControlGroup path to inspect event counters. For example, if it is /system.slice/app.service, run:

Terminal
sudo cat /sys/fs/cgroup/system.slice/app.service/memory.events

The kernel’s cgroup documentation explains these counters. oom counts occasions when the cgroup reached its limit and an allocation was about to fail; oom_kill counts processes killed by the kernel OOM killer. The counters include descendants and have no timestamps. An oom_kill value alone does not distinguish a host OOM from a cgroup-limit OOM. Correlate it with the logs, and remember that counters disappear when the cgroup is removed.

Check systemd-oomd

Some systems also run systemd-oomd, a userspace service that monitors memory pressure and swap use. It can kill processes in a selected cgroup before the kernel reaches an OOM condition, so there may be no kernel Out of memory message.

Check its journal around the time the application disappeared:

Terminal
sudo journalctl -u systemd-oomd --since '2 hours ago'

A kill entry identifies the cgroup selected by systemd-oomd. Match that path and timestamp to the affected service or user session. If the service is not installed or enabled, this check does not apply. Its selection policy is separate from the kernel’s oom_score_adj mechanism; see the systemd-oomd documentation for details.

Inspect and Adjust OOM Scores

For a running process, /proc exposes its current OOM score and adjustment. To inspect your current shell safely, use $$, which expands to its PID:

Terminal
cat /proc/$$/oom_score
cat /proc/$$/oom_score_adj

For another process, replace $$ with its current PID. The killed process from the log is already gone, and its PID may later be reused. You cannot recover its old score by reading the same /proc/PID path after the event.

The oom_score_adj setting ranges from -1000 to 1000. Positive values make selection more likely, while negative values make it less likely. A value such as -500 does not guarantee that the process will survive. -1000 excludes the process from kernel OOM victim selection, which shifts pressure to other workloads and should not be a routine fix.

If you need to lower a systemd service’s score, create a drop-in with:

Terminal
sudo systemctl edit app.service

Add the adjustment under [Service]:

/etc/systemd/system/app.service.d/override.confini
[Service]
OOMScoreAdjust=-500

Save the file. systemctl edit reloads systemd’s configuration, but the setting applies to newly started processes. Restart the service during a suitable maintenance window, since this interrupts it:

Terminal
sudo systemctl restart app.service

This makes the preference persistent across service restarts. It does not reduce memory use or prevent systemd-oomd from choosing the service’s cgroup.

Prevent the Next OOM Event

Start by checking current memory and swap use:

Terminal
free -h

Read the available column, not the free column. These are current values, so they may look healthy after a large process has been killed. The free command guide explains the columns.

If one application’s memory use keeps growing under a steady workload, investigate a possible leak. If usage rises with traffic or job size, reduce worker concurrency, batch size, or cache limits before assuming a bug.

For systemd services on cgroup v2, MemoryHigh= applies reclaim pressure and throttling, while MemoryMax= provides a hard limit. Exceeding MemoryMax= can cause an OOM kill inside the service. Choose limits from measured usage and leave room for the rest of the host. The systemd resource-control documentation recommends MemoryHigh= as the main control and MemoryMax= as the last line of defense.

If the host does not have enough capacity for its normal workload, add RAM or reduce the workload. Adding swap space can absorb temporary pressure from swappable memory, but it does not fix a leak or remove a service’s memory limit. Sustained swapping can also make the machine slow.

Troubleshooting

dmesg reports “Operation not permitted”
Run it with sudo on the host. Kernel log access is often restricted, and root inside a container may still lack permission. Ask the host administrator for logs if you cannot access them.

The previous boot has no journal entries
List retained boots with sudo journalctl --list-boots. Logs may have been stored only in memory or removed by retention limits. Enabling persistent logging helps future investigations but cannot recover discarded entries.

The process was killed, but the search returns nothing
Check the right boot and time range, then inspect systemd-oomd and supervisor logs. On systems using a syslog daemon, retained kernel messages may also be in /var/log/kern.log, /var/log/messages, or rotated copies. Missing logs do not prove that no OOM occurred, and a SIGKILL exit alone does not prove that one did.

Conclusion

Save the full log around an OOM event before it rotates, including the process table and cgroup information. To watch memory use while reproducing the workload, see our guides on the top command and vmstat .

systemd Unit File Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 30 Sep 2026 10:45:00 +0200

File Locations

systemd reads units from several directories. /etc overrides /run, which overrides /usr/lib.

Path	Description
`/etc/systemd/system/`	Units you write or override as the administrator
`/run/systemd/system/`	Runtime units, gone after a reboot
`/usr/lib/systemd/system/`	Units installed by packages; do not edit these
`/etc/systemd/system/name.service.d/*.conf`	Drop-in overrides for one unit
`~/.config/systemd/user/`	Per-user units, managed with `systemctl --user`
`/etc/systemd/user/`	User units for every account on the system
`systemctl cat name.service`	Print the unit and every drop-in that applies to it

Unit Types

The file extension decides what kind of unit systemd creates.

Extension	Description
`.service`	A process or daemon
`.timer`	Schedule that activates another unit
`.socket`	Listening socket that starts a service on demand
`.target`	Group of units, used as a boot milestone
`.path`	Watches a file or directory and activates a unit on change
`.mount`	Filesystem mount point
`.slice`	Resource control group for other units

[Unit] Section

Description, ordering, and dependencies.

Directive	Description
`Description=My API server`	Name shown by `systemctl status`
`Documentation=man:nginx(8) https://nginx.org/`	Documentation links
`After=network-online.target`	Start after the named unit; ordering only
`Before=nginx.service`	Start before the named unit
`Wants=network-online.target`	Pull in a unit, keep running if it fails
`Requires=postgresql.service`	Pull in a unit, stop if it is explicitly stopped
`BindsTo=dev-sdb1.device`	Stop as soon as the named unit stops
`PartOf=app.target`	Stop and restart together with the named unit
`Conflicts=shutdown.target`	Stop the named unit when this one starts, and the reverse
`ConditionPathExists=/etc/app.conf`	Skip the start quietly when the check fails
`AssertPathExists=/etc/app.conf`	Fail the start when the check fails
`StartLimitIntervalSec=60`	Window for counting start attempts
`StartLimitBurst=5`	Starts allowed inside that window

Wants= and Requires= do not set start order. Pair them with After= when one unit must be up first.

Service Types

Type= tells systemd when the service counts as started.

Directive	Description
`Type=simple`	Started as soon as the process is forked; the default
`Type=exec`	Started once the binary has been executed successfully
`Type=forking`	Started when the parent exits; the daemon forks itself
`PIDFile=/run/app.pid`	PID file to track for a `forking` daemon
`Type=oneshot`	Runs to completion; later units wait for it to exit
`RemainAfterExit=yes`	Keep a `oneshot` unit shown as active after it exits
`Type=notify`	Started when the process sends `READY=1` via `sd_notify`
`Type=notify-reload`	Like `notify`, and reloads by sending `SIGHUP`
`Type=dbus`	Started when the name in `BusName=` appears on D-Bus
`Type=idle`	Like `simple`, but waits until other boot jobs finish

Exec Commands

Commands systemd runs at each stage of the service lifecycle.

Directive	Description
`ExecStart=/usr/bin/app --port 8080`	Main command; use an absolute path
`ExecStartPre=/usr/bin/app --check-config`	Run before `ExecStart=`; a failure stops the start
`ExecStartPost=/usr/bin/notify-ready`	Run after the service has started
`ExecReload=/bin/kill -HUP $MAINPID`	Run by `systemctl reload`
`ExecStop=/usr/bin/app --shutdown`	Run by `systemctl stop` before the signal is sent
`ExecStopPost=/usr/bin/cleanup`	Run after the service has stopped or failed
`ExecStartPre=-/usr/bin/mkdir /tmp/app`	`-` prefix: ignore a non-zero exit code
`ExecStartPre=+/usr/bin/chown app /data`	`+` prefix: run with full privileges, ignoring `User=` and sandboxing
`ExecStart=:/usr/bin/echo $HOME`	`:` prefix: pass `$` through without variable expansion

Commands are not run through a shell, so pipes, >, and && do not work. Wrap them in /bin/sh -c '...' or move them into a script.

Restart and Timeouts

Control what happens when the process exits or hangs.

Directive	Description
`Restart=on-failure`	Restart on non-zero exit, signal, timeout, or watchdog
`Restart=always`	Restart no matter how the process exited
`Restart=on-abnormal`	Restart on signal, timeout, or watchdog, not on exit codes
`Restart=no`	Never restart; the default
`RestartSec=5`	Wait five seconds before restarting
`RestartSteps=5`	Grow the delay over five restarts
`RestartMaxDelaySec=60`	Upper limit for the growing delay
`TimeoutStartSec=30`	Fail the start after 30 seconds
`TimeoutStopSec=30`	Escalate to `SIGKILL` after 30 seconds
`SuccessExitStatus=143`	Treat an extra exit code as a clean exit
`RestartPreventExitStatus=2`	Never restart after this exit code
`KillMode=mixed`	`SIGTERM` to the main process, `SIGKILL` to the rest of the group
`WatchdogSec=30`	Mark the service failed when keep-alive pings stop

A unit that restarts more than StartLimitBurst= times inside StartLimitIntervalSec= is refused further starts until the interval passes or you run systemctl reset-failed.

User, Environment, and Directories

Who the process runs as and what it sees.

Directive	Description
`User=app`	Run as this user instead of root
`Group=app`	Run with this primary group
`DynamicUser=yes`	Allocate a temporary user for each run
`WorkingDirectory=/opt/app`	Directory the process starts in
`Environment="NODE_ENV=production" "PORT=8080"`	Set variables inline
`EnvironmentFile=/etc/app/app.env`	Read `KEY=value` lines from a file
`EnvironmentFile=-/etc/default/app`	Same, but skip the file when it is missing
`UMask=0027`	Default permission mask for new files
`StateDirectory=app`	Create `/var/lib/app` owned by the service user
`RuntimeDirectory=app`	Create `/run/app`, removed when the service stops
`LogsDirectory=app`	Create `/var/log/app`
`ConfigurationDirectory=app`	Create `/etc/app`
`StandardOutput=journal`	Send stdout to the journal; the default
`SyslogIdentifier=app`	Tag used in `journalctl` output

Resource Limits

Cap what one service can consume.

Directive	Description
`LimitNOFILE=65536`	Maximum open files
`LimitNPROC=4096`	Maximum processes for the service user
`MemoryMax=512M`	Hard memory limit; the OOM killer acts above it
`MemoryHigh=400M`	Throttle and reclaim memory above this level
`CPUQuota=50%`	Half of one CPU; `200%` means two CPUs
`CPUWeight=50`	Relative CPU share; the default is 100
`IOWeight=50`	Relative disk I/O share; the default is 100
`TasksMax=100`	Maximum threads and processes
`Nice=10`	Scheduling priority, from -20 to 19
`systemctl set-property app.service MemoryMax=1G`	Change a limit at runtime and save it as a drop-in

ulimit values set in a shell do not apply to services. Use the Limit*= directives instead.

Security Hardening

Sandboxing options that most services tolerate.

Directive	Description
`NoNewPrivileges=yes`	Block privilege gain through setuid binaries
`ProtectSystem=strict`	Mount the whole file system read-only
`ProtectSystem=full`	Mount `/usr`, `/boot`, and `/etc` read-only
`ReadWritePaths=/var/lib/app`	Keep one path writable under `ProtectSystem=`
`ProtectHome=yes`	Hide `/home`, `/root`, and `/run/user`
`ProtectHome=read-only`	Show home directories, but read-only
`PrivateTmp=yes`	Give the service its own `/tmp` and `/var/tmp`
`PrivateDevices=yes`	Hide physical devices under `/dev`
`ProtectKernelTunables=yes`	Make `/proc/sys` and `/sys` read-only
`ProtectKernelModules=yes`	Block kernel module loading
`AmbientCapabilities=CAP_NET_BIND_SERVICE`	Let a non-root user bind ports below 1024
`CapabilityBoundingSet=CAP_NET_BIND_SERVICE`	Drop every other capability
`RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX`	Allow only IP and Unix sockets
`SystemCallFilter=@system-service`	Allow the system calls a typical service needs
`systemd-analyze security app.service`	Score the unit’s exposure and list what is missing

[Install] Section

Read only by systemctl enable and disable.

Directive	Description
`WantedBy=multi-user.target`	Start at boot on servers and desktops
`WantedBy=graphical.target`	Start only when the graphical session target is reached
`WantedBy=default.target`	Start with the user session, for `--user` units
`WantedBy=timers.target`	Activate a timer at boot
`RequiredBy=app.target`	Hard dependency created on enable
`Alias=api.service`	Extra name created as a symlink on enable
`Also=app.socket`	Enable or disable another unit together with this one

A unit without an [Install] section can be started by hand but not enabled.

Timer Units

A name.timer activates name.service by default.

Directive	Description
`OnCalendar=daily`	Every day at midnight
`OnCalendar=--* 02:30:00`	Every day at 02:30
`OnCalendar=Mon..Fri 09:00`	Weekdays at 09:00
`OnCalendar=*:0/15`	Every 15 minutes
`OnCalendar=--01 00:00`	First day of every month
`OnBootSec=5min`	Five minutes after boot
`OnUnitActiveSec=1h`	One hour after the unit last started
`Persistent=true`	Run a missed calendar event after downtime
`RandomizedDelaySec=10m`	Spread the start by up to 10 minutes
`AccuracySec=1s`	Tighten the default one-minute accuracy
`Unit=backup.service`	Activate a unit with a different name
`systemd-analyze calendar "Mon..Fri 09:00"`	Check an expression and show the next run
`systemctl list-timers`	Show active timers and their next run

Overrides and Drop-ins

Change a packaged unit without editing the file under /usr/lib.

Command	Description
`sudo systemctl edit nginx.service`	Create or edit a drop-in override
`sudo systemctl edit --full nginx.service`	Copy the whole unit to `/etc` and edit it
`sudo systemctl revert nginx.service`	Remove overrides and return to the vendor unit
`systemctl cat nginx.service`	Show the unit with every drop-in applied
`systemd-delta`	List units that are overridden or extended
`ExecStart=`	Empty line in a drop-in clears the list before a new `ExecStart=`
`sudo systemctl daemon-reload`	Reload unit files after a manual change

systemctl edit reloads the configuration on save. Edits made with a normal editor need daemon-reload.

Specifiers

Placeholders systemd expands inside unit files.

Specifier	Description
`%n`	Full unit name, such as `app@web.service`
`%N`	Unit name without the type suffix
`%i`	Instance name in a template unit, the part after `@`
`%H`	Host name
`%h`	Home directory of the user running the manager
`%u`	User name of the manager
`%t`	Runtime directory: `/run` or `$XDG_RUNTIME_DIR`
`%%`	A literal percent sign

A template file such as app@.service is started as app@web.service, with %i set to web.

Install and Verify

Put a new unit in place and confirm it loads.

Command	Description
`sudo cp app.service /etc/systemd/system/`	Install the unit file
`systemd-analyze verify /etc/systemd/system/app.service`	Check syntax and unknown directives
`sudo systemctl daemon-reload`	Make systemd read the new file
`sudo systemctl enable --now app.service`	Enable at boot and start now
`systemctl status app.service`	Show state and the latest log lines
`journalctl -u app.service -f`	Follow the service log
`systemctl show app.service -p Restart,User`	Print the effective value of directives
`systemctl list-dependencies app.service`	Show the dependency tree
`systemctl --user daemon-reload`	Reload units in `~/.config/systemd/user/`
`sudo loginctl enable-linger username`	Keep user units running after logout

Deeper reading on services and systemd.

Guide	Description
How to Create a systemd Service File	Write, install, and manage a service step by step
systemd Service File Generator	Build a `.service` file in the browser
systemctl Command in Linux	Start, stop, enable, and inspect units
How to List Services with systemctl	Filter units by state and type
journalctl Command in Linux	Read and filter service logs
systemctl cheatsheet	Quick reference for `systemctl`
journalctl cheatsheet	Quick reference for `journalctl`

Ubuntu Desktop vs Ubuntu Server: Which One Should You Use?

hello@linuxize.com (Linuxize) — Sat, 26 Sep 2026 10:40:00 +0200

When you go to download Ubuntu, the site offers two separate images: Ubuntu Desktop and Ubuntu Server. They share the same name, the same release number, and the same six-month release schedule, so it is easy to assume the choice does not matter much. It does. The two editions are built around different defaults, ship different software, and expect to run on very different machines.

This guide compares Ubuntu Desktop and Ubuntu Server where the differences actually show up: the installer, the default software set, the desktop environment, resource usage, and the kind of work each one is meant for.

Same Ubuntu Underneath

Both editions are the same Ubuntu. They draw from the same package archive, run the same apt and dpkg tools, use systemd as the init system, and follow the same release cadence and support windows. A long-term support (LTS) release gets five years of standard support on both Desktop and Server. Both are free to download and use, while the optional Ubuntu Pro subscription adds extended security coverage.

Because the base is identical, anything you learn on one transfers to the other. The same systemctl commands manage services, the same configuration files live in the same places, and the same packages are available from the archive. The differences are about what is installed and enabled out of the box, not about two separate operating systems.

The Installer

The first difference you meet is the installer.

Ubuntu Desktop boots into a graphical live session. You can try the system before installing, and the installer walks you through language, keyboard, disk layout, and a user account with point-and-click screens. The usual installation path assumes that a monitor, keyboard, and mouse are attached.

Ubuntu Server uses the text-based Subiquity installer. You can operate it from a local console, over a serial connection, or through an SSH connection to the installer. It puts server-focused options up front, including static network configuration, LVM or software RAID, SSH key imports from GitHub or Launchpad, and an optional OpenSSH server. Ubuntu Desktop also supports advanced disk layouts, but its guided path focuses on workstation setup.

Default Software and Desktop Environment

This is the largest practical difference.

Ubuntu Desktop installs the GNOME desktop environment, Firefox, the App Center, audio support, and the core utilities needed for a workstation. The current installer offers a smaller Default selection and an Extended selection with additional office tools and utilities. Third-party drivers and support for additional media formats are separate optional choices, so the exact software set depends on what you select during installation.

Ubuntu Server installs none of that graphical stack. There is no desktop, display server, or browser in the standard installation. You get a command-line system, with the option to install OpenSSH and selected server-oriented snaps during setup. The expectation is that you administer the machine over SSH and run services on it, not sit in front of it.

You are not locked in by this choice. You can install a full GNOME desktop on a server image with apt, and you can install server packages on a desktop. The default set is a starting point, not a hard boundary.

Resource Usage

Because Ubuntu Server has no graphical stack, it generally uses less memory and disk at idle, leaving more resources for the services you run. Exact usage depends on the release, hardware, and installed packages. As a current reference, the Ubuntu 26.04 system requirements list 6 GB of RAM and 25 GB of storage as the minimum for a comfortable Desktop experience, while Server requirements start at 1.5 GB of RAM and 4 GB of storage.

Ubuntu Desktop needs more resources to keep GNOME and its background services responsive. On modern workstation hardware this is not a problem, but the lower Server baseline matters on small virtual machines and older systems. A smaller default package set also means fewer components to maintain, although the services you install and how you configure them matter more for security.

The Kernel

Both editions can run the same kernel, but the defaults differ in a way that matters for some hardware.

On LTS releases, Ubuntu Desktop installations track the Hardware Enablement (HWE) stack, which brings newer kernels to support recent laptops and graphics hardware. Ubuntu Server defaults to the General Availability (GA) kernel, while the HWE kernel remains available when newer hardware support is required.

When to Choose Each

Pick Ubuntu Desktop when a person sits at the machine: a developer workstation, a laptop, a daily driver, or any system where you want a graphical environment, a browser, and desktop applications ready to go.

Pick Ubuntu Server when the machine runs services and you reach it over the network: a web or database server, a VPS, a container host, a home lab box, or anything headless in a rack or a cloud. If the machine has no monitor attached and its job is to run software for other clients, the server edition is the right starting point. After the install, an initial server setup gets it hardened and ready.

Here is a quick summary of where the two differ:

Aspect	Ubuntu Desktop	Ubuntu Server
Installer	Graphical live session	Text-based (Subiquity)
Desktop environment	GNOME, preinstalled	None
Desktop applications	Core apps included; more with Extended selection	Not included
Default access	Local graphical login	Local console; SSH optional
Baseline resource use	Higher	Lower
LTS kernel track	HWE	GA by default; HWE optional
Built for	Workstations, laptops	Servers, VPS, containers

Converting Between Desktop and Server

You can add either software profile because the package archive is shared, but the two directions are not equally simple.

To turn a server into a desktop, install the desktop metapackage:

Terminal
sudo apt update
sudo apt install ubuntu-desktop

The ubuntu-desktop metapackage pulls in the full Ubuntu desktop software set. A lighter desktop environment is another option if you need only occasional graphical access.

Going in the other direction is less tidy. Removing the ubuntu-desktop metapackage does not automatically return the system to a minimal Server installation. If you only need to run server software on a Desktop system, install the required services directly. When a clean headless base matters, reinstalling from the Server image is usually safer than removing desktop packages one by one.

Conclusion

The choice comes down to who, or what, uses the machine. A workstation with a screen wants Ubuntu Desktop; a headless box running services wants Ubuntu Server. If you are weighing the underlying distribution as well, our Debian vs Ubuntu Server comparison covers that side of the decision.

GitHub CLI Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 23 Sep 2026 09:30:00 +0200

Authentication

Command or variable	Description
`gh auth login`	Start the interactive login flow
`gh auth login --web`	Authenticate through the browser
`gh auth login --hostname github.example.com`	Log in to a GitHub Enterprise Server host
`gh auth status`	Show the active account, protocol, and token scopes
`gh auth refresh -s workflow`	Add a scope to the existing token
`gh auth switch`	Change the active account
`gh auth token`	Print the raw token `gh` is using
`gh auth setup-git`	Configure `git` to authenticate through `gh`
`gh auth logout`	Remove stored credentials for a host
`GH_TOKEN`	Token environment variable for GitHub.com automation
`GH_ENTERPRISE_TOKEN`	Token environment variable for GitHub Enterprise Server automation

Treat the output of gh auth token as a password. Store automation tokens in your CI secret manager, expose them through the appropriate environment variable, and never commit them to a repository.

Repositories

Create, clone, and inspect repositories without leaving the shell.

Command	Description
`gh repo clone OWNER/REPO`	Clone a repository using your configured protocol
`gh repo view`	Show the description, default branch, and README
`gh repo view --web`	Open the repository in a browser
`gh repo create NAME --private --source=. --push`	Publish the current directory as a new repository
`gh repo fork --clone`	Fork a repository and clone the fork
`gh repo sync`	Update a fork from its upstream
`gh repo list OWNER`	List repositories owned by a user or organization
`gh repo edit --default-branch main`	Set `main` as the default branch
`gh repo set-default OWNER/REPO`	Pin the repository that commands target here
`gh repo archive`	Archive a repository

Pull Requests

The commands that replace most of the pull request web interface.

Command	Description
`gh pr list`	List open pull requests
`gh pr list --state all --author @me`	List your pull requests in every state
`gh pr status`	Show pull requests relevant to you
`gh pr create --fill`	Open a pull request using the commit title and body
`gh pr create --draft --reviewer octocat`	Create a draft and request a review
`gh pr checkout NUMBER`	Check the pull request out as a local branch
`gh pr diff NUMBER`	Show the patch
`gh pr checks NUMBER`	Show the status checks and their conclusions
`gh pr review --approve`	Approve the pull request for the current branch
`gh pr merge NUMBER --squash`	Squash the commits and merge the pull request
`gh pr ready NUMBER`	Mark a draft as ready for review
`gh pr view NUMBER --web`	Open the pull request in a browser

Issues

Triage and close issues from the same terminal you build in.

Command	Description
`gh issue list`	List open issues
`gh issue list --label bug --assignee @me`	List open bugs assigned to you
`gh issue status`	Show issues assigned to or mentioning you
`gh issue create --title "..." --body "..."`	Create an issue without the prompts
`gh issue view NUMBER`	Read an issue in the terminal
`gh issue comment NUMBER --body "..."`	Add a comment
`gh issue edit NUMBER --add-label bug`	Add the `bug` label to an issue
`gh issue close NUMBER --comment "..."`	Close with a closing comment
`gh issue develop NUMBER --checkout`	Create and check out a branch linked to the issue
`gh issue transfer NUMBER OWNER/REPO`	Move an issue to another repository

GitHub Actions

Watch, debug, and re-run workflows from the command line.

Command	Description
`gh run list`	List recent workflow runs
`gh run list --workflow ci.yml --status failure`	List failed runs for `ci.yml`
`gh run view ID`	Show a summary of one run
`gh run view ID --log-failed`	Print the logs for failed steps only
`gh run watch ID`	Follow a run until it finishes
`gh run rerun ID --failed`	Re-run only the jobs that failed
`gh run download ID`	Download the artifacts a run produced
`gh run cancel ID`	Cancel a run in progress
`gh workflow list`	List the workflows in the repository
`gh workflow run build.yml -f env=staging`	Trigger a `workflow_dispatch` workflow with inputs
`gh workflow disable NAME`	Disable a workflow
`gh cache list`	List the Actions caches for the repository
`gh cache delete --all`	Immediately delete every Actions cache

Deleting all Actions caches has no dry-run and can slow the next workflow runs while the caches rebuild. Confirm that the command targets the intended repository before running it.

Secrets and Variables

Secrets are write-only; variables stay readable.

Command	Description
`gh secret set NAME`	Prompt for a value and store it, hidden from shell history
`echo "$VALUE" \| gh secret set NAME`	Read the value from standard input
`gh secret set --env-file .env`	Load several secrets from a dotenv file
`gh secret set NAME --env production`	Set a deployment environment secret
`gh secret set NAME --org ORG --visibility selected --repos a,b`	Set an organization secret for named repositories
`gh secret list`	List secret names and update times, never values
`gh secret delete NAME`	Immediately remove a repository secret
`gh variable set NAME --body value`	Store a non-sensitive value that workflows can read
`gh variable get NAME`	Print a variable value
`gh variable list`	List variables with their values

Keep any dotenv file used with --env-file out of version control, and delete it once the values are uploaded. Before deleting a secret, confirm the repository and secret name because GitHub cannot return the stored value afterward.

Releases

Tag, publish, and fetch release assets.

Command	Description
`gh release create TAG --generate-notes`	Create a release with notes built from merged pull requests
`gh release create TAG --target main --title "..."`	Create the tag on a specific branch or commit
`gh release create TAG dist/app dist/checksums.txt`	Attach build files while creating the release
`gh release create TAG --draft --prerelease`	Publish as a draft or a prerelease
`gh release list`	List releases
`gh release view TAG`	Show the notes and assets for one release
`gh release download TAG`	Download every asset
`gh release download TAG --pattern "*.tar.gz"`	Download matching assets only
`gh release upload TAG file`	Add an asset to an existing release
`gh release delete TAG`	Delete a release

Search and Browse

Find work across GitHub, then jump to it.

Command	Description
`gh search repos QUERY --language go`	Search repositories
`gh search issues QUERY --state open`	Search issues
`gh search prs --review-requested @me`	Search pull requests
`gh search code QUERY`	Search code
`gh search commits QUERY`	Search commit messages
`gh browse`	Open the current repository in a browser
`gh browse NUMBER`	Open an issue or pull request
`gh browse path/to/file.go`	Open a file at the current branch
`gh browse --actions`	Open the Actions tab
`gh browse -n path/to/file`	Print the URL instead of opening it
`gh status`	Show issues, pull requests, and notifications across repositories

JSON Output and the API

Structured output for scripts, and direct API access for everything else.

Command	Description
`gh pr list --json number,title,author`	Return selected fields as JSON
`gh pr list --json number,title --jq '.[].title'`	Filter JSON without a separate `jq` process
`gh run list --json conclusion --template ...`	Format JSON with a Go template
`gh help formatting`	See every JSON formatting option
`gh pr list --json`	Passing no value lists the fields that command exposes
`gh api repos/{owner}/{repo}/releases`	Send an authenticated REST request
`gh api ENDPOINT --jq '.[].tag_name'`	Filter the API response
`gh api ENDPOINT -f title="..." -f body="..."`	Send a POST with string fields
`gh api ENDPOINT -X PATCH -F draft=false`	Choose the method and send typed fields
`gh api ENDPOINT --paginate`	Follow pagination and return every page
`gh api graphql -f query='...'`	Send a GraphQL query

The {owner} and {repo} placeholders are filled from the current repository.

Aliases, Extensions, and Config

Shorten what you type, and add commands gh does not ship with.

Command	Description
`gh alias set pv 'pr view --web'`	Create a shortcut
`gh alias set bugs 'issue list --label bug'`	Alias a command with its flags
`gh alias list`	List configured aliases
`gh alias delete NAME`	Remove an alias
`gh extension search QUERY`	Find extensions
`gh extension install OWNER/gh-NAME`	Install an extension
`gh extension list`	List installed extensions
`gh extension upgrade --all`	Update every installed extension
`gh extension remove NAME`	Remove an extension
`gh config set editor vim`	Set the editor `gh` opens for bodies and prompts
`gh config set git_protocol ssh`	Choose HTTPS or SSH for Git operations
`gh config list`	Show current configuration

Extensions are not reviewed or signed by GitHub, and they run with your token. Read the source before installing one.

Troubleshooting

What the common failures mean and where to look.

Message	Check
`To get started with GitHub CLI, please run: gh auth login`	No credentials for this host; run `gh auth login`, or set `GH_TOKEN` in CI
`HTTP 403: Resource not accessible by personal access token`	Check with `gh auth status`; refresh OAuth scopes, or fix fine-grained token access, SSO authorization, or Actions permissions
`error: your authentication token is missing required scopes [workflow]`	Refresh with the scope named in the message
`none of the git remotes configured for this repository point to a known GitHub host`	Run inside a GitHub clone, pass `--repo OWNER/REPO`, or run `gh repo set-default`
`multiple remotes detected. please select which repo to use`	Set the target once with `gh repo set-default`
`pull request create failed: GraphQL: No commits between main and branch`	Commit and push the branch before creating the pull request
`HTTP 404: Not Found` on a private repository	The account is authenticated but lacks access, or SSO is not authorized for the token
`X` status with no logs in `gh run view`	Logs expire with the retention policy; check the run age

Deeper reading on GitHub CLI and the Git commands beside it.

Guide	Description
GitHub CLI: Manage Repositories, Issues, and Pull Requests	Full `gh` walkthrough with examples and troubleshooting
git clone Command	Clone repositories directly with Git
git diff Command	Read the patch format `gh pr diff` prints
How to Add Git Remotes	Manage the remotes `gh repo create` configures
gitignore: Ignoring Files in Git	Keep secrets and build output out of a repository
Git cheatsheet	Quick reference for the Git commands themselves

Fix the NO_PUBKEY GPG Error on apt update

hello@linuxize.com (Linuxize) — Mon, 21 Sep 2026 12:50:00 +0200

You run sudo apt update, and one repository fails with a GPG error ending in NO_PUBKEY followed by a long hexadecimal key ID. APT can still update the other repositories, but it rejects the new package index from the affected source and may continue using an older cached copy.

This usually happens after you add a third-party repository, or when its owner rotates the signing key. This guide explains how to identify the affected repository, install its verified key under /etc/apt/keyrings, and limit that key to the correct source with signed-by.

Quick Reference

For a printable quick reference, see the APT cheatsheet .

Task	Command
Identify the repository	Read the URL on the `NO_PUBKEY` line
Create the local keyring directory	`sudo install -m 0755 -d /etc/apt/keyrings`
Inspect a downloaded key	`gpg --show-keys --with-fingerprint --with-subkey-fingerprint KEYRING`
Make a keyring readable by APT	`sudo chmod 0644 /etc/apt/keyrings/NAME.gpg`
Limit a key to one source	Add `signed-by=/etc/apt/keyrings/NAME.gpg` to a `.list` entry, or `Signed-By:` to a `.sources` file
Test the fix	`sudo apt update`

What the NO_PUBKEY Error Means

A typical failure looks like this:

output

Err:7 https://repo.example.com/apt stable InRelease
The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0123456789ABCDEF
Reading package lists... Done
W: GPG error: https://repo.example.com/apt stable InRelease: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 0123456789ABCDEF
E: The repository 'https://repo.example.com/apt stable InRelease' is not signed.

APT checks the signature on a repository’s InRelease file before it trusts the package index. When the matching public key is missing, unreadable, or no longer current, APT cannot confirm that the metadata came from the repository owner.

The URL identifies the affected repository. The value after NO_PUBKEY, here 0123456789ABCDEF, is the ID of the key that signed the metadata. You can use that ID to inspect a candidate key, but you should verify the key’s full fingerprint against the repository owner’s documentation before trusting it.

Warning

Older instructions use sudo apt-key adv to fetch the missing key. The apt-key command is deprecated and was last available in Debian 12 and Ubuntu 24.04. It also places imported keys in a global trust store unless you take additional steps. Use a dedicated keyring with signed-by instead.

Import the Key From the Repository Owner

The preferred fix is to download the key from the same organization that operates the repository. Do not substitute a key URL from an unrelated tutorial, even when the key ID looks correct.

First, create the directory for locally managed APT keyrings:

Terminal
sudo install -m 0755 -d /etc/apt/keyrings

Find the current signing-key URL and fingerprint in the repository’s official installation documentation. If the provider publishes an ASCII-armored key, download it and convert it to a binary OpenPGP keyring. Replace the example URL and filename with the provider’s values:

Terminal
curl -fsSL https://repo.example.com/apt/gpg.key |
 gpg --dearmor |
 sudo tee /etc/apt/keyrings/example.gpg > /dev/null
sudo chmod 0644 /etc/apt/keyrings/example.gpg

The curl -f option makes the command fail when the server returns an HTTP error instead of quietly passing an error page to GnuPG. The final chmod ensures that the _apt system user can read the keyring.

Some providers publish a ready-to-use binary .gpg keyring. In that case, download it directly without gpg --dearmor. A provider may also use an ASCII-armored .asc file, which modern APT versions can reference directly. Keep the filename extension consistent with the key format.

Before you connect the key to the repository, display its full fingerprint:

Terminal
gpg --show-keys --with-fingerprint --with-subkey-fingerprint /etc/apt/keyrings/example.gpg

Compare the primary fingerprint with the one in the provider’s documentation. The 16-character value from the APT error is a key ID, so it should match the last 16 characters of the primary fingerprint or of one of its signing subkeys. Stop if the documented fingerprint and downloaded key do not match.

Point the Repository to the Keyring

The key does not become active merely because it exists under /etc/apt/keyrings. The affected repository entry must reference it with signed-by.

Use the host from the error message to find the source file. Replace repo.example.com with the actual repository host:

Terminal
grep -R -n --include='*.list' --include='*.sources' \
 'repo.example.com' /etc/apt/sources.list /etc/apt/sources.list.d 2>/dev/null

For a traditional .list file, add signed-by inside the option brackets. If the entry has no brackets, add them between deb and the URL:

/etc/apt/sources.list.d/example.listini
deb [signed-by=/etc/apt/keyrings/example.gpg] https://repo.example.com/apt stable main

If the entry already has an option such as arch=amd64, keep both options in the same brackets:

/etc/apt/sources.list.d/example.listini
deb [arch=amd64 signed-by=/etc/apt/keyrings/example.gpg] https://repo.example.com/apt stable main

For the newer DEB822 format, add the Signed-By field to the existing .sources stanza:

/etc/apt/sources.list.d/example.sourcesini
Types: deb
URIs: https://repo.example.com/apt
Suites: stable
Components: main
Signed-By: /etc/apt/keyrings/example.gpg

Preserve the repository’s existing URI, suite, components, and architecture settings. Only add or correct the keyring reference.

Run the update again after saving the source file:

Terminal
sudo apt update

The NO_PUBKEY error for that repository should no longer appear.

Fetch a Key From a Keyserver

Use a public keyserver only when the repository owner publishes the full fingerprint but does not provide a downloadable key. A keyserver can return a key for an ID, but it does not prove that the key belongs to the repository.

Create an isolated temporary GnuPG home, then fetch the ID shown in the error. Replace the example ID with your missing key ID:

Terminal
key_tmp=$(mktemp -d)
gpg --homedir "$key_tmp" \
 --keyserver hkps://keyserver.ubuntu.com \
 --recv-keys 0123456789ABCDEF

Display the complete fingerprint before exporting anything:

Terminal
gpg --homedir "$key_tmp" --fingerprint --with-subkey-fingerprint \
 0123456789ABCDEF

Compare it with the fingerprint published by the repository owner. If it matches, export the key in the binary OpenPGP format that APT expects:

Terminal
gpg --homedir "$key_tmp" \
 --export-options export-minimal \
 --export 0123456789ABCDEF |
 sudo tee /etc/apt/keyrings/example.gpg > /dev/null
sudo chmod 0644 /etc/apt/keyrings/example.gpg
rm -rf "$key_tmp"

Add the keyring to the repository’s signed-by or Signed-By setting as shown in the previous section, then run sudo apt update.

If the key is already in your personal GnuPG keyring, run gpg as your own user so that it reads that keyring, and keep sudo on the tee command that writes the file:

Terminal
gpg --export-options export-minimal --export 0123456789ABCDEF |
 sudo tee /etc/apt/keyrings/example.gpg > /dev/null
sudo chmod 0644 /etc/apt/keyrings/example.gpg

Fix Keys for Official Ubuntu or Debian Repositories

A default Ubuntu or Debian installation already includes the keys for its official repositories. If the failing URL belongs to Ubuntu or Debian, do not replace the archive key with one copied from a third-party page.

On Ubuntu, reinstall the package that provides the Ubuntu archive keys:

Terminal
sudo apt install --reinstall ubuntu-keyring

On Debian, reinstall the Debian archive key package:

Terminal
sudo apt install --reinstall debian-archive-keyring

Then retry the update:

Terminal
sudo apt update

If the error remains, check that your source entries use the correct release codename and that the installed release still receives updates. An unsupported release or a repository entry copied from another distribution needs a source correction, not an extra trusted key.

Troubleshooting

The same NO_PUBKEY error appears after importing the key
Check the signed-by or Signed-By path in the affected source file. It must exactly match the keyring filename. Confirm that the file is readable with ls -l /etc/apt/keyrings/NAME.gpg, then set safe permissions with sudo chmod 0644 /etc/apt/keyrings/NAME.gpg. If the path and permissions are correct, compare the fingerprint again because the repository may have rotated its signing key.

APT warns that the key is stored in the legacy trusted.gpg keyring
Debian 12 and Ubuntu 24.04 still fall back to the single /etc/apt/trusted.gpg file and print Key is stored in legacy trusted.gpg keyring (/etc/apt/trusted.gpg), see the DEPRECATION section in apt-key(8) for details. APT 3.0, which ships in Debian 13 and Ubuntu 25.04, dropped that fallback, so a repository whose key lives only in that file starts failing with NO_PUBKEY after the upgrade. Export the key into its own keyring, then point the source at it with signed-by:

Terminal
gpg --no-default-keyring --keyring /etc/apt/trusted.gpg \
 --export 0123456789ABCDEF |
 sudo tee /etc/apt/keyrings/example.gpg > /dev/null
sudo chmod 0644 /etc/apt/keyrings/example.gpg

gpg reports no valid OpenPGP data
The key URL may be wrong, or the server may have returned an HTML error page. Open the repository owner’s current installation instructions and copy the key URL again. Keep curl -f in the download command so an HTTP error stops the pipeline.

gpg reports keyserver receive failed
The keyserver may be blocked or temporarily unavailable. The hkps://keyserver.ubuntu.com address uses HTTPS, which normally works through networks that block the traditional HKP port. Prefer the repository owner’s direct key URL whenever one is available.

gpg or curl is not installed
Install the required packages from the enabled Ubuntu or Debian repositories, then retry the key download:

Terminal
sudo apt install curl gnupg ca-certificates

APT reports conflicting values for Signed-By
The same repository is defined more than once with different keyring paths. Search /etc/apt/sources.list.d/ for the repository host, compare the matching .list and .sources files, and remove or disable the stale duplicate entry.

Several repositories report NO_PUBKEY
Handle each affected repository separately and verify every key against its owner. Repositories from the same provider may use one signing key, but unrelated repositories should not share a keyring merely because the errors appeared at the same time.

Conclusion

A NO_PUBKEY error should lead you back to the repository owner, not to an unverified key command. Once the full fingerprint matches, store the key under /etc/apt/keyrings and limit it with signed-by; for more on source configuration, see adding an APT repository on Ubuntu and the apt command guide .

sudo Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 20 Sep 2026 09:25:00 +0200

Basic Usage

Run commands with elevated privileges.

Command	Description
`sudo command`	Run a command as root
`sudo -u username command`	Run a command as another user
`sudo -g groupname command`	Run a command with another primary group
`sudo -u#1000 command`	Run as a user ID instead of a name
`sudo -i`	Open a root login shell that reads root’s profile
`sudo -s`	Open a root shell that keeps the current directory
`sudo -e /etc/hosts`	Edit a root-owned file with an editor running as your user
`sudo -b command`	Run the command in the background
`sudo -- command -l`	Stop option parsing so the flags reach the command
`sudo !!`	Re-run the previous command with `sudo` in Bash or Zsh

Password Caching

Control how often sudo asks for a password.

Command	Description
`sudo -v`	Refresh the cached credentials without running a command
`sudo -k`	Invalidate the cache for the current terminal
`sudo -K`	Remove the cached credentials for every terminal
`sudo -n command`	Fail with an error instead of prompting, for cron and scripts
`sudo -A command`	Read the password from the program named in `SUDO_ASKPASS`
`sudo -p "Password for %u: " command`	Set a custom prompt
`Defaults timestamp_timeout=10`	Cache the password for 10 minutes
`Defaults timestamp_timeout=0`	Prompt for every command
`Defaults timestamp_type=global`	Share one timestamp across all terminals

Debian and Ubuntu packages ship a 15 minute timeout, while Fedora and RHEL keep the upstream five minute default.

Listing Privileges

Check what a rule actually grants before you rely on it.

Command	Description
`sudo -l`	List the commands the current user may run
`sudo -ll`	List the same rules in long form
`sudo -l -U username`	List another user’s privileges as root or an authorized user
`sudo -l /usr/bin/systemctl`	Check whether one command is permitted
`sudo -V`	Print the version, and as root the full `Defaults` list
`id -nG`	List group membership, which `%group` rules match on
`getent group sudo`	Show the members of the `sudo` group

Environment Handling

sudo builds a new environment rather than passing yours through.

Command	Description
`sudo -E command`	Request preservation of the current environment
`sudo --preserve-env=http_proxy command`	Request preservation of only the named variables
`sudo -H command`	Set `HOME` to the target user’s home directory
`sudo env`	Print the environment `sudo` actually builds
`sudo env PATH="/opt/tool/bin:/usr/bin" command`	Run with an explicit trusted `PATH` instead of `secure_path`
`Defaults env_reset`	Strip the caller’s environment, the default on most distros
`Defaults env_keep += "http_proxy https_proxy"`	Let named variables through `env_reset`
`Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin"`	Replace `PATH` for every `sudo` command
`Defaults always_set_home`	Set target `HOME` when `env_reset` does not already do so

sudo exports SUDO_USER, SUDO_UID, SUDO_GID, and SUDO_COMMAND into the command environment, so a privileged script can recover who called it.

Redirects and Pipes

The shell expands > and | before sudo runs, so redirects need their own root process.

Command	Description
`sudo echo text > /root/file`	Usually fails: the shell opens the file as your user
`sudo sh -c 'echo text > /root/file'`	Run the whole line, redirect included, as root
`echo text \| sudo tee /root/file`	Write the file as root
`echo text \| sudo tee -a /root/file`	Append to the file as root
`echo text \| sudo tee /root/file > /dev/null`	Write without echoing the content back
`sudo sh -c 'cmd1 && cmd2'`	Chain several commands under one `sudo` call
`sudo cat /root/file \| grep pattern`	Read as root, filter as your user

Editing the sudoers File

Never open /etc/sudoers in a plain editor. A syntax error there can disable sudo access.

Command	Description
`sudo visudo`	Edit `/etc/sudoers` with a syntax check on save
`sudo visudo -c`	Check every sudoers file without editing
`sudo visudo -f /etc/sudoers.d/webops`	Edit a drop-in file with the same check
`sudo visudo -s`	Treat undefined aliases and alias cycles as errors
`@includedir /etc/sudoers.d`	Parse eligible files in the drop-in directory
`sudo chown root:root /etc/sudoers.d/webops`	Set the required owner and group
`sudo chmod 0440 /etc/sudoers.d/webops`	Set the permissions a drop-in file requires
`sudo ls /etc/sudoers.d`	List the files in the drop-in directory

On sudo older than 1.9.1 the directive is written #includedir /etc/sudoers.d. Despite the leading #, that line is not a comment. Drop-in files whose names contain a dot or end in ~ are skipped.

visudo reads SUDO_EDITOR, VISUAL, and EDITOR when the policy lets those variables through. A command rule that matches ALL implies SETENV, while a rule granting only /usr/sbin/visudo must add SETENV or preserve the editor variables. To avoid depending on that policy, open a root shell with sudo -i, then run EDITOR=/usr/bin/vim visudo.

sudoers Rule Syntax

Each rule reads user host=(runas:rungroup) tagged commands.

Rule	Description
`username ALL=(ALL:ALL) ALL`	Full access for one user
`%sudo ALL=(ALL:ALL) ALL`	Full access for a group, Debian and Ubuntu
`%wheel ALL=(ALL) ALL`	Full access for a group, Fedora and RHEL
`username ALL=(ALL) NOPASSWD: ALL`	Skip the password prompt for every command
`username ALL=(ALL) NOPASSWD: /usr/bin/systemctl restart nginx`	Skip the prompt for one exact command
`username ALL=(www-data) /usr/bin/php`	Run one command as a service account
`username ALL=(ALL) NOEXEC: /usr/bin/less`	Block child commands where `NOEXEC` is supported
`username ALL=(ALL) PASSWD: /usr/bin/su`	Force a prompt for one command inside a `NOPASSWD` rule

Command paths generally must be absolute. A rule listing apt never matches; write /usr/bin/apt. Wildcards in command arguments can match whitespace, so exact arguments or anchored regular expressions are safer. Do not use an editor as a security boundary: /usr/bin/vim can start a shell even without a wildcard.

Aliases

Aliases keep long rule sets readable and reduce repetition.

Declaration	Description
`User_Alias ADMINS = alice, bob, %ops`	Name a set of users or groups
`Runas_Alias SUPERUSER = root`	Name a set of target users
`Host_Alias WEB = web01, web02, 10.0.5.0/24`	Name a set of hosts
`Cmnd_Alias NGINX = /usr/bin/systemctl restart nginx, /usr/bin/systemctl reload nginx`	Name a set of exact commands
`ADMINS WEB=(SUPERUSER) NGINX`	Combine aliases in a rule
`ADMINS ALL=(root) NOPASSWD: NGINX`	Apply a tag to a command alias

Alias names start with an uppercase letter and contain uppercase letters, digits, or underscores. The parser resolves aliases across the complete policy, so a definition may appear before or after a rule that uses it.

Defaults Directives

Policy settings that apply to every matching sudo call.

Directive	Description
`Defaults env_reset`	Run commands with a clean environment
`Defaults secure_path="/usr/sbin:/usr/bin:/sbin:/bin"`	Fixed `PATH` for `sudo` commands
`Defaults timestamp_timeout=15`	Minutes before the password is asked for again
`Defaults passwd_tries=3`	Password attempts before `sudo` gives up
`Defaults targetpw`	Ask for the target user’s password, not the caller’s
`Defaults lecture=never`	Skip the warning shown on first use
`Defaults mail_badpass`	Mail the administrator after a failed password
`Defaults:username timestamp_timeout=30`	Apply a setting to one user
`Defaults@web01 log_output`	Apply a setting on one host
`Defaults!/usr/sbin/visudo env_keep += "SUDO_EDITOR VISUAL EDITOR"`	Preserve editor variables for `visudo`

Logging and Auditing

By default, sudoers logs allowed and denied commands as well as errors.

Command	Description
`sudo journalctl _COMM=sudo`	Show `sudo` events from the systemd journal
`sudo journalctl -t sudo -S today`	Show today’s events by syslog tag
`sudo grep sudo /var/log/auth.log`	Read the log on Debian and Ubuntu
`sudo grep sudo /var/log/secure`	Read the log on Fedora, RHEL, and derivatives
`Defaults logfile="/var/log/sudo.log"`	Write a dedicated `sudo` log file
`Defaults log_input, log_output`	Record full sessions for replay
`sudo sudoreplay -l`	List the recorded sessions
`sudo sudoreplay ID`	Replay one recorded session

Troubleshooting

What the common failures mean and where to look.

Message	Check
`username is not in the sudoers file`	Add the user to `sudo` on Debian and Ubuntu or `wheel` on Fedora and RHEL, then log in again
`sudo: unable to resolve host name`	Map the current hostname in `/etc/hosts`, such as `127.0.1.1 name`
`sudo: command not found` or `sudo: name: command not found`	The shell cannot find `sudo`, or the target command is missing or outside `secure_path`
`sorry, you are not allowed to set the following environment variables`	Preserve the variable or grant `SETENV` narrowly
`sorry, you are not allowed to preserve the environment`	Grant `SETENV`; matching `ALL` implies it unless `NOSETENV` overrides it
`>>> /etc/sudoers: syntax error near line N <<<`	Press `e` to re-edit; `Q` force-saves the broken file
`sudo: no tty present and no askpass program specified`	Use `-n` to fail fast, configure `-A`, or grant `NOPASSWD` narrowly
`sudo: effective uid is not 0`	Check root ownership, setuid, `nosuid`, and NFS mounts; repair from root or recovery

Deeper reading on privilege escalation and user administration.

Guide	Description
sudo Command in Linux	Full `sudo` guide with examples, sudoedit, and credential caching
How to Add User to Sudoers in Ubuntu	Grant sudo access on Debian and Ubuntu
How to Add User to Sudoers in CentOS	Grant sudo access on RHEL and derivatives
How to Run sudo Command Without Password	Set up a `NOPASSWD` rule safely
su Command in Linux	Switch user accounts instead of running one command
su cheatsheet	Quick reference for `su`

nice and renice Commands in Linux: Set Process Priority

hello@linuxize.com (Linuxize) — Fri, 18 Sep 2026 18:00:00 +0200

When you run a CPU-heavy task on a shared server, a long compile job or a background backup can slow down everything else. Linux lets you give that process a lower priority, so it receives a smaller share of CPU time when it competes with other work. Use nice to adjust the priority when you start a command and renice to change the priority of a process that is already running.

This guide explains how nice values work in Linux and how to use nice and renice to start and adjust processes at different priority levels.

How Nice Values Work

For processes using normal time-sharing or batch scheduling, the kernel uses a nice value to decide how much CPU time they should receive relative to competing processes. The range goes from -20 (highest priority) to 19 (lowest priority). New processes inherit their parent’s nice value, which is usually 0.

A higher nice value means the process is “nicer” to other work and receives a smaller CPU share under contention. A lower nice value gives it a larger share. Without contention, even a process at nice 19 can use a full CPU core. Niceness does not set a CPU usage limit.

On most systems, regular users can only increase the nice value of their own processes (lower their priority). Decreasing the value normally requires root privileges, even when changing it from 10 back to 0. An administrator can allow exceptions through the RLIMIT_NICE resource limit.

You can check the current nice value of a process in the NI column of ps or top :

Terminal
ps -eo pid,ni,comm

For example, the output may look like this:

output

 PID NI COMMAND
1 0 systemd
842 0 sshd
1024 10 rsync

The rsync process in the example above is running with a nice value of 10, which is lower priority than the default.

nice Command Syntax

The nice command runs a command with an adjustment to the inherited nice value:

txt
nice [OPTION] [COMMAND [ARGS]...]

With no command, nice prints its current nice value, inherited from your shell:

Terminal
nice

In a shell with the usual nice value of 0, the output is:

output

This does not change the shell’s priority. When you pass a command, nice adds 10 to the inherited nice value unless you choose a different adjustment with -n.

The examples below assume a starting nice value of 0 and use GNU nice from coreutils and renice from util-linux, the implementations commonly found on Linux.

Running a Command With Lower Priority

To try the default adjustment without creating files or running a heavy workload, use nice to run another copy of itself:

Terminal
nice nice

The second nice prints the adjusted value:

output

The outer command adds 10 to the inherited value of 0. The inner command only prints that value and exits.

For a practical example, you can run an archive job at a lower CPU priority. Choose an unused archive filename and replace /var/www with a directory you can read:

Terminal
nice tar -czf backup.tar.gz /var/www

The tar process runs with a nice value of 10 instead of 0. This can help interactive programs stay responsive when they compete with the archive job for CPU time.

You can choose a different adjustment with the -n option. For example, to add 15 when running an existing build script:

Terminal
nice -n 15 ./build.sh

From a starting value of 0, the build script runs at nice 15. If your shell already has a nice value of 10, the result is 19, the maximum allowed value, rather than 15.

Running a Command With Higher Priority

To raise a command’s priority, use a negative adjustment. This normally requires root privileges. For example, a regular user without a suitable nice resource limit can try:

Terminal
nice -n -5 nice

From a starting value of 0, GNU nice reports the failed adjustment and the inner command prints the unchanged value:

output

nice: cannot set niceness: Permission denied
0

GNU nice still runs the command after this permission error, so the warning does not mean the workload was stopped.

With sudo , you can normally apply the adjustment:

Terminal
sudo nice -n -5 nice

When the starting value is 0, the inner command prints:

output

-5

This command runs as root. To raise the priority of a job you already started as your own user, use sudo renice as shown below. Changing its nice value does not change its owner.

Use negative values carefully. A CPU-heavy process at nice -20 can leave competing work with little CPU time.

renice Command Syntax

The renice command changes the nice value of a process that is already running:

txt
renice PRIORITY [-p|-g|-u] IDENTIFIER...

By default, renice interprets the identifier as a process ID. The -p option makes that explicit, -g targets a process group, and -u targets processes owned by a given user.

Unlike nice -n, the priority in this form is an absolute nice value. For example, renice 10 -p PID sets the value to 10; it does not add 10.

In util-linux, renice -n 10 also sets an absolute value by default, but it becomes a relative adjustment when the POSIXLY_CORRECT environment variable is set. We use the form without -n to keep the examples unambiguous. See the renice manual for details.

Changing the Priority of a Running Process

To lower the priority of a running process, find its PID with ps or pgrep , then pass it to renice. Replace 4821 with the PID of your process:

Terminal
renice 10 -p 4821

If the process starts at nice 0, the output is:

output

4821 (process ID) old priority 0, new priority 10

The output confirms the change from 0 to 10.

To try this on a harmless process, start sleep in the background, capture its PID, and change its nice value:

Terminal
sleep 60 &
job_pid=$!
renice 10 -p "$job_pid"
ps -p "$job_pid" -o pid,ni,comm

$! holds the PID of the last background job. The NI column from ps should show 10. The process exits on its own after 60 seconds, so run the following examples before it finishes.

To change the value again, pass the new absolute value:

Terminal
renice 15 -p "$job_pid"

This changes the nice value from 10 to 15, rather than adding 15 to it.

Restoring the value to 0 raises the process’s priority and normally requires sudo:

Terminal
sudo renice 0 -p "$job_pid"

On Linux, nice values are per thread. Renicing a PID does not automatically update every worker thread or an existing child process. Newly created children inherit the calling thread’s nice value.

Renicing All Processes for a User

To adjust the current processes owned by a user, pass the username with -u. For example, if your backup jobs run under an account named backup:

Terminal
sudo renice 15 -u backup

This sets the account’s current processes to nice 15. It does not configure a permanent default for the account or change jobs that will start independently later.

Renicing a Process Group

To target a process group, use -g with the process group ID (PGID). First, list process IDs and their groups:

Terminal
ps -eo pid,pgid,ni,comm

If the jobs you want to adjust belong to group 1820, set their nice value to 5:

Terminal
sudo renice 5 -g 1820

Replace 1820 with the PGID you found. A process group can contain several commands from the same job, such as the stages of a shell pipeline.

Quick Reference

Task	Command
Show the nice value inherited from your shell	`nice`
Add `10` when starting a command	`nice command`
Add `15` when starting a command	`nice -n 15 command`
Subtract `5` when starting a command as root	`sudo nice -n -5 command`
Set a running process to nice `10`	`renice 10 -p PID`
Restore a running process to nice `0`	`sudo renice 0 -p PID`
Set a user’s current processes to nice `15`	`sudo renice 15 -u USER`
Set processes in a group to nice `5`	`sudo renice 5 -g PGID`

Troubleshooting

nice: cannot set niceness: Permission denied
You tried to apply a negative adjustment without permission to raise priority. Use sudo when appropriate, or choose a nonnegative adjustment. GNU nice still runs the command at its inherited nice value after this warning.

renice reports permission denied or operation not permitted
You tried to change a process you do not own, or to decrease a nice value without the required privileges. On most systems, even restoring your own process from nice 10 to 0 requires sudo.

renice reports no such process
The process has exited or the PID is wrong. Find the current PID with ps or pgrep and try again. In the sleep example above, the process disappears after 60 seconds.

Nice value does not seem to affect performance
Nice values matter when processes compete for CPU time. On an idle system, a niced process can still use a full CPU core. Use htop to check whether the workload is CPU-bound.

Autogrouping and cgroup CPU scheduling also affect how CPU time is shared. With autogrouping enabled, changing niceness in one terminal session may have little effect on a job in another session. Process nice values apply within the same scheduling group; see the Linux scheduling documentation for the details.

A backup still slows down disk access
nice and renice adjust CPU scheduling, so they do not directly set disk I/O priority. Some I/O schedulers derive a default I/O priority from CPU niceness, but the behavior depends on the scheduler. Use ionice when you need to set I/O priority explicitly, and check whether your active I/O scheduler supports it.

Conclusion

For a long job that can wait, start with the default nice adjustment and check its NI value with ps. If you prefer to adjust priorities interactively, see how to change nice values in htop .

Nginx Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 16 Sep 2026 17:45:00 +0200

Service and CLI Commands

Control the service and check the configuration before it goes live.

Command	Description
`sudo systemctl reload nginx`	Apply a new configuration without dropping connections
`sudo systemctl start nginx`	Start the service
`sudo systemctl stop nginx`	Stop the service immediately
`sudo systemctl restart nginx`	Stop and start the service
`sudo systemctl status nginx`	Show the service state and recent log lines
`sudo systemctl enable --now nginx`	Start now and at every boot
`sudo nginx -t`	Test the configuration for syntax errors
`sudo nginx -T`	Test and print the full merged configuration
`sudo nginx -s reload`	Reload through the master process signal
`sudo nginx -s quit`	Shut down gracefully after current requests finish
`sudo nginx -s reopen`	Reopen the log files after rotation
`nginx -V`	Print the version and the configure arguments

Always run nginx -t before a reload. A failed reload leaves the old configuration running, but a restart with a broken file leaves the service down.

Configuration Layout

Where the files live and how a site is switched on.

Path	Description
`/etc/nginx/nginx.conf`	Main configuration file
`/etc/nginx/conf.d/*.conf`	Common include pattern; verify it in `nginx.conf`
`/etc/nginx/sites-available/`	Site definitions on Ubuntu and Debian
`/etc/nginx/sites-enabled/`	Symlinks to the active sites
`/etc/nginx/snippets/`	Reusable fragments on Ubuntu and Debian
`/var/www/html`	Default document root on Ubuntu and Debian
`/usr/share/nginx/html`	Default document root on Fedora and RHEL
`/var/log/nginx/`	Access and error logs
`sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/`	Enable a site on Ubuntu and Debian
`sudo unlink /etc/nginx/sites-enabled/default`	Disable the default site

Fedora and RHEL have no sites-available directory. Put each site in its own file under /etc/nginx/conf.d/ instead.

Server Blocks

Directives that decide which server block answers a request.

Directive	Description
`listen 80;`	Listen on IPv4 port 80
`listen [::]:80;`	Listen on IPv6 port 80
`listen 80 default_server;`	Serve requests matching no other server name
`server_name example.com www.example.com;`	Match these host names
`server_name *.example.com;`	Match any subdomain
`server_name _;`	Invalid name used as a catch-all placeholder
`root /var/www/example.com;`	Set the document root
`index index.html index.htm;`	File served when a directory is requested
`include /etc/nginx/snippets/ssl.conf;`	Pull in a shared fragment

Nginx matches the exact name first, then the longest wildcard starting with an asterisk, then the longest wildcard ending with one, and finally the first matching regular expression.

Location Matching

Modifiers that set both the match rule and its priority.

Directive	Description
`location = /health { ... }`	Exact match, checked first and wins immediately
`location ^~ /static/ { ... }`	Prefix match that suppresses the regex pass
`location ~ \.php$ { ... }`	Case-sensitive regular expression
`location ~* \.css$ { ... }`	Case-insensitive regular expression
`location /images/ { ... }`	Plain prefix match
`location / { ... }`	Fallback for every request
`location @fallback { ... }`	Named location, reachable only from `error_page` or `try_files`

Nginx checks the exact match first, then stores the longest matching prefix. If that prefix uses ^~, it is used right away. Otherwise the regular expressions are tried in file order and the first match wins. The stored prefix is used only when no regular expression matches.

Serving Files

Map a request to a file on disk and decide what happens when it is missing.

Directive	Description
`root /var/www/example.com;`	Append the current normalized URI path, without the query string
`alias /srv/media/;`	Replace the matched location prefix with this path
`try_files $uri $uri/ =404;`	Try the file, then the directory, then return 404
`try_files $uri $uri/ /index.html;`	Single-page application fallback
`try_files $uri $uri/ /index.php?$query_string;`	WordPress and PHP framework fallback
`autoindex on;`	Generate a directory listing
`error_page 404 /404.html;`	Serve a custom error page
`error_page 502 503 504 /5xx.html;`	One page for several statuses
`sendfile on;`	Copy files to the socket in the kernel

With root, nginx appends the current normalized URI path without the query string, so location /images/ with root /data serves /data/images/cat.png. With alias, the matched prefix is replaced instead, so the same location with alias /data/pictures/ serves /data/pictures/cat.png. Keep the trailing slash on both the location and the alias.

Reverse Proxy

Forward requests to an application and pass on the client details.

Directive	Description
`proxy_pass http://127.0.0.1:3000;`	Forward to a local application
`proxy_pass http://backend;`	Forward to a named upstream group
`proxy_set_header Host $host;`	Pass the original host name
`proxy_set_header X-Real-IP $remote_addr;`	Pass the client address
`proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;`	Append the client to the forwarding chain
`proxy_set_header X-Forwarded-Proto $scheme;`	Tell the application whether TLS was used
`proxy_http_version 1.1;`	Use HTTP/1.1 for upstream keepalive and WebSocket upgrades
`proxy_set_header Upgrade $http_upgrade;`	Pass the WebSocket upgrade request
`proxy_set_header Connection "upgrade";`	Complete the WebSocket handshake
`proxy_read_timeout 300s;`	Wait longer for a slow response
`proxy_buffering off;`	Stream the response as it arrives

The trailing slash changes the result. proxy_pass http://127.0.0.1:3000; forwards the full request URI, while proxy_pass http://127.0.0.1:3000/; replaces the matched location prefix with /.

Load Balancing

Spread traffic across a pool of backends. Define the pool in http and put the other directives inside upstream.

Directive	Description
`upstream backend { server 10.0.0.1:8080; server 10.0.0.2:8080; }`	Define a pool, round-robin by default
`least_conn;`	Send each request to the least busy server
`ip_hash;`	Pin a client address to one server
`hash $request_uri consistent;`	Distribute by key with minimal reshuffling
`server 10.0.0.1:8080 weight=3;`	Take three times the usual share
`server 10.0.0.2:8080 max_fails=3 fail_timeout=30s;`	After three qualifying failures within 30 seconds, mark unavailable for 30 seconds
`server 10.0.0.3:8080 backup;`	Use only when the others are down
`server 10.0.0.4:8080 down;`	Take a server out of rotation
`server unix:/run/app.sock;`	Proxy to a Unix socket
`keepalive 32;`	Cache up to 32 idle upstream connections per worker

Choose only one of least_conn, ip_hash, or hash; round-robin is the default. The backup parameter cannot be combined with hash or ip_hash. On nginx versions older than 1.29.7, set proxy_http_version 1.1; and proxy_set_header Connection ""; in the proxy location to use HTTP/1.1 upstream keepalive. Since 1.29.7, HTTP/1.1 and upstream keepalive are enabled by default, and the default proxy configuration no longer sends Connection: close.

HTTPS and TLS

Terminate TLS and keep the protocol settings current.

Directive	Description
`listen 443 ssl;`	Accept TLS connections
`http2 on;`	Enable HTTP/2 on nginx 1.25.1 and later
`listen 443 ssl http2;`	Enable HTTP/2 on older releases
`ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;`	Certificate and intermediate chain
`ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;`	Private key
`ssl_protocols TLSv1.2 TLSv1.3;`	Allow only modern protocol versions
`ssl_prefer_server_ciphers off;`	Let the client pick from the allowed ciphers
`ssl_session_cache shared:SSL:10m;`	Share the session cache between workers
`ssl_session_timeout 1d;`	Keep sessions resumable for a day
`add_header Strict-Transport-Security "max-age=63072000" always;`	Send HSTS on every response
`sudo certbot --nginx -d example.com -d www.example.com`	Issue and install a certificate

Keep the private key readable by root only. Never copy a key into a repository or a document root, and add *.pem to .gitignore when the configuration lives in version control.

Redirects and Rewrites

Move URLs without losing the original path.

Directive	Description
`return 301 https://$host$request_uri;`	Redirect every request to HTTPS
`return 301 https://www.example.com$request_uri;`	Redirect to the www host
`return 302 /maintenance.html;`	Temporary redirect
`return 444;`	Close the connection without a response
`rewrite ^/old/(.*)$ /new/$1 permanent;`	301 rewrite that keeps the path tail
`rewrite ^/old/(.*)$ /new/$1 redirect;`	The same rewrite as a 302
`rewrite ^/blog/(.*)$ /$1 last;`	Rewrite internally and restart location matching
`rewrite ^/api/(.*)$ /$1 break;`	Rewrite internally and stop processing rewrites

Prefer return over rewrite for plain redirects. It is faster, easier to read, and it skips the regular expression evaluation that rewrite performs on every request.

Access Control and Limits

Guard the upstream against oversized uploads and traffic spikes. Use htpasswd -c only for a new password file, because it overwrites an existing one.

Directive	Description
`client_max_body_size 64m;`	Raise the upload size limit
`allow 10.0.0.0/8;`	Permit a network
`deny all;`	Block everything else
`auth_basic "Restricted";`	Turn on HTTP basic authentication
`auth_basic_user_file /etc/nginx/.htpasswd;`	Point to the password file
`sudo htpasswd -c /etc/nginx/.htpasswd admin`	Create a new password file, first creation only
`sudo htpasswd /etc/nginx/.htpasswd editor`	Add or update a user in the existing file
`limit_req_zone $binary_remote_addr zone=req:10m rate=10r/s;`	Define a rate limit zone in `http`
`limit_req zone=req burst=20 nodelay;`	Apply the zone with a burst allowance
`limit_conn_zone $binary_remote_addr zone=conn:10m;`	Define a connection limit zone in `http`
`limit_conn conn 10;`	Limit active connections to ten per address
`server_tokens off;`	Hide the version number in responses and error pages

The .htpasswd file holds hashed credentials. Keep it outside the document root and out of version control. In HTTP/2 and HTTP/3, limit_conn counts each concurrent request as a separate connection.

Compression and Caching

Cut response size and avoid repeat trips to the backend.

Directive	Description
`gzip on;`	Compress responses
`gzip_types text/css application/javascript application/json;`	Compress these types beyond `text/html`
`gzip_min_length 256;`	Skip responses too small to benefit
`gzip_comp_level 5;`	Balance CPU time against size
`gzip_vary on;`	Add `Vary: Accept-Encoding`
`expires 30d;`	Set a far-future expiry inside a static location
`add_header Cache-Control "public, immutable";`	Mark fingerprinted assets as cacheable
`proxy_cache_path /var/cache/nginx keys_zone=cache:10m max_size=1g;`	Define a proxy cache in `http`
`proxy_cache cache;`	Turn the cache on for a location
`proxy_cache_valid 200 10m;`	Cache successful responses for ten minutes
`add_header X-Cache-Status $upstream_cache_status;`	Expose cache hits and misses while debugging

By default, a block with its own add_header directives does not inherit its parent’s add_header directives. Repeat the ones you still need, or use add_header_inherit merge; on nginx 1.29.3 and later.

Logging

Choose what gets recorded and where to watch it.

Directive	Description
`access_log /var/log/nginx/access.log combined;`	Write access logs in the default format
`access_log off;`	Disable access logging for a location
`error_log /var/log/nginx/error.log warn;`	Set the error log file and level
`log_format main '$remote_addr $status "$request" $request_time';`	Define a custom format in `http`
`access_log /var/log/nginx/api.log main;`	Use that custom format
`sudo tail -f /var/log/nginx/error.log`	Follow errors live
`sudo journalctl -u nginx -f`	Follow service-level messages
`sudo nginx -s reopen`	Reopen log files after rotation

Error log levels run debug, info, notice, warn, error, crit, alert, and emerg, from most to least verbose, and each level includes everything more severe. The debug level needs a build configured with --with-debug.

Common Variables

Values available in log formats, proxy headers, redirects, and conditions.

Variable	Description
`$host`	Host from the request line, then the Host header, then the matching server name
`$remote_addr`	Client IP address
`$request_uri`	Full original URI including the query string
`$uri`	Current URI after rewrites, without the query string
`$args`	Query string
`$scheme`	`http` or `https`
`$request_method`	GET, POST, and so on
`$status`	Response status code
`$body_bytes_sent`	Size of the response body
`$request_time`	Request duration in seconds
`$http_user_agent`	User-Agent header
`$proxy_add_x_forwarded_for`	Existing X-Forwarded-For plus the client address
`$upstream_addr`	Backend that served the request
`$upstream_response_time`	Backend response time
`$document_root`	Document root for the current request

Use these guides for the longer explanations behind these directives.

Guide	Description
`Nginx Commands You Should Know`	Service, testing, and reload commands in detail
`Nginx Location Blocks`	Match rules and the full priority order
`Nginx Reverse Proxy`	proxy_pass, headers, and WebSocket support
`Configuring the Nginx Error and Access Logs`	Log formats, levels, and rotation
`Redirect HTTP to HTTPS in Nginx`	Redirect patterns and the pitfalls to avoid
`How to Start, Stop, or Restart Nginx`	Reload versus restart and what each one does
`Nginx Server Blocks on Ubuntu`	Hosting several sites on one server
`How to Install Nginx on Ubuntu 26.04`	Installation, firewall rules, and first steps

Fix "No Space Left on Device" When df Shows Free Space

hello@linuxize.com (Linuxize) — Mon, 14 Sep 2026 18:10:00 +0200

A command can fail with No space left on device even when df -h reports gigabytes of free space:

output

touch: cannot touch '/var/lib/app/cache/item': No space left on device

The message does not always mean that the filesystem has run out of data blocks. Linux also needs a free inode for every new file, and the affected path may be on a different mount or a size-limited memory filesystem. Btrfs can run out of usable data or metadata space while df still reports free capacity, and the kernel returns the same error when a program exhausts its inotify watch limit.

This guide shows how to check each cause in a practical order, identify the exhausted resource, and free space safely.

Quick Reference

Check	Command
Space on the affected path	`df -h /affected/path`
Inodes on the affected path	`df -ih /affected/path`
Filesystem and source device	`findmnt -T /affected/path`
Inode-heavy directories	`sudo du --inodes -x -d 2 /path \| sort -n \| tail -20`
Deleted files still open	`sudo lsof +L1`
Btrfs allocation details	`sudo btrfs filesystem usage /affected/path`
inotify watch limit	`sysctl fs.inotify.max_user_watches`
Docker storage usage	`docker system df`
Journal size	`sudo journalctl --disk-usage`
APT cache size	`sudo du -sh /var/cache/apt/archives`

Check the Exact Path That Failed

Start by passing the affected path to df , not only the root directory:

Terminal
df -h /var/lib/app/cache

output

Filesystem Size Used Avail Use% Mounted on
/dev/nvme0n1p5 40G 17G 22G 44% /var

The Mounted on column shows which filesystem actually holds the path. Here the failing directory lives on a separate /var filesystem, not on the root filesystem that df -h / would have reported. A server may have separate filesystems for /, /var, /home, /tmp, container storage, or application data, and each one fills up independently.

Display the source device, filesystem type, and mount point with:

Terminal
findmnt -T /var/lib/app/cache

output

TARGET SOURCE FSTYPE OPTIONS
/var /dev/nvme0n1p5 ext4 rw,relatime

If Use% is 100%, the filesystem is genuinely out of data blocks. Use du or the guide on finding large files in Linux to locate the largest directories and files.

Check Inode Usage

When block usage looks normal, check inodes on the same path:

Terminal
df -ih /var/lib/app/cache

output

Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/nvme0n1p5 2.6M 2.6M 0 100% /var

Each file and directory consumes an inode . A filesystem containing millions of tiny cache, session, queue, or temporary files can run out of inodes while still having substantial free capacity in bytes.

If IFree is 0 or IUse% is 100%, inode exhaustion is the cause.

Find Directories Using the Most Inodes

The GNU du command can count inodes instead of bytes. To inspect /var without crossing into other mounted filesystems:

Terminal
sudo du --inodes -x -d 2 /var 2>/dev/null |
 sort -n |
 tail -20

output

12540 /var/lib/systemd
48201 /var/lib/docker
73122 /var/cache
2310884 /var/lib/app/cache
2485119 /var/lib
2621402 /var

The largest counts appear at the bottom. In this example, /var/lib/app/cache alone accounts for almost every inode on the filesystem. Repeat the command on the highest directory with a greater depth:

Terminal
sudo du --inodes -x -d 3 /var/lib/app/cache 2>/dev/null |
 sort -n |
 tail -20

This narrows the search before you remove anything.

For a file-count view grouped by parent directory, use:

Terminal
sudo find /var -xdev -type f -printf '%h\n' 2>/dev/null |
 sort |
 uniq -c |
 sort -n |
 tail -20

This command may take time on a filesystem containing millions of files. It does not delete anything.

Remove Excess Small Files Safely

Once you identify the directory, determine which application owns it and whether the files are disposable. Common sources include:

Application caches that do not expire old entries.
PHP session directories.
Mail queues.
Container image layers and build caches.
Monitoring data and rotated logs.
Temporary files created by failed jobs.

Preview old temporary files before deleting them:

Terminal
sudo find /tmp -xdev -type f -mtime +7 -print

If the list contains only files that are safe to remove, rerun it with -delete:

Terminal
sudo find /tmp -xdev -type f -mtime +7 -delete

Do not run broad find ... -delete commands against application directories until you know their retention rules. Prefer the application’s own cleanup command when one exists.

On Ubuntu and Debian, clear downloaded package archives with:

Terminal
sudo apt clean

Check the system journal’s current size:

Terminal
sudo journalctl --disk-usage

To remove archived journal data older than seven days:

Terminal
sudo journalctl --vacuum-time=7d

After cleanup, confirm that inodes are available again:

Terminal
df -ih /var/lib/app/cache

Check for Deleted Files Still Held Open

This check covers a different version of the problem: df reports a full filesystem, but du cannot account for the usage. A process may still have a deleted file open. The directory entry is gone, but the kernel does not release its blocks until the process closes the file descriptor.

List deleted files that remain open:

Terminal
sudo lsof +L1

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NLINK NODE NAME
java 4217 app 7w REG 259,3 8589934592 0 8123 /var/log/app.log (deleted)

The example shows an 8 GB deleted log still held by a Java process. Restart the owning service during an appropriate maintenance window:

Terminal
sudo systemctl restart app.service

Use the actual service name for your process. Confirm the file is gone from the lsof +L1 output and check space again with df -h.

For a detailed explanation of deleted open files, see the lsof command guide .

Check tmpfs and Container Filesystems

Paths such as /run, /dev/shm, and sometimes /tmp may use tmpfs, which is backed by memory and has its own size limit. Check the affected path directly:

Terminal
df -h /run /dev/shm /tmp

If a tmpfs mount is full, remove stale files owned by the relevant application or increase the mount limit after checking available memory.

Containers also write through overlay filesystems and mounted volumes. A host filesystem may have free space while a container-specific mount or storage pool is full. From the host, identify the path and mount with findmnt -T. Inside the container, run df -h and df -i to inspect its view.

For Docker, display the space used by images, containers, local volumes, and the build cache with:

Terminal
docker system df

This command reports Docker’s storage usage without removing anything. Review the detailed output before deciding which objects are safe to clean up.

Check Btrfs Data and Metadata Allocation

Btrfs manages data and metadata in separate block groups. Its copy-on-write allocation can return No space left on device even when the free-space total from df looks sufficient.

If findmnt reports btrfs for the affected path, inspect its allocation details with:

Terminal
sudo btrfs filesystem usage /affected/path

Review the Device unallocated, Free (estimated), Data, and Metadata values together. A filesystem may have free data space but too little unallocated capacity to create another metadata block group.

First, remove unneeded files or snapshots according to your retention policy. You can then reclaim completely unused data and metadata block groups with:

Terminal
sudo btrfs balance start -dusage=0 -musage=0 /mountpoint

Replace /mountpoint with the Btrfs mount point shown by findmnt. The usage=0 filters select only empty block groups and do not need extra workspace. Do not run an unfiltered balance as a general disk-full fix because it rewrites all selected block groups, can take a long time, and needs temporary free space.

Check the inotify Watch Limit

Editors, build tools, log shippers, and file sync daemons watch files through inotify. Every watched file or directory consumes one watch, and the kernel enforces a per-user limit. When a program exceeds that limit, inotify_add_watch() fails with the same No space left on device error even though the filesystem has free blocks and free inodes. Applications often report it in their own wording:

output

Error: ENOSPC: System limit for number of file watchers reached, watch '/srv/app/src'

Display the current limit:

Terminal
sysctl fs.inotify.max_user_watches

output

fs.inotify.max_user_watches = 65536

The value varies by distribution and kernel version. To find which process is consuming the watches, count them per file descriptor:

Terminal
sudo sh -c "grep -c '^inotify' /proc/*/fdinfo/* 2>/dev/null" |
 awk -F: '$2 > 0 {print $2, $1}' |
 sort -rn |
 head

output

62184 /proc/2811/fdinfo/23
1204 /proc/1533/fdinfo/9
118 /proc/994/fdinfo/12

The PID appears in the path, so ps -p 2811 -o comm= names the program holding the watches. If that program is watching a directory it does not need, such as a dependency or build output directory, exclude the directory in the program’s own configuration instead of raising the limit.

When the workload genuinely needs more watches, raise the limit for the running system:

Terminal
sudo sysctl fs.inotify.max_user_watches=524288

Make the change persistent across reboots:

Terminal
echo 'fs.inotify.max_user_watches=524288' | sudo tee /etc/sysctl.d/90-inotify.conf

Each watch consumes a small amount of kernel memory that cannot be swapped out, so set the limit to match the workload rather than to the largest value the system accepts.

Check Filesystem and Kernel Errors

If space and inodes are available but writes still fail, inspect recent kernel messages:

Terminal
sudo dmesg --level=err,warn | tail -50

Also check the system journal:

Terminal
sudo journalctl -k -p warning --since "1 hour ago"

Look for Btrfs allocation warnings, I/O errors, filesystem corruption, a read-only remount, or storage device failures. Errors such as Input/output error and Read-only file system need a different fix than No space left on device. A filesystem check may be required, but do not run fsck against a mounted filesystem. Schedule downtime, unmount the filesystem, and follow the appropriate recovery procedure.

Troubleshooting

df -h shows space but df -i shows 100 percent
The filesystem has exhausted its inode table. Find directories containing very large numbers of files, then remove or archive files according to the owning application’s retention policy.

df shows more usage than du
A process probably holds a deleted file open. Run sudo lsof +L1, identify the process, and restart the owning service to release the blocks.

The error occurs only in /tmp, /run, or /dev/shm
The path may be a size-limited tmpfs mount. Run df -h and df -i against that exact path rather than checking /.

Docker reports no space while the host has free capacity
Check Docker’s storage path and filesystem with docker info, docker system df, and findmnt -T /var/lib/docker. Review unused images, containers, build cache, and volumes before removing them.

Btrfs reports no space while df shows free capacity
Run sudo btrfs filesystem usage /affected/path and compare data, metadata, and unallocated space. After removing unneeded files or snapshots, a balance limited to -dusage=0 -musage=0 can reclaim empty block groups without starting a full balance.

An editor, build tool, or sync daemon reports no space while df and df -i look fine
The process reached the inotify watch limit. Check fs.inotify.max_user_watches, exclude directories the program does not need to watch, and raise the limit in /etc/sysctl.d/ when the workload requires it.

FAQ

What is an inode?
An inode stores filesystem metadata for a file or directory, such as its size, ownership, permissions, timestamps, and the location of its data blocks. Each filesystem has a finite inode supply, and each file normally consumes one inode regardless of its size.

Can I add more inodes to an existing ext4 filesystem?
The inode count is chosen when the filesystem is created and cannot be increased with an online setting change. The practical fixes are to remove excess files, move the workload to another filesystem, or recreate the filesystem with a smaller bytes-per-inode ratio suited to many small files.

Why does deleting a large file not free space immediately?
A running process may still have the deleted file open. Linux releases the blocks only when the last file descriptor closes, so df keeps reporting the space as used. Run sudo lsof +L1 to find the process and restart the owning service.

Why does the error appear on a system with terabytes of free space?
The failing write is limited by something other than total capacity, most often the inode count of the specific mount, a size-limited tmpfs, container storage, Btrfs allocation, or the inotify watch limit. Always check the exact path that failed rather than the root filesystem.

Conclusion

When df -h shows free space, check the affected path with df -ih and use findmnt to confirm its mount and filesystem type. Inode exhaustion, a full nested mount or tmpfs, container storage, Btrfs allocation, and the inotify watch limit each need a different fix, while lsof +L1 solves the separate case where df is full but du cannot explain the usage.

ffmpeg Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 13 Sep 2026 10:30:00 +0200

Install ffmpeg

Get the ffmpeg binaries and confirm the build.

Command	Description
`sudo apt install ffmpeg`	Install on Ubuntu, Debian, and derivatives
`sudo dnf install ffmpeg`	Install the full build from RPM Fusion on Fedora or RHEL
`sudo dnf install ffmpeg-free`	Install the codec-limited build from Fedora or EPEL
`ffmpeg -version`	Print the version and build configuration
`ffmpeg -encoders`	List every available encoder
`ffmpeg -decoders`	List every available decoder
`ffmpeg -formats`	List supported container formats

Inspect Media Files

Read stream details before deciding how to re-encode.

Command	Description
`ffprobe -hide_banner in.mp4`	Show streams, codecs, and duration
`ffprobe -v error -show_format in.mp4`	Print container metadata only
`ffprobe -v error -show_streams in.mp4`	Print every stream property
`ffprobe -v error -print_format json -show_format -show_streams in.mp4`	Machine-readable output
`ffprobe -v error -select_streams v:0 -show_entries stream=width,height -of csv=p=0 in.mp4`	Print the video resolution
`ffprobe -v error -show_entries format=duration -of csv=p=0 in.mp4`	Print the duration in seconds

Common Options

Options that control inputs, outputs, and command behavior.

Option	Description
`-i input`	Set an input file (repeat for multiple inputs)
`-y`	Overwrite the output file without asking
`-n`	Never overwrite an existing output file
`-hide_banner`	Suppress the build and library banner
`-loglevel error`	Print errors only
`-stats`	Keep the progress line while quiet
`-threads:v 4`	Request four threads for the video encoder when supported
`-f format`	Force an input or output format

Convert Between Formats

Change the container, with or without re-encoding.

Command	Description
`ffmpeg -i in.mkv -c copy out.mp4`	Repackage compatible streams without re-encoding
`ffmpeg -i in.avi out.mp4`	Convert using the default encoders
`ffmpeg -i in.mov -c:v libx264 -c:a aac out.mp4`	Convert to H.264 and AAC
`ffmpeg -i in.mp4 -c:v libvpx-vp9 -c:a libopus out.webm`	Convert to WebM
`ffmpeg -i in.mp4 -c:v copy -c:a aac out.mp4`	Re-encode the audio, keep the video
`ffmpeg -i in.wav out.flac`	Convert between audio formats

Compress Video

Lower the bitrate with constant quality or a controlled bitrate.

Command	Description
`ffmpeg -i in.mp4 -c:v libx264 -crf 23 -preset slow -c:a aac -b:a 128k out.mp4`	Compress with H.264
`ffmpeg -i in.mp4 -c:v libx265 -crf 28 -c:a copy out.mp4`	Compress with H.265 at a similar quality
`ffmpeg -i in.mp4 -c:v libx264 -crf 18 out.mp4`	Keep near-source quality
`ffmpeg -i in.mp4 -c:v libx264 -b:v 2M -maxrate 2M -bufsize 4M -c:a copy out.mp4`	Target 2 Mb/s with a 2 Mb/s VBV ceiling
`ffmpeg -i in.mp4 -c:v h264_nvenc -cq 23 -c:a copy out.mp4`	Encode on an NVIDIA GPU
`ffmpeg -vaapi_device /dev/dri/renderD128 -i in.mp4 -vf 'format=nv12,hwupload' -c:v h264_vaapi -c:a copy out.mp4`	Encode with VA-API

CRF runs from 0 (lossless) to 51 (worst). Lower values mean larger files, and 18 to 28 covers most work. Slower presets such as slow or veryslow shrink the file further at the same CRF.

Audio

Extract, convert, and adjust audio tracks.

Command	Description
`ffmpeg -i in.mp4 -vn -c:a libmp3lame -q:a 2 out.mp3`	Extract audio as MP3
`ffmpeg -i in.mp4 -vn -c:a copy out.m4a`	Copy compatible audio without re-encoding
`ffmpeg -i in.mp4 -vn -c:a aac -b:a 192k out.aac`	Extract audio as AAC
`ffmpeg -i in.mp3 -ac 1 -ar 16000 out.wav`	Downmix to mono at 16 kHz
`ffmpeg -i in.mp4 -c:v copy -af 'volume=1.5' out.mp4`	Raise the volume by 50 percent
`ffmpeg -i in.mp4 -c:v copy -af 'loudnorm=I=-23' -ar 48000 out.mp4`	Apply one-pass EBU R128 normalization at -23 LUFS
`ffmpeg -i in.mp4 -an -c:v copy out.mp4`	Strip the audio track

The -q:a scale for libmp3lame runs from 0 (best) to 9 (worst), and 2 is a good default for speech and music alike.

Resize, Crop, and Rotate

Reshape the picture with video filters.

Command	Description
`ffmpeg -i in.mp4 -vf scale=1280:-2 -c:a copy out.mp4`	Scale to 1280 wide, keep the aspect ratio
`ffmpeg -i in.mp4 -vf scale=-2:720 -c:a copy out.mp4`	Scale to 720 high
`ffmpeg -i in.mp4 -vf scale=1920:1080 -c:a copy out.mp4`	Force an exact resolution
`ffmpeg -i in.mp4 -vf 'crop=640:480:100:50' -c:a copy out.mp4`	Crop 640x480 starting at x=100, y=50
`ffmpeg -i in.mp4 -vf 'transpose=1' -c:a copy out.mp4`	Rotate 90 degrees clockwise
`ffmpeg -i in.mp4 -vf 'hflip' -c:a copy out.mp4`	Mirror horizontally
`ffmpeg -i in.mp4 -vf 'pad=1920:1080:(ow-iw)/2:(oh-ih)/2' -c:a copy out.mp4`	Pad to 1080p with centered bars

Use -2 rather than -1 for the free dimension so the calculated size stays even, as required by common 4:2:0 output formats.

Trim and Concatenate

Cut clips and join files back together.

Command	Description
`ffmpeg -ss 00:01:00 -to 00:02:30 -i in.mp4 -c copy clip.mp4`	Fast cut at the nearest keyframe
`ffmpeg -ss 00:01:00 -to 00:02:30 -i in.mp4 -c:v libx264 -c:a aac clip.mp4`	Frame-accurate cut by re-encoding
`ffmpeg -ss 00:00:30 -t 15 -i in.mp4 -c copy clip.mp4`	Cut 15 seconds starting at 30 seconds
`ffmpeg -i in.mp4 -t 60 -c copy first-minute.mp4`	Keep the first minute
`ffmpeg -f concat -safe 0 -i list.txt -c copy out.mp4`	Join files listed in list.txt
`ffmpeg -i in.mp4 -c copy -f segment -segment_time 600 part%03d.mp4`	Split near ten-minute boundaries at keyframes

Each line of list.txt takes the form file '/path/to/clip.mp4'. The concat demuxer requires matching stream layouts and parameters, including codecs and time bases.

Images, Thumbnails, and GIFs

Move between video and still images.

Command	Description
`ffmpeg -ss 00:00:10 -i in.mp4 -frames:v 1 thumb.jpg`	Grab a single frame at ten seconds
`ffmpeg -i in.mp4 -vf fps=1 frame%04d.png`	Export one frame per second
`ffmpeg -i in.mp4 -vf 'fps=1/10' frame%04d.jpg`	Export one frame every ten seconds
`ffmpeg -framerate 30 -i frame%04d.png -c:v libx264 -pix_fmt yuv420p out.mp4`	Build a video from an image sequence
`ffmpeg -i in.mp4 -vf 'fps=10,scale=480:-1:flags=lanczos' out.gif`	Create a GIF
`ffmpeg -i in.mp4 -vf 'fps=10,scale=480:-1:flags=lanczos,palettegen' palette.png`	Build a GIF color palette
`ffmpeg -i in.mp4 -i palette.png -lavfi 'fps=10,scale=480:-1:flags=lanczos [x]; [x][1:v] paletteuse' out.gif`	Create a GIF with that palette

Subtitles

Attach, burn in, or pull out subtitle tracks.

Command	Description
`ffmpeg -i in.mp4 -i subs.srt -map 0 -map 1:0 -c copy -c:s mov_text out.mp4`	Add soft subtitles to MP4
`ffmpeg -i in.mkv -i subs.srt -map 0 -map 1:0 -c copy out.mkv`	Add soft subtitles to MKV
`ffmpeg -i in.mp4 -vf subtitles=subs.srt -c:a copy out.mp4`	Burn subtitles into the picture
`ffmpeg -i in.mkv -vf 'subtitles=in.mkv:si=0' -c:a copy out.mp4`	Burn in an embedded subtitle stream
`ffmpeg -i in.mkv -map 0:s:0 subs.srt`	Convert the first subtitle track to SRT when it is text based
`ffmpeg -i in.mkv -map 0 -sn -c copy out.mkv`	Remove every subtitle track and keep other streams

Stream Mapping and Metadata

Choose which streams reach the output.

Command	Description
`ffmpeg -i in.mkv -map 0:v:0 -map 0:a:1 -c copy out.mkv`	Keep the first video and second audio stream
`ffmpeg -i in.mkv -map 0 -c copy out.mkv`	Keep every stream from the input
`ffmpeg -i video.mp4 -i audio.mp3 -map 0:v -map 1:a -c:v copy -shortest out.mp4`	Combine separate video and audio files
`ffmpeg -i in.mp4 -map_metadata -1 -c copy out.mp4`	Strip global metadata
`ffmpeg -i in.mp3 -metadata title='Track name' -c copy out.mp3`	Set a metadata tag
`ffmpeg -i in.mp4 -c copy -movflags +faststart out.mp4`	Move the MP4 index to the front for streaming
`for f in *.mkv; do ffmpeg -i "$f" -c:v libx264 -crf 23 -c:a aac "${f%.mkv}.mp4"; done`	Batch convert a directory

Use these guides for the longer explanations behind these commands.

Guide	Description
`ffmpeg Command in Linux`	Full ffmpeg tutorial with worked examples
`Convert MP4 to MP3 with ffmpeg`	Audio extraction and quality settings in detail

pnpm Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 11 Sep 2026 08:45:00 +0200

Install and Update pnpm

Set up the pnpm executable and keep it current.

Command	Description
`curl -fsSL https://get.pnpm.io/install.sh \| sh -`	Install with the standalone script
`wget -qO- https://get.pnpm.io/install.sh \| sh -`	Install without curl
`npx get-pnpm`	Install through npm
`pnpm self-update`	Update pnpm to the current release
`pnpm self-update 12.3.4`	Move to a specific pnpm version
`pnpm setup`	Create PNPM_HOME and update the shell profile
`pnpm --version`	Print the installed pnpm version

Node.js Runtimes

Install language runtimes with pnpm itself.

Command	Description
`pnpm runtime set node lts -g`	Install the Node.js LTS release
`pnpm runtime set node 22 -g`	Install a Node.js major version
`pnpm runtime set node latest -g`	Install the newest Node.js release
`pnpm runtime set node 22.23.2 -g`	Install an exact Node.js version
`pnpm runtime set deno 2 -g`	Install Deno
`pnpm runtime set bun latest -g`	Install Bun

Project Setup

Create and edit project metadata.

Command	Description
`pnpm init`	Create package.json
`pnpm init --init-package-manager`	Create package.json and pin pnpm
`pnpm init --bare`	Create package.json with required fields only
`pnpm import`	Build pnpm-lock.yaml from another lockfile
`pnpm pkg get name`	Print a package.json field
`pnpm pkg set scripts.start="node index.js"`	Add or update a field
`pnpm pkg delete scripts.old`	Remove a package.json field

Add Dependencies

Record packages in package.json and the lockfile.

Command	Description
`pnpm add express`	Add a runtime dependency
`pnpm add -D eslint`	Add a development dependency
`pnpm add -O sharp`	Add an optional dependency
`pnpm add -E express`	Add without a version range
`pnpm add express@5.1.0`	Add a specific version
`pnpm add -g http-server`	Add a global package
`pnpm add -w typescript`	Add to the workspace root

Install Dependencies

Reproduce a dependency tree from the lockfile.

Command	Description
`pnpm install`	Install everything package.json declares
`pnpm install --frozen-lockfile`	Install without changing the lockfile
`pnpm ci`	Clean install for CI pipelines
`pnpm install --prod`	Skip development dependencies
`pnpm install --offline`	Install from the store only
`pnpm install --ignore-scripts`	Install without lifecycle scripts
`pnpm fetch`	Fetch the lockfile contents into the store

Update and Inspect

Check versions and trace where packages come from.

Command	Description
`pnpm outdated`	Show packages with newer versions
`pnpm update`	Update within package.json ranges
`pnpm update express --latest`	Update one package and its range
`pnpm update -i`	Choose updates interactively
`pnpm list --depth 0`	List direct dependencies
`pnpm why express`	Explain why a package is installed
`pnpm licenses list`	List dependency licenses

Remove and Clean

Drop packages and reclaim project space.

Command	Description
`pnpm remove express`	Remove a dependency
`pnpm remove -g http-server`	Remove a global package
`pnpm prune`	Remove extraneous packages
`pnpm prune --prod`	Remove development dependencies
`pnpm dedupe`	Collapse duplicate versions in the lockfile
`pnpm dedupe --check`	Report duplicates without writing
`pnpm pm clean`	Remove node_modules from every workspace project

Scripts and Execution

Run package scripts and one-off tools.

Command	Description
`pnpm run build`	Run a named script
`pnpm start`	Run the start script
`pnpm test`	Run the test script
`pnpm run build -- --watch`	Pass arguments to a script
`pnpm exec eslint .`	Run a local package binary
`pnpm dlx create-vite@latest app`	Run a package without installing it
`pnpm pm <command>`	Force a built-in command over a same-named script

Workspaces and Filtering

Target one package or a slice of a monorepo.

Command	Description
`pnpm -r run build`	Run a script in every workspace package
`pnpm --filter web-app add zod`	Add a dependency to one package
`pnpm --filter web-app run test`	Run a script in one package
`pnpm --filter "@scope/*" test`	Select packages by pattern
`pnpm --filter web-app... build`	Select a package and its dependencies
`pnpm --filter ...web-app build`	Select a package and its dependents
`pnpm --filter "...[origin/main]" build`	Select packages changed since a branch

Store and Cache

Maintain the shared content-addressable store.

Command	Description
`pnpm store path`	Print the store location
`pnpm store status`	Check the store for modified packages
`pnpm store prune`	Remove orphaned packages from the store
`pnpm store add express@5.1.0`	Add a package to the store
`pnpm cache path`	Print the metadata cache directory
`pnpm root -g`	Print the global node_modules path
`pnpm bin -g`	Print the global binary directory

Security and Diagnostics

Audit dependencies and check the installation.

Command	Description
`pnpm audit`	Scan dependencies for advisories
`pnpm audit --prod`	Audit production dependencies only
`pnpm audit --fix`	Add overrides for non-vulnerable versions
`pnpm doctor`	Run diagnostics on the pnpm environment
`pnpm sbom --sbom-format spdx`	Generate a software bill of materials
`pnpm approve-builds`	Approve dependency build scripts
`pnpm ignored-builds`	List packages with blocked build scripts

Use these references for Node.js package workflows.

Guide	Description
`pnpm Command`	Full pnpm tutorial with examples
`npm Command`	The npm equivalents of these commands
`Install Node.js on Ubuntu 26.04`	Install Node.js and npm

How to Fix APT and dpkg Lock Errors on Ubuntu and Debian

hello@linuxize.com (Linuxize) — Wed, 09 Sep 2026 10:20:00 +0200

When you install or update packages on Ubuntu or Debian, you may see an error saying that APT or dpkg could not obtain a lock:

output

E: Could not get lock /var/lib/dpkg/lock-frontend. It is held by process 2481 (apt)
N: Be aware that removing the lock file is not a solution and may break your system.
E: Unable to acquire the dpkg frontend lock (/var/lib/dpkg/lock-frontend), is another process using it?

The lock prevents two package managers from changing the package database at the same time. In most cases, another update is still running and the correct fix is to let it finish. If the process is stuck, you need to identify and stop it before repairing the package state.

This guide explains how to resolve APT and dpkg lock errors without deleting lock files or damaging the package database.

Quick Reference

For a printable quick reference, see the apt cheatsheet .

Task	Command
Show the process from the error	`ps -p PID -o pid,etime,cmd`
Check APT lock holders	`sudo lsof /var/lib/dpkg/lock-frontend /var/lib/dpkg/lock /var/cache/apt/archives/lock /var/lib/apt/lists/lock`
Check with fuser	`sudo fuser -v /var/lib/dpkg/lock-frontend`
Check automatic update services	`systemctl status apt-daily.service apt-daily-upgrade.service unattended-upgrades.service`
Ask a stuck process to stop	`sudo kill PID`
Finish pending package configuration	`sudo dpkg --configure -a`
Repair broken dependencies	`sudo apt --fix-broken install`
Refresh the package index	`sudo apt update`

Why the Lock Error Occurs

APT and dpkg use lock files to coordinate access to package data. A lock error commonly appears when:

Another terminal is running apt, apt-get, dpkg, or a graphical software manager.
Ubuntu’s automatic update services are checking for or installing updates.
A package operation was interrupted and left a process running.
A package manager process stopped responding.

The error often includes the process ID that holds the lock. That PID is the safest place to start because it tells you which process currently owns package management.

Warning

Do not delete /var/lib/dpkg/lock, /var/lib/dpkg/lock-frontend, /var/cache/apt/archives/lock, or /var/lib/apt/lists/lock as a first response. Removing a lock file does not stop the process using the package database, and two concurrent writers can leave packages in an inconsistent state.

Step 1: Check the Process Holding the Lock

Replace 2481 with the PID shown in your error:

Terminal
ps -p 2481 -o pid,etime,cmd

output

 PID ELAPSED CMD
2481 01:42 apt upgrade

The ELAPSED column shows how long the process has been running. If it is an expected apt, dpkg, or update process and its runtime is reasonable, wait for it to finish.

When the error does not show a PID, check the common lock files with lsof:

Terminal
sudo lsof \
 /var/lib/dpkg/lock-frontend \
 /var/lib/dpkg/lock \
 /var/cache/apt/archives/lock \
 /var/lib/apt/lists/lock

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
apt 2481 root 4uW REG 8,2 0 812 /var/lib/dpkg/lock-frontend

The COMMAND and PID columns identify the process. If lsof is unavailable, use fuser:

Terminal
sudo fuser -v /var/lib/dpkg/lock-frontend

output

 USER PID ACCESS COMMAND
/var/lib/dpkg/lock-frontend:
root 2481 F.... apt

Do not start another package command until the listed process has finished or been stopped safely.

Step 2: Check Automatic Updates

Ubuntu and Debian systems may run background package operations through systemd. Check the APT update services with:

Terminal
systemctl status apt-daily.service apt-daily-upgrade.service unattended-upgrades.service

If any of these services is active, wait several minutes and check again:

Terminal
systemctl is-active apt-daily.service apt-daily-upgrade.service unattended-upgrades.service

output

inactive
inactive
inactive

Once all three services are inactive, retry your original package command.

You can also inspect recent service messages:

Terminal
sudo journalctl -u apt-daily.service -u apt-daily-upgrade.service -u unattended-upgrades.service --since "30 minutes ago"

The journal shows whether the updater is downloading packages, installing them, or failing repeatedly.

Step 3: Stop a Stuck Package Process

Only stop the process when it has clearly stopped making progress. Check the terminal output or service journal first, then confirm its command, state, and elapsed time:

Terminal
ps -p 2481 -o pid,stat,etime,cmd

The STAT column shows the current process state, but it does not prove that a process is stuck. A sleeping package process may still be waiting for network or disk activity, so use the command output and logs as your main evidence.

First, ask the process to terminate normally:

Terminal
sudo kill 2481

Wait a few seconds, then check whether it still exists:

Terminal
ps -p 2481

If the command prints no process row, it has exited. Avoid sending SIGKILL unless a normal termination fails, because an immediate kill gives the package manager no opportunity to clean up.

If an automatic update service owns the process, stop the service instead of killing a child process:

Terminal
sudo systemctl stop apt-daily.service apt-daily-upgrade.service unattended-upgrades.service

Check the lock again before continuing:

Terminal
sudo fuser -v /var/lib/dpkg/lock-frontend

No output means no visible process is accessing that lock file.

Step 4: Repair Interrupted Package Configuration

Stopping a package process may leave unpacked packages waiting to be configured. Complete those pending operations with:

Terminal
sudo dpkg --configure -a

This command configures packages that were unpacked but not fully configured. Our dpkg command guide explains package states and other useful recovery options.

Next, repair missing or broken dependencies:

Terminal
sudo apt --fix-broken install

Review the proposed package changes before confirming. After the repair completes, refresh the package index:

Terminal
sudo apt update

You can then retry the original install or upgrade command.

Lock File Locations

The path in the error depends on which package-management layer is busy:

/var/lib/dpkg/lock-frontend - Frontend lock used by APT before it calls dpkg.
/var/lib/dpkg/lock - Lock for the dpkg package database.
/var/cache/apt/archives/lock - Lock for downloaded package archives.
/var/lib/apt/lists/lock - Lock for repository index files.

The diagnostic process is the same for each path: identify the process using the file, let it finish or stop it safely, and repair interrupted package configuration when necessary.

If No Process Holds the Lock

If lsof and fuser show no holder, do not remove the lock file. The dpkg tools keep these files in place, and the presence of a file does not mean that its lock is active.

First, confirm that no package manager is running:

Terminal
ps aux | grep -E '[a]pt|[d]pkg|unattended-upgrade'

Retry the original package command. If the lock error returns with a PID, another process acquired the lock between your checks. Inspect that new process before taking any other action.

Run the recovery commands only if an earlier package operation was interrupted:

Terminal
sudo dpkg --configure -a
sudo apt --fix-broken install

Troubleshooting

The lock is held by unattended-upgrade
Wait for the automatic update to finish and monitor it with systemctl status apt-daily-upgrade.service unattended-upgrades.service or sudo journalctl -u apt-daily-upgrade.service -u unattended-upgrades.service. Stop it only when it has clearly failed or remained stuck for an unreasonable time.

dpkg –configure -a reports dependency problems
Run sudo apt --fix-broken install to install missing dependencies and finish incomplete package operations. Then run sudo dpkg --configure -a again if the error requests it.

The lock returns immediately
Check the PID in the new error instead of assuming that the previous process restarted. An APT timer may have launched a new one-shot package operation between your checks. Inspect the services and their next scheduled runs with:

Terminal
systemctl status apt-daily.service apt-daily-upgrade.service
systemctl list-timers apt-daily.timer apt-daily-upgrade.timer

Do not repeatedly kill package processes. Wait for the active service to finish or stop that service only after confirming that it is stuck.

The lock error appears inside a script
Another package process may overlap with the script. For an apt-get install command, set a bounded dpkg lock timeout so the script waits instead of failing immediately:

sh
sudo apt-get -o DPkg::Lock::Timeout=60 install -y curl

This example waits up to 60 seconds for the dpkg lock. If the timeout expires, log the failure and stop the script. Do not add rm commands for APT or dpkg lock files.

A graphical software manager is open
Close applications such as App Center, Software Updater, Synaptic, or other package frontends. Wait for their background process to exit, then retry the terminal command.

FAQ

Is it safe to delete /var/lib/dpkg/lock?
Deleting the file is not the correct first fix. The lock is associated with a running process, so removing the path does not stop that process. Identify the holder with lsof, fuser, or the PID in the error and deal with the process instead.

How long should I wait for apt-daily?
Most background checks finish within a few minutes, but upgrades can take longer depending on package downloads and installation work. Check its status and journal rather than relying on a fixed timeout.

What does dpkg –configure -a do?
It configures all packages that were unpacked but not fully configured. This is the standard recovery step after a package operation is interrupted.

Why does the error mention lock-frontend instead of lock?
APT uses a frontend lock to ensure that only one high-level package manager controls dpkg at a time. The lower-level dpkg database has its own lock as well.

Can I prevent automatic updates from taking the lock?
You can change the system’s automatic update schedule or policy, but disabling security updates only to avoid occasional lock contention is usually a poor tradeoff. It is safer to schedule maintenance commands outside the automatic update window.

Conclusion

An APT or dpkg lock error usually means package management is already active, not that the lock file is broken. Identify the holder, wait or stop it safely, then use dpkg --configure -a and apt --fix-broken install to repair any interrupted work. For more package maintenance examples, see our APT command guide .

vmstat Command in Linux: Memory, CPU, and I/O Statistics

hello@linuxize.com (Linuxize) — Mon, 07 Sep 2026 17:10:00 +0200

When a server slows down, the first question is what it is waiting on. Is the CPU saturated? Is memory exhausted and the system is swapping? Is disk I/O holding up processes? The vmstat command puts clues about each resource in one compact table, making it a useful first check before you move to a more specialized monitoring tool.

vmstat stands for virtual memory statistics and is provided by procps-ng. Most full Linux installations include it through a package named procps or procps-ng.

This guide explains how to read vmstat output and use its most useful options.

Syntax

txt
vmstat [OPTIONS] [delay [count]]

delay - Seconds between reports. Without it, vmstat prints a single report and exits.
count - Number of reports to print. When you set a delay without a count, vmstat runs until you press Ctrl+C.

Reading the Default Output

Running vmstat without arguments prints one report:

Terminal
vmstat

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
1 0 0 362824 94368 1207160 0 0 12 5 48 112 1 0 99 0 0 0

The process and memory columns show values from the moment the command runs. In the first report, swap, I/O, system, and CPU activity is averaged since the last boot. The output has six sections.

procs

r - Runnable processes, including processes running or waiting for CPU time. Compare a sustained value with the logical CPU count from nproc; a busy run queue together with little idle CPU suggests CPU contention.
b - Processes blocked while waiting for I/O to complete.

memory (default KiB)

swpd - Swap space currently in use.
free - Idle memory that is not currently in use.
buff - Memory used as buffers.
cache - Memory used as cache. Linux uses otherwise idle RAM to cache data, so a large value is normal.

The free column alone does not show how much memory applications can readily use. Check the available value from the free command when you need that figure.

swap (KiB/s)

si - Memory swapped in from disk per second.
so - Memory swapped out to disk per second.

Occasional swap activity is not enough to diagnose a problem. Sustained si or so activity together with falling free and cache memory is a stronger sign of memory pressure.

io (KiB/s)

bi - Kibibytes received from block devices per second.
bo - Kibibytes sent to block devices per second.

system

in - Interrupts per second, including the clock interrupt.
cs - Context switches per second. Compare this value with the system’s normal workload rather than using a fixed threshold.

cpu (percentage of total CPU time)

us - Time spent running user-space code, including nice time.
sy - Time spent running kernel code.
id - Idle time.
wa - Time the CPU was idle while waiting for I/O. A sustained increase is a clue to investigate I/O, but it does not identify the device or prove that storage is the bottleneck.
st - Time taken from a virtual machine by the hypervisor.
gu - Time spent running KVM guest code, including guest nice time.

Older procps-ng versions may end the CPU columns at st. The meaning of the preceding columns is unchanged.

Continuous Monitoring

A single report gives limited information about a live problem. Pass a delay to watch activity over consecutive intervals:

Terminal
vmstat 2

This prints a new line every two seconds until you press Ctrl+C. The first line still contains activity averages since boot, while later lines cover each two-second interval. Add -y when you want to omit that first report:

Terminal
vmstat -y 2

To collect ten interval reports and then stop, add a count:

Terminal
vmstat -y 2 10

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free buff cache si so bi bo in cs us sy id wa st gu
0 0 0 360988 94504 1208068 0 0 0 0 92 198 0 0 100 0 0 0
1 0 0 360744 94504 1208068 0 0 0 16 104 231 1 0 99 0 0 0
0 0 0 360720 94504 1208080 0 0 0 0 89 190 0 0 100 0 0 0

Only the first three rows are shown here. Because -y skips the immediate boot-average report, the command waits for and records ten two-second intervals, taking about 20 seconds.

Add timestamps and redirect the reports to a file when you want to review them later:

Terminal
vmstat -y -t 2 10 > vmstat.log

Active and Inactive Memory

The -a flag replaces the buff and cache columns with inact (inactive memory) and active (active memory):

Terminal
vmstat -a

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu-------
r b swpd free inact active si so bi bo in cs us sy id wa st gu
0 0 0 358900 921048 490836 0 0 12 5 48 112 1 0 99 0 0 0

Active memory contains pages used recently and likely to be referenced again. Inactive memory has not been accessed recently and contains candidates for reclaim when the system needs space. This view is useful when several workloads compete for memory.

Adding Timestamps

The -t flag appends a timestamp column to each line, which is useful when capturing output to a log file:

Terminal
vmstat -y -t 2 5

output

procs -----------memory---------- ---swap-- -----io---- -system-- -------cpu------- -----timestamp-----
r b swpd free buff cache si so bi bo in cs us sy id wa st gu EEST
0 0 0 362824 94368 1207160 0 0 0 0 88 195 0 0 100 0 0 0 2026-09-07 10:30:02
0 0 0 362700 94368 1207160 0 0 0 12 94 207 1 0 99 0 0 0 2026-09-07 10:30:04

The timestamp uses the system’s local time zone. The example shows only the first two of the five requested reports.

Wide Output Mode

On systems with many CPU cores or high counter values, the default column widths can cause numbers to truncate or columns to overlap. The -w flag switches to a wider format that avoids truncation:

Terminal
vmstat -w 2

Memory Event Counters

The -s flag prints current memory totals followed by CPU and event counters accumulated since boot:

Terminal
vmstat -s

output

 2023560 K total memory
417148 K used memory
493280 K active memory
921048 K inactive memory
362824 K free memory
94368 K buffer memory
1207160 K swap cache
2097148 K total swap
0 K used swap
2097148 K free swap
48712 non-nice user cpu ticks
952 nice user cpu ticks
12836 system cpu ticks
5181148 idle cpu ticks
5984 IO-wait cpu ticks
0 IRQ cpu ticks
3268 softirq cpu ticks
0 stolen cpu ticks
0 non-nice guest cpu ticks
0 nice guest cpu ticks
621264 K paged in
247908 K paged out
0 pages swapped in
0 pages swapped out
2518704 interrupts
5884112 CPU context switches
1788713671 boot time
52364 forks

The exact list varies with the kernel and procps-ng version. This view is useful for checking current swap totals and cumulative paging activity. The event counters and CPU ticks start again after a reboot.

Disk Statistics

The -d flag shows cumulative read and write statistics broken down by disk device:

Terminal
vmstat -d

output

disk- ------------reads------------ ------------writes----------- -----IO------
total merged sectors ms total merged sectors ms cur sec
sda 12486 983 956342 34208 18402 4682 920612 142104 0 42
sdb 142 0 9168 252 0 0 0 0 0 0

total - Total number of completed read or write operations.
merged - Adjacent requests grouped into a single I/O operation.
sectors - Total sectors read or written.
ms - Total milliseconds spent reading or writing.
cur - I/O operations currently in progress.
sec - Total seconds spent doing I/O.

To see statistics for a specific partition rather than the whole disk:

Terminal
vmstat -p /dev/sda1

output

sda1 reads read sectors writes requested writes
12384 948812 18320 910484

Changing Output Units

By default, memory and swap values use 1024-byte kibibytes. The -S flag changes their display unit:

Terminal
vmstat -S M 2

Accepted values are k (1000 bytes), K (1024 bytes), m (1,000,000 bytes), and M (1,048,576 bytes). This option does not change the swap (si, so) or I/O (bi, bo) fields, which stay in KiB/s.

Options Reference

-a - Show active and inactive memory instead of buffer and cache values.
-d - Display disk statistics per device.
-D - Display summary disk statistics.
-f - Show the number of forks since boot.
-m - Display slab memory information.
-n - Print the header only once.
-p device - Display partition-level disk statistics.
-s - Display memory statistics and event counters.
-S unit - Set the memory and swap output unit to k, K, m, or M.
-t - Append a timestamp to each line.
-w - Use wider columns to prevent unwanted column breaks.
-y - Omit the first report containing activity averages since boot.

Quick Reference

Task	Command
Single snapshot	`vmstat`
Update every 2 seconds	`vmstat 2`
Skip the boot-average report	`vmstat -y 2`
10 interval reports, 2 seconds apart	`vmstat -y 2 10`
Active/inactive memory view	`vmstat -a 2`
Timestamped output	`vmstat -t 2`
Wide output	`vmstat -w 2`
Memory event counters	`vmstat -s`
Disk statistics	`vmstat -d`
Partition statistics	`vmstat -p /dev/sda1`
Output in megabytes	`vmstat -S M 2`

Troubleshooting

All values look like averages, not live activity
The first line contains activity averages since boot, although its process and memory fields are current values. Run vmstat -y 2 to skip that line and show only two-second interval reports.

The shell reports vmstat: command not found
Install the procps package on Ubuntu and Debian with sudo apt install procps. Fedora and RHEL use sudo dnf install procps-ng, while Arch Linux uses sudo pacman -S procps-ng.

vmstat cannot read data under /proc
The command needs access to files under /proc. Containers and systems mounted with restrictive /proc options may hide some statistics. The vmstat -m view also requires access to /proc/slabinfo, which may be unavailable to a standard user.

Conclusion

Run vmstat -y 2 as a first check when a system slows down, then follow the signal: use top or htop for per-process CPU and memory usage, or iostat -xz 2 for device latency and queues. For per-core and historical CPU data, see the guide on checking CPU usage in Linux .

btop Command in Linux: Monitor System Resources

hello@linuxize.com (Linuxize) — Sat, 05 Sep 2026 14:35:00 +0200

When a server feels slow, the first minutes are often spent juggling tools: top for processes, free for memory, and separate commands for network and disk activity. btop puts these metrics on one screen, with live graphs for CPU, memory, disks, and network traffic alongside a filterable process list. It is the C++ continuation of the bashtop and bpytop resource monitors.

This guide explains how to install btop, read its dashboard, manage processes from it, and adjust its configuration.

Installing btop

btop is available from the package repositories of current Ubuntu, Debian, Fedora, RHEL-based, and Arch Linux releases.

On Ubuntu, Debian, and Derivatives, install it with apt:

Terminal
sudo apt install btop

On Fedora, RHEL, and Derivatives, use dnf. Fedora provides the package directly:

Terminal
sudo dnf install btop

On RHEL, Rocky Linux, and AlmaLinux, enable the EPEL repository before installing btop:

Terminal
sudo dnf install epel-release
sudo dnf install btop

On Arch Linux, install the package with pacman:

Terminal
sudo pacman -S btop

Verify the installation with the version option:

Terminal
btop --version

btop Syntax

The btop command accepts the following general syntax:

txt
btop [OPTIONS]

Run it without options to open the interactive dashboard:

Terminal
btop

Use the built-in help to see the options supported by your installed version:

Terminal
btop --help

The options you will use most often are:

--low-color - Disable truecolor and convert to 256 colors.
-t - Force TTY mode with 16 colors and tty-friendly graph symbols.
-p <id> - Start with one of the saved presets, 0 through 9.
--version - Print the installed version.

Short option names changed in btop 1.4.2, so prefer the long forms above when you write scripts or aliases that must work across distributions.

Reading the Dashboard

The screen is divided into four boxes. The top box graphs per-core CPU usage along with frequency, temperature (when sensors are available), load average, and uptime. The left box covers memory and disks: used, available, and cached memory, plus usage and I/O activity for each mounted filesystem. The right box graphs network download and upload per interface. The bottom box is the process list.

Everything is live and mouse-aware: you can click a process to select it, click column headers to change sorting, and scroll the list with the wheel. The same navigation works from the keyboard. Press 1 to toggle the CPU box, 2 for memory and disks, 3 for network, and 4 for processes.

In the process list, memory usage is based on resident memory. By default, CPU usage is shown as a share of the machine’s total CPU capacity. Press c to switch to per-core scaling, where 100% represents one fully used core and a multithreaded process can exceed 100%. For more detail on the underlying numbers, see the free command for memory and the load discussion in our top command guide .

Working with the Process List

The process list supports keyboard and mouse navigation. These keys cover the most common tasks:

Up and Down arrows select a process; Enter opens a detail view with its own CPU and memory graphs for the selected process.
f or / starts a filter. Type part of a process name and press Enter to keep only matching rows. Press Delete after leaving the filter editor to clear the active filter; Esc cancels an edit and restores the previous filter.
e toggles tree view, showing parent-child relationships so you can see what started a process.
Left and Right arrows change the sort column (CPU, memory, PID, and so on), and r reverses the order.

Filtering plus the detail view covers the “what is eating this machine” workflow: filter to the suspect, Enter to watch its graphs, and you have a per-process monitor without leaving the dashboard.

Managing Processes

With a process selected, three keys open signal actions:

t opens a confirmation prompt for SIGTERM, the normal termination request.
k opens a confirmation prompt for SIGKILL, which stops the process immediately.
s opens a menu of all signals, for cases like SIGHUP or SIGSTOP.

Warning

Try SIGTERM first and wait for the process to exit. SIGKILL does not let the process save data or run cleanup handlers, so use it only when the process ignores SIGTERM.

You can signal processes owned by your user. Run sudo btop only when you need to manage a process owned by another account, and confirm the selected PID before sending a signal.

Options and Themes

Press F2 or o to open the options screen directly. You can change the update interval, visible boxes, temperature units, network interface, and color theme from this menu. Press Esc for the main menu or q to quit.

When $XDG_CONFIG_HOME is set, btop stores its settings in $XDG_CONFIG_HOME/btop/btop.conf. Otherwise, it uses ~/.config/btop/btop.conf. The file is plain text and can also be edited directly:

~/.config/btop/btop.conftxt
color_theme = "tokyo-night"
theme_background = False
update_ms = 2000
shown_boxes = "cpu mem net proc"

Setting theme_background = False makes btop use your terminal’s background. The 2000 ms update interval is the upstream default and provides steadier graph samples than a very short interval.

Distribution packages usually place system themes in /usr/share/btop/themes, while source installations may use /usr/local/share/btop/themes. Put additional themes in $XDG_CONFIG_HOME/btop/themes or ~/.config/btop/themes to make them available in the picker.

GPU panels appear only when the btop binary was built with GPU support and the required driver libraries are available. On Linux x86_64, upstream supports NVIDIA and AMD GPUs and Intel integrated GPUs, but the exact support depends on how your distribution packaged btop.

Quick Reference

Key or Command	Action
`btop`	Open the resource dashboard
`btop --help`	Show options supported by the installed version
`btop --version`	Show the installed version
`btop -p 1`	Start with preset 1
`btop -t`	Start in 16-color TTY mode
`btop --low-color`	Start in 256-color mode
`1` / `2` / `3` / `4`	Toggle the CPU, memory, network, or process box
Up / Down	Select a process
Enter	Open or close details for the selected process
Space	Expand or collapse the selected process in tree view
`f` or `/`	Edit the process filter
Delete	Clear the active process filter
Left / Right	Change the process sort column
`r`	Reverse the process sort order
`e`	Toggle process tree view
`c`	Toggle per-core process CPU percentages
`t` / `k` / `s`	Open SIGTERM, SIGKILL, or signal selection actions
`+` / `-`	Add or subtract 100 ms from the update timer
`F2` or `o`	Open options
`h`	Show the help window
Esc	Toggle the main menu
`q`	Quit `btop`

Troubleshooting

The interface renders as broken boxes or stray characters
btop needs a UTF-8 locale and a font with Braille, geometric shape, and box-drawing characters. Fix the locale or font first. The flag that bypasses locale detection was renamed in btop 1.4.2. Version 1.4.2 and newer accept btop --force-utf, while 1.4.1 and earlier, including the packages in Ubuntu 24.04 and Debian 13, accept btop --utf-force. Run btop --help to confirm which form your version accepts. TTY mode is another fallback for limited terminals:

Terminal
btop -t

No temperatures are shown
On Linux, btop reads sensor data through the kernel’s hwmon interface. Check whether the sensors command reports a CPU temperature, then select the correct sensor under Options > CPU if automatic detection chose the wrong one. If the kernel module for your hardware is missing, install lm-sensors and run sudo sensors-detect. Virtual machines usually do not expose hardware temperature sensors.

Colors look wrong or washed out
Try 256-color mode when the terminal does not render truecolor correctly:

Terminal
btop --low-color

For a basic console or a terminal with limited character support, use btop -t instead.

Sending a signal returns an insufficient permissions error
Your user can normally signal only its own processes. Exit and restart with sudo btop if you must manage a system process, then verify the process name and PID before confirming the signal.

Conclusion

btop combines CPU, memory, disk, network, and process monitoring in one interactive terminal view. Keep top as the widely available fallback, or use htop when you want a process-focused interface with fewer system-wide graphs.

How to Open a Port in the Firewall on Linux

hello@linuxize.com (Linuxize) — Wed, 02 Sep 2026 09:35:00 +0200

When a service works locally but cannot be reached from another machine, the host firewall is one of the first places to check. Opening the port tells the firewall to accept matching traffic, but it does not start the service or change the address on which it listens.

This guide shows how to open a port with ufw, firewalld, nftables, and legacy iptables rules, make the change persistent, and test the connection from another host.

Quick Reference

For a printable quick reference, see the ufw cheatsheet , firewalld cheatsheet , and iptables cheatsheet .

Task	Command
Check ufw	`sudo ufw status`
Check firewalld	`sudo firewall-cmd --state`
Find the active firewalld zone	`sudo firewall-cmd --get-active-zones`
Open TCP port 80 with ufw	`sudo ufw allow 80/tcp`
Open TCP port 80 with firewalld	`sudo firewall-cmd --zone=public --add-port=80/tcp`
Add a permanent firewalld rule	`sudo firewall-cmd --permanent --zone=public --add-port=80/tcp`
Inspect nftables rules	`sudo nft -a list ruleset`
Open TCP port 80 with iptables	`sudo iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT`
Check the local listener	`sudo ss -ltnp 'sport = :80'`
Test from another host	`nc -zv server.example.com 80`

The firewalld example uses the public zone. Replace it with the zone attached to your incoming network interface. Raw nftables rules use administrator-defined table and chain names, so inspect the ruleset before changing it.

Check Whether the Service Is Listening

Before changing the firewall, confirm that the service is listening on the expected TCP port. This example checks port 80:

Terminal
sudo ss -ltnp 'sport = :80'

If the command returns no output, nothing is listening on that port. Start or reconfigure the service before changing the firewall. If the local address is 127.0.0.1:80 or [::1]:80, the service accepts only local connections. Configure it to listen on the server’s network address, such as 0.0.0.0:80 or [::]:80, when remote access is required.

For a UDP service, replace -ltnp with -lunp. The ss command guide covers socket filters and listener output in more detail.

Identify the Active Firewall

Use the firewall manager that is already active on the system. Do not add raw nftables or iptables rules alongside ufw or firewalld, because the manager may replace or reorder them during a reload.

On Ubuntu and systems configured with ufw, check its status:

Terminal
sudo ufw status

Use the ufw section when the output begins with Status: active. An inactive ufw configuration is not enforcing its saved rules.

On Fedora, RHEL, and derivatives, check firewalld:

Terminal
sudo firewall-cmd --state

If the command prints running, use the firewalld section. When neither manager is active, check whether the system loads a raw nftables configuration:

Terminal
sudo systemctl is-active nftables

An active result means the nftables service is running. If all three checks are inactive or unavailable, the machine may not have an active host firewall. A cloud firewall, security group, or router can still block incoming traffic before it reaches the server.

Opening a Port with ufw

Ubuntu uses ufw as its default firewall configuration tool, and it is also available on Debian. To allow TCP traffic on port 80, run:

Terminal
sudo ufw allow 80/tcp

The rule takes effect immediately when ufw is active and remains in place after a reboot. Replace tcp with udp when the application uses UDP.

You can also use a service name from /etc/services. The following rule opens the standard HTTP port:

Terminal
sudo ufw allow http

Do not expose a database or an administration port to every source unless the service is meant to be public. To allow one address to reach PostgreSQL on port 5432, use:

Terminal
sudo ufw allow proto tcp from 203.0.113.10 to any port 5432

Replace 203.0.113.10 with the client address. You can also provide a CIDR range, such as 192.168.1.0/24, when a trusted network needs access.

For a TCP port range, separate the first and last ports with a colon:

Terminal
sudo ufw allow 6000:6007/tcp

List the rules with their numbers to confirm the change:

Terminal
sudo ufw status numbered

output

Status: active
To Action From
-- ------ ----
[ 1] 80/tcp ALLOW IN Anywhere
[ 2] 80/tcp (v6) ALLOW IN Anywhere (v6)

The two entries allow port 80 over IPv4 and IPv6. For more examples, including deleting a rule, see the ufw command guide .

Warning

If you are enabling ufw over SSH, allow the SSH service or its custom port first. Otherwise, sudo ufw enable can block the connection and leave you dependent on console access.

Opening a Port with firewalld

firewalld organizes rules into zones, and each network interface or source is assigned to a zone. Find the zone that receives the incoming connection before adding the rule:

Terminal
sudo firewall-cmd --get-active-zones

output

public
interfaces: enp1s0

This server uses the public zone for traffic arriving on enp1s0. Open TCP port 80 in the runtime configuration so the change takes effect immediately:

Terminal
sudo firewall-cmd --zone=public --add-port=80/tcp

Add the same rule to the permanent configuration so it survives a reload or reboot:

Terminal
sudo firewall-cmd --permanent --zone=public --add-port=80/tcp

Running both commands avoids reloading the entire firewall and does not disturb unrelated runtime-only rules. If your interface belongs to another zone, replace public in both commands.

For standard services, a named service is easier to read than a port number. These commands allow HTTP immediately and permanently:

Terminal
sudo firewall-cmd --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=http

A port range works the same way, except that firewalld separates the two ports with a hyphen rather than the colon ufw expects. These commands open TCP ports 6000 through 6007:

Terminal
sudo firewall-cmd --zone=public --add-port=6000-6007/tcp
sudo firewall-cmd --permanent --zone=public --add-port=6000-6007/tcp

Query the active zone to confirm that the port rule is present:

Terminal
sudo firewall-cmd --zone=public --query-port=80/tcp

output

yes

When you add http as a named service, verify it with sudo firewall-cmd --zone=public --query-service=http instead.

Opening a Port with nftables

Use raw nft commands only when nftables itself manages the firewall. ufw and firewalld can also use nftables as a backend, but their rules should still be changed through ufw or firewall-cmd.

Unlike iptables, nftables does not create standard table and chain names. Display the current ruleset, including rule handles, before adding anything:

Terminal
sudo nft -a list ruleset

The following example assumes the ruleset contains an inet table named filter and an input chain named input. It inserts an allow rule at the beginning of that chain so an existing catch-all drop rule cannot match first:

Terminal
sudo nft insert rule inet filter input tcp dport 80 accept

Substitute the family, table, and chain names shown on your system. The command changes the running ruleset immediately, but it does not update the configuration loaded during boot.

On Debian, persistent nftables rules are normally stored in /etc/nftables.conf. Add the equivalent rule inside the existing input chain, before its final drop or reject rule:

/etc/nftables.conftxt
tcp dport 80 accept

Validate the complete file before loading it:

Terminal
sudo nft --check --file /etc/nftables.conf

If the check produces no error, apply the file and enable the service at boot:

Terminal
sudo nft --file /etc/nftables.conf
sudo systemctl enable nftables

Some systems split the rules across files included from /etc/nftables.conf. In that case, edit the file that defines the input chain rather than adding a second copy of the chain.

Opening a Port with iptables

iptables is the legacy interface and is often a compatibility front end for nftables on current distributions. Prefer ufw, firewalld, or native nftables for a new firewall, but use iptables syntax when maintaining an existing iptables ruleset.

Insert an IPv4 rule at the top of the INPUT chain to allow TCP port 80:

Terminal
sudo iptables -I INPUT 1 -p tcp --dport 80 -j ACCEPT

Using -I INPUT 1 places the rule before a later rule that drops unmatched traffic. List the chain with rule numbers to verify its position:

Terminal
sudo iptables -L INPUT -n --line-numbers

The running rule disappears after a reboot unless the system restores it. On Ubuntu and Debian, install the persistence package and save the current ruleset:

Terminal
sudo apt install iptables-persistent
sudo netfilter-persistent save

The iptables command affects IPv4 only. If the service also accepts IPv6 connections, add the equivalent rule with ip6tables and save again:

Terminal
sudo ip6tables -I INPUT 1 -p tcp --dport 80 -j ACCEPT
sudo netfilter-persistent save

See the iptables command guide when you need to inspect, remove, or reorder existing rules.

Verifying the Port Is Reachable

After applying the firewall rule, check the local listener again:

Terminal
sudo ss -ltnp 'sport = :80'

Then test from another machine that should be allowed through the firewall. Replace the hostname and port with your server details:

Terminal
nc -zv server.example.com 80

A successful connection confirms that the service is listening and the network path permits the traffic. A timeout usually points to a firewall, routing, or upstream network filter. Connection refused usually means the host is reachable but nothing accepts the connection on that address and port.

For additional remote tests with nmap, netcat, and Bash, see how to check open ports in Linux .

Troubleshooting

The firewall rule exists, but the port is still unreachable
Run sudo ss -ltnp 'sport = :80' and inspect the local address. A service bound only to 127.0.0.1 or ::1 cannot accept remote connections.

The ufw rule does not filter any traffic
Check sudo ufw status. Rules are saved while ufw is inactive, but they are not enforced until you enable the firewall.

The firewalld rule is in the wrong zone
Compare sudo firewall-cmd --get-active-zones with the zone used in the command. Add the rule to the zone attached to the incoming interface or source.

The rule uses the wrong protocol
TCP and UDP rules are separate. Check the application’s documentation or use ss -ltnp for TCP and ss -lunp for UDP before adding the rule.

A cloud server still blocks the port
Cloud security groups and provider firewalls operate outside the Linux host. Allow the same port and source in the provider control panel. A server behind a router may also need a port-forwarding rule before internet clients can reach it.

Conclusion

Open only the port, protocol, and source range the service needs. Check both the local listener and a remote connection after every change, and remove temporary rules when the service no longer requires them.

PHP Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 01 Sep 2026 10:55:00 +0200

Basic Syntax

Every PHP file starts with an opening tag. Closing tags are omitted in pure PHP files to avoid stray output.

Syntax	Description
`<?php ... ?>`	Standard PHP tags
`<?= $name ?>`	Short echo tag (always available)
`declare(strict_types=1);`	Use strict scalar checks for calls and returns in this file
`// comment`, `# comment`	Single-line comment
`/* comment */`	Multi-line comment
`echo "text";`	Output one or more strings
`print_r($var)`	Human-readable dump of an array or object
`var_dump($var)`	Dump value with type and length
`require 'file.php'`	Include file, fatal error if missing
`include 'file.php'`	Include file, warning if missing
`require_once 'file.php'`	Include only once

Variables and Types

PHP variables start with $ and are dynamically typed. Type declarations are optional but recommended.

Syntax	Description
`$name = "Alice";`	Assign a value
`int`, `float`, `bool`, `string`	Scalar types
`array`, `object`, `callable`, `iterable`	Compound types
`null`	Absence of a value
`const MAX = 10;`	Compile-time constant
`define('MAX', 10);`	Runtime constant
`gettype($x)`	Return the type name
`is_int($x)`, `is_string($x)`, `is_array($x)`	Type checks
`(int) $x`, `(string) $x`, `(bool) $x`	Explicit casts
`intval($x)`, `floatval($x)`	Convert to int or float
`isset($x)`	`true` if set and not `null`
`empty($x)`	`true` when unset or equal to `""`, `"0"`, `0`, `0.0`, `[]`, `null`, or `false`
`unset($x)`	Destroy a variable
`?int $x`	Nullable type (int or null)
`int\|string $x`	Union type

Operators

Arithmetic, comparison, logical, and null-handling operators.

Operator	Description
`+`, `-`, `*`, `/`, `%`	Arithmetic and modulo
`**`	Exponentiation
`.`	String concatenation
`.=`, `+=`, `-=`, `*=`	Compound assignment
`==`, `!=`	Loose comparison (type juggling)
`===`, `!==`	Strict comparison (value and type)
`<`, `>`, `<=`, `>=`	Relational comparison
`<=>`	Spaceship, returns -1, 0, or 1
`&&`, `\|\|`, `!`	Logical AND, OR, NOT
`and`, `or`, `xor`	Low-precedence logical operators
`? :`	Ternary conditional
`?:`	Elvis, returns left side if truthy
`??`	Null coalescing, returns right side if left is null
`??=`	Null coalescing assignment
`?->`	Nullsafe method or property access
`\|>`	Pipe operator, PHP 8.5 and later

Strings

Double-quoted strings interpolate variables; single-quoted strings do not.

Function	Description
`strlen($s)`	String length in bytes
`mb_strlen($s)`	Character length (requires the mbstring extension)
`strtolower($s)` / `strtoupper($s)`	Change case
`ucfirst($s)` / `ucwords($s)`	Capitalize first letter / each word
`trim($s)`, `ltrim($s)`, `rtrim($s)`	Strip whitespace
`str_contains($s, "x")`	`true` if substring is present
`str_starts_with($s, "x")`	`true` if string starts with prefix
`str_ends_with($s, "x")`	`true` if string ends with suffix
`strpos($s, "x")`	First index of substring, `false` if absent
`substr($s, 0, 5)`	Extract part of a string
`str_replace("a", "b", $s)`	Replace all occurrences
`explode(",", $s)`	Split into an array
`implode(", ", $arr)`	Join array elements
`sprintf("%s has %d", $a, $b)`	Format into a string
`number_format(1234.5, 2)`	Format a number with separators
`str_pad($s, 10, "0", STR_PAD_LEFT)`	Pad to a fixed width
`str_repeat($s, 3)`	Repeat a string
`htmlspecialchars($s)`	Escape HTML before output
`nl2br($s)`	Convert newlines to `<br>`
`"Hello $name"` / `"Sum: {$a['b']}"`	Interpolation, braces for complex expressions
`<<<EOT ... EOT;`	Heredoc (interpolates) and nowdoc `<<<'EOT'` (does not)

Arrays

PHP arrays are ordered maps and cover both lists and dictionaries.

Syntax	Description
`$a = [1, 2, 3];`	Indexed array
`$a = ["k" => "v"];`	Associative array
`$a[] = 4;`	Append an element
`$a["k"]`	Access by key
`$a[0][1]`	Nested access
`count($a)`	Number of elements
`array_key_exists("k", $a)`	`true` if the key exists, even when null
`in_array(4, $a)`	`true` if the value exists
`array_search(4, $a)`	Return the key of a value
`[$x, $y] = $a;`	Destructuring assignment
`["k" => $v] = $a;`	Destructure by key
`[...$a, ...$b]`	Spread into a new array
`foreach ($a as $k => $v)`	Iterate keys and values

Array Functions

Transform, filter, and sort arrays without writing loops.

Function	Description
`array_push($a, $v)` / `array_pop($a)`	Add or remove at the end
`array_unshift($a, $v)` / `array_shift($a)`	Add or remove at the start
`array_merge($a, $b)`	Merge arrays, reindex numeric keys
`array_keys($a)` / `array_values($a)`	Extract keys or values
`array_slice($a, 1, 3)`	Extract a portion
`array_splice($a, 1, 2)`	Remove or replace a portion in place
`array_map(fn($x) => $x * 2, $a)`	Apply a callback to each element
`array_filter($a, fn($x) => $x > 2)`	Keep elements passing a test
`array_reduce($a, fn($c, $x) => $c + $x, 0)`	Reduce to a single value
`array_column($rows, "name", "id")`	Pull one column, optionally keyed
`array_unique($a)`	Remove duplicate values
`array_combine($keys, $vals)`	Build an array from two arrays
`array_flip($a)`	Swap keys and values
`array_sum($a)` / `array_product($a)`	Sum or product of values
`min($a)` / `max($a)`	Smallest or largest value
`range(1, 10)`	Build a sequence
`sort($a)` / `rsort($a)`	Sort values ascending / descending
`asort($a)` / `ksort($a)`	Sort by value / key, keep keys
`usort($a, fn($x, $y) => $x <=> $y)`	Sort with a custom comparator
`array_find($a, $fn)`, `array_any($a, $fn)`, `array_all($a, $fn)`	Search and test, PHP 8.4 and later
`array_first($a)` / `array_last($a)`	First or last value, PHP 8.5 and later

Control Flow

Conditionals and loops. The alternative syntax with endif and endforeach reads better inside HTML templates.

Syntax	Description
`if (...) { } elseif (...) { } else { }`	Standard branching
`if (...): ... endif;`	Alternative syntax for templates
`switch ($x) { case 1: ...; break; default: ...; }`	Multi-branch on loose comparison
`match($x) { 1 => "a", default => "b" }`	Strict comparison, returns a value
`for ($i = 0; $i < 10; $i++)`	Counter loop
`foreach ($arr as $value)`	Iterate values
`foreach ($arr as $key => $value)`	Iterate keys and values
`foreach ($arr as &$value)`	Iterate by reference (unset after)
`while (cond)` / `do { } while (cond);`	Conditional loops
`break;` / `break 2;`	Exit the loop, or two levels of loops
`continue;`	Skip to the next iteration
`return $x;`	Return from a function

Functions

Functions support default values, type declarations, named arguments, and variadics.

Syntax	Description
`function name($a, $b) { }`	Function declaration
`function name(int $a): string { }`	Typed parameters and return type
`function name($a = 10) { }`	Default parameter value
`function name(...$args) { }`	Variadic parameters
`name(b: 2, a: 1)`	Named arguments
`function name(&$a) { }`	Pass by reference
`function (): void { }`	No return value
`fn($x) => $x * 2`	Arrow function, captures scope automatically
`function ($x) use ($y) { }`	Closure with an explicit captured variable
`$fn = strlen(...);`	First-class callable syntax
`call_user_func($fn, $arg)`	Call a callable dynamically
`function gen() { yield $x; }`	Generator function
`static function () { }`	Closure without `$this` binding

Classes and Objects

PHP 8 adds constructor promotion, enums, readonly properties, and property hooks.

Syntax	Description
`class User { }`	Class declaration
`new User()`	Instantiate
`public`, `protected`, `private`	Visibility modifiers
`public function __construct(private string $name) { }`	Constructor property promotion
`public readonly int $id;`	Write once, then immutable
`private(set) string $name;`	Asymmetric visibility, PHP 8.4 and later
`public string $full { get => "$this->a $this->b"; }`	Property hook, PHP 8.4 and later
`$this->name`	Access a property on the instance
`self::CONST`, `static::method()`	Class and late static binding access
`parent::__construct()`	Call the parent constructor
`class Admin extends User { }`	Inheritance
`interface Jsonable { }` / `implements Jsonable`	Interfaces
`abstract class Base { }`	Abstract class
`trait Loggable { }` / `use Loggable;`	Trait reuse
`enum Status: string { case Active = 'active'; }`	Backed enum
`Status::from('active')`, `Status::tryFrom($x)`	Enum lookup, `tryFrom` returns null
`$obj instanceof User`	Type check
`User::class`	Fully qualified class name as a string
`__get`, `__set`, `__call`, `__toString`	Magic methods
`namespace App\Models;` / `use App\Models\User;`	Namespaces and imports

Superglobals and Request Data

Superglobals are available in every scope. Treat all of them as untrusted input.

Variable	Description
`$_GET`	Query string parameters
`$_POST`	Form body parameters
`$_REQUEST`	Merge of GET, POST, and cookies
`$_SERVER`	Request and server metadata
`$_SERVER['REQUEST_METHOD']`	HTTP method
`$_SERVER['REMOTE_ADDR']`	Client IP address
`$_FILES`	Uploaded file metadata
`$_COOKIE`	Cookies sent by the client
`$_SESSION`	Session data, after `session_start()`
`$_ENV`, `getenv('NAME')`	Environment variables
`filter_input(INPUT_GET, 'id', FILTER_VALIDATE_INT)`	Read and validate in one call
`filter_var($email, FILTER_VALIDATE_EMAIL)`	Validate a value
`htmlspecialchars($v, ENT_QUOTES)`	Escape before printing to HTML
`header('Location: /home'); exit;`	Redirect and stop further execution
`http_response_code(404)`	Set the response status
`password_hash($p, PASSWORD_DEFAULT)`	Hash a password
`password_verify($p, $hash)`	Verify a password against a hash

Files and JSON

File helpers for small payloads, plus JSON encoding and decoding.

Function	Description
`file_get_contents($path)`	Read a whole file into a string
`file_put_contents($path, $data)`	Write a string to a file
`file($path, FILE_IGNORE_NEW_LINES)`	Read a file into an array of lines
`fopen($path, 'r')`, `fgets($fh)`, `fclose($fh)`	Streamed reads for large files
`fwrite($fh, $data)`	Write to an open handle
`file_exists($p)`, `is_file($p)`, `is_dir($p)`	Existence and type checks
`is_readable($p)`, `is_writable($p)`	Permission checks
`unlink($p)`, `rename($a, $b)`, `copy($a, $b)`	Delete, move, copy
`mkdir($p, 0755, true)` / `rmdir($p)`	Create or remove directories
`scandir($p)` / `glob("*.log")`	List directory entries or match a pattern
`dirname($p)`, `basename($p)`, `pathinfo($p)`	Split a path
`__DIR__`, `__FILE__`	Directory and path of the current file
`realpath($p)`, `filesize($p)`, `filemtime($p)`	Resolve path, size, modification time
`json_encode($data, JSON_PRETTY_PRINT)`	Encode to JSON
`json_decode($s, true)`	Decode to an associative array
`json_encode($d, JSON_THROW_ON_ERROR)`	Throw `JsonException` on failure
`json_validate($s)`	Check validity without decoding, PHP 8.3 and later

Dates and Times

DateTimeImmutable is the safer default because arithmetic returns a new object instead of mutating the original.

Syntax	Description
`time()`	Current Unix timestamp
`date('Y-m-d H:i:s')`	Format the current time
`date('Y-m-d', $ts)`	Format a given timestamp
`strtotime('+1 day')`	Parse a relative or absolute string
`mktime($h, $m, $s, $mo, $d, $y)`	Build a timestamp from parts
`new DateTimeImmutable('2026-09-01')`	Create an immutable date object
`$d->format('D, d M Y')`	Format a date object
`$d->modify('+2 weeks')`	Return a shifted copy
`$d->add(new DateInterval('P1M'))`	Add an interval
`$a->diff($b)->days`	Difference in days
`new DateTimeZone('Europe/Berlin')`	Time zone object
`date_default_timezone_set('UTC')`	Set the script time zone
`checkdate($m, $d, $y)`	Validate a calendar date
`Y m d H i s`, `D M`, `N`, `U`	Common format characters

Errors and Exceptions

Error covers engine failures and Exception covers application failures; both implement Throwable.

Syntax	Description
`try { } catch (Exception $e) { } finally { }`	Handle and clean up
`catch (TypeError \| ValueError $e)`	Catch multiple types
`catch (Exception)`	Catch without capturing the object
`throw new RuntimeException("msg", 500);`	Throw an exception
`$e->getMessage()`, `$e->getCode()`	Read the message and code
`$e->getFile()`, `$e->getLine()`	Where the exception was thrown
`$e->getTraceAsString()`	Stack trace as text
`$e->getPrevious()`	Chained exception
`class MyException extends Exception { }`	Custom exception
`error_reporting(E_ALL)`	Report every error level
`ini_set('display_errors', '1')`	Show errors, development only
`ini_set('log_errors', '1')`	Write errors to the log
`set_error_handler($fn)`	Register a user-defined error handler
`set_exception_handler($fn)`	Catch uncaught exceptions
`trigger_error("msg", E_USER_WARNING)`	Raise a user-level error
`@$value`	Error suppression operator, avoid it

Regular Expressions

PHP uses PCRE. Patterns need delimiters, usually / or #.

Function	Description
`preg_match('/^a/', $s, $m)`	Match once, fill `$m` with captures
`preg_match_all('/\d+/', $s, $m)`	Match every occurrence
`preg_replace('/\s+/', ' ', $s)`	Replace matches
`preg_replace_callback('/\d/', $fn, $s)`	Replace using a callback
`preg_split('/[\s,]+/', $s)`	Split on a pattern
`preg_quote($s, '/')`	Escape user input used in a pattern
`preg_grep('/^a/', $arr)`	Filter array entries by pattern
`/pattern/i`	Case-insensitive
`/pattern/m`	Multiline, `^` and `$` match each line
`/pattern/s`	Dot matches newlines
`/pattern/u`	Treat pattern and subject as UTF-8
`(?<name>...)`	Named capture group, read as `$m['name']`

PHP CLI

The php binary runs scripts, checks syntax, and starts a development server without a web server in front of it.

Command	Description
`php script.php`	Run a script
`php -v`	Show the PHP version
`php -m`	List compiled and loaded modules
`php -i`	Print the full `phpinfo()` output
`php --ini`	Show which `php.ini` files are loaded
`php -l script.php`	Syntax check without executing
`php -r 'echo PHP_VERSION;'`	Run inline code
`php -a`	Interactive shell
`php -S localhost:8000`	Built-in development server
`php -S localhost:8000 -t public`	Serve a specific document root
`php -d memory_limit=512M script.php`	Override an `ini` setting for one run
`php -c /path/to/php.ini script.php`	Use a specific config file
`php --rf str_replace`	Reflect on a function signature
`php --rc DateTimeImmutable`	Reflect on a class
`php --re json`	Reflect on an extension
`php -n script.php`	Run without loading any `php.ini`

Configuration and Extensions

Configuration paths depend on the SAPI and distribution. Use php --ini for the CLI or phpinfo() through the web server to confirm which files are active.

Path or command	Description
`php --ini`	Locate the CLI configuration files
`/etc/php/<version>/cli/php.ini`	CLI config on Debian and Ubuntu
`/etc/php/<version>/fpm/php.ini`	PHP-FPM config on Debian and Ubuntu
`/etc/php/<version>/apache2/php.ini`	Apache module config on Debian and Ubuntu
`/etc/php.ini`, `/etc/php.d/`	Main config and snippets on Fedora and RHEL
`/etc/php/<version>/mods-available/`	Extension snippets on Debian and Ubuntu
`memory_limit`, `max_execution_time`	Per-script resource limits
`upload_max_filesize`, `post_max_size`	Upload limits, raise both together
`display_errors`, `error_log`	Error output and log destination
`date.timezone`	Default time zone
`opcache.enable`, `opcache.memory_consumption`	Bytecode cache settings
`sudo apt install php-gd php-curl php-mbstring`	Install default-version extensions on Ubuntu or Debian
`sudo dnf install php-gd php-curl php-mbstring`	Install extensions on Fedora or RHEL
`php -m \| grep -E 'curl\|gd\|mbstring'`	Confirm extensions are loaded
`sudo phpenmod curl` / `sudo phpdismod curl`	Enable or disable an extension on Debian or Ubuntu
`sudo update-alternatives --config php`	Select an installed CLI version on Debian or Ubuntu

PHP-FPM

PHP-FPM is the process manager that Nginx and Apache hand PHP requests to. The versioned examples below use PHP 8.5 on Ubuntu 26.04; Debian 13 uses 8.4, while Fedora and RHEL use unversioned php-fpm names. Reload or restart FPM after config or extension changes.

Command or directive	Description
`sudo systemctl status php8.5-fpm`	Check the Ubuntu 26.04 service state
`sudo systemctl status php-fpm`	Check the Fedora or RHEL service state
`sudo systemctl restart php8.5-fpm`	Restart the versioned service
`sudo systemctl reload php8.5-fpm`	Gracefully reload FPM workers
`sudo php-fpm8.5 -t`	Test Ubuntu 26.04 configuration before reloading
`/etc/php/8.5/fpm/pool.d/www.conf`	Ubuntu 26.04 default pool configuration
`listen = /run/php/php8.5-fpm.sock`	Unix socket the web server connects to
`user` / `group`	System account the workers run as
`pm = dynamic`	Process manager mode: `static`, `dynamic`, or `ondemand`
`pm.max_children`	Hard cap on worker processes
`pm.start_servers`, `pm.min_spare_servers`	Warm pool sizing for `dynamic`
`pm.max_requests`	Recycle a worker after N requests
`php_admin_value[memory_limit] = 256M`	Override an `ini` value per pool
`slowlog`, `request_slowlog_timeout`	Log requests that run too long
`sudo journalctl -u php8.5-fpm -f`	Follow the versioned service log

Composer

Composer manages dependencies and the autoloader for almost every modern PHP project.

Command	Description
`composer init`	Create a `composer.json` interactively
`composer require vendor/package`	Add a dependency
`composer require --dev phpunit/phpunit`	Add a development dependency
`composer install`	Install from `composer.lock`
`composer update`	Update dependencies and the lock file
`composer update vendor/package`	Update a single package
`composer remove vendor/package`	Remove a dependency
`composer install --no-dev --optimize-autoloader`	Production install
`composer dump-autoload -o`	Regenerate an optimized autoloader
`composer show` / `composer show -t`	List packages, or show the dependency tree
`composer outdated`	List packages with newer versions
`composer why vendor/package`	Explain why a package is installed
`composer audit`	Check dependencies for known vulnerabilities
`composer create-project vendor/skeleton app`	Start a project from a skeleton
`require 'vendor/autoload.php';`	Load the autoloader in your entry script

Use these guides to install PHP, check the running version, and debug errors on a server.

Guide	Description
How to Install PHP on Ubuntu 26.04	Install PHP 8.5 with Apache or Nginx and PHP-FPM
How to Check the PHP Version	Find the CLI and web server PHP versions
PHP Error Reporting	Show, log, and control PHP errors
How to Install a LAMP Stack on Ubuntu 26.04	Apache, MySQL, and PHP on one server
MySQL and MariaDB Cheatsheet	Database commands for the data layer behind PHP

What Is .bashrc? When It Runs and What to Put in It

hello@linuxize.com (Linuxize) — Mon, 31 Aug 2026 14:35:00 +0200

You define an alias in your terminal, use it happily for an hour, then open a new tab and it is gone. Shell settings typed at the prompt live only as long as that shell does. To make them permanent, they have to go in a file that Bash reads every time it starts a new session. On most Linux systems that file is ~/.bashrc.

This guide covers where .bashrc lives, when Bash reads it, what belongs inside it, and how to apply your changes without opening a new terminal.

What .bashrc Does

.bashrc is a per-user Bash startup script, not a generic Linux configuration file. When Bash loads it, each command runs in the current shell. That is why aliases, functions, prompt settings, and shell options become part of the session without a separate import step. Other shells use their own files, such as ~/.zshrc for zsh.

The rc suffix comes from RUNCOM, an early CTSS program that executed commands stored in a file. The name survives in Unix configuration files such as .vimrc, .screenrc, and .inputrc.

Where the .bashrc File Is Located

.bashrc sits in your home directory. The leading dot makes it a hidden file, so a plain ls will not show it:

Terminal
ls -la ~/.bashrc

output

-rw-r--r-- 1 dejan dejan 3771 Aug 14 09:12 /home/dejan/.bashrc

Every user account has its own copy, and editing yours has no effect on anyone else on the system. The file is plain text, so any editor works:

Terminal
nano ~/.bashrc

If the file does not exist, nothing is broken. Bash simply skips it. Most distributions ship a template in /etc/skel/ that is copied into each new home directory, so you can restore the default version with:

Terminal
cp /etc/skel/.bashrc ~/.bashrc

You can also create the file from scratch and start with an empty one.

When Bash Reads .bashrc

Bash reads ~/.bashrc when it starts an interactive shell that is not a login shell. In everyday terms, that means opening a new terminal window or tab in your desktop environment, or typing bash inside a shell you already have open.

Two common cases do not fit that description. Logging in over SSH or at a console starts a login shell. Bash reads /etc/profile, then the first readable file it finds from ~/.bash_profile, ~/.bash_login, and ~/.profile. Running a local script starts a non-interactive shell, which normally reads none of those files. If BASH_ENV is set, Bash reads the file named by that variable before running the script.

Because most people want the same interactive settings in both login and non-login shells, the usual arrangement is to keep those settings in ~/.bashrc and have the login file source it. For the full startup order and the reasoning behind that setup, see .bashrc vs .bash_profile .

The Guard at the Top of the File

Open the default ~/.bashrc on Debian or Ubuntu and the first real line is this:

~/.bashrcsh
# If not running interactively, don't do anything
case $- in
 *i*) ;;
 *) return;;
esac

The $- variable holds the current shell option flags, and it contains i only in an interactive shell. If the i flag is missing, return stops reading the file right there.

That guard exists because of one specific Bash behavior: when Bash detects that its standard input is connected to a network connection, as happens with ssh user@host 'command', it reads ~/.bashrc even though the shell is not interactive. Without the guard, everything below it could run during remote commands and file transfers that start Bash on the server.

Keep the guard where it is, and add interactive settings below it. A setting required by a non-interactive remote command is an exception, but anything placed above the guard must stay silent.

What to Put in .bashrc

Anything that shapes how an interactive shell behaves belongs here. The most common additions follow.

Aliases

Aliases are short names for longer commands:

~/.bashrcsh
alias ll='ls -alF'
alias gs='git status'
alias ..='cd ..'

Functions

When a shortcut needs arguments or more than one command, use a function instead of an alias:

~/.bashrcsh
mkcd () {
 mkdir -p "$1" && cd "$1"
}

Running mkcd projects/api now creates the directory and moves into it.

Interactive PATH Additions

To make Bash find executables in a directory of your own at the interactive prompt, add it to $PATH :

~/.bashrcsh
export PATH="$HOME/.local/bin:$PATH"

Putting $PATH at the end preserves the existing directories. Placing your directory first means your version of a command wins over a system one with the same name.

This change applies to shells that read .bashrc. If the path must also reach GUI programs or other shells, set it in ~/.profile or ~/.bash_profile instead.

Environment Variables

Environment variables needed by programs you start from interactive Bash can go here. Export them so child processes inherit their values:

~/.bashrcsh
export EDITOR=nano
export LESS='-R'

For variables that must exist across the entire login session, including applications not launched from a terminal, use a login or desktop environment file instead.

Do not put API keys, tokens, or passwords in .bashrc. The file often ends up in a dotfiles repository. Keep secrets in a separate file that is excluded from version control and protected with chmod 600, or use a dedicated secret manager.

The Shell Prompt

PS1 defines the prompt string. The following example shows the username, host, and current directory in color:

~/.bashrcsh
PS1='\[\e[32m\]\u@\h\[\e[0m\]:\[\e[34m\]\w\[\e[0m\]\$ '

The \[ and \] markers tell Bash that the enclosed escape sequences take up no screen width. Leaving them out makes long command lines wrap incorrectly.

Shell Options

shopt toggles Bash behaviors that are off by default:

~/.bashrcsh
shopt -s autocd # type a directory name to cd into it
shopt -s cdspell # fix minor typos in cd arguments
shopt -s globstar # ** matches files across subdirectories
shopt -s histappend # append to the history file instead of overwriting

History settings such as HISTSIZE and HISTCONTROL also live in this file. See the history command guide for working with the entries themselves.

Apply Changes Without Restarting the Terminal

Bash reads ~/.bashrc at startup, so an edit has no effect on shells that are already running. Before loading an edited file, check its syntax:

Terminal
bash -n ~/.bashrc

No output means Bash found no syntax errors. You can then source the file instead of closing the terminal:

Terminal
source ~/.bashrc

The dot command is the POSIX spelling of source and does the same thing in Bash:

Terminal
. ~/.bashrc

Either command runs the file in your current shell, so aliases, functions, and variables become available immediately. Sourcing does not undo anything: if you deleted an alias from the file, it stays defined in the current session until you run unalias or open a new terminal.

Split .bashrc Into Separate Files

A .bashrc that has grown past a couple of hundred lines is easier to manage in pieces. Debian and Ubuntu already use this pattern for aliases, and their default file includes:

~/.bashrcsh
if [ -f ~/.bash_aliases ]; then
 . ~/.bash_aliases
fi

For a more general split, create a directory for the extra files:

Terminal
mkdir -p ~/.bashrc.d

Then add a loop to ~/.bashrc that sources every readable shell file in the directory:

~/.bashrcsh
if [ -d ~/.bashrc.d ]; then
 for rc in ~/.bashrc.d/*.sh; do
 [ -r "$rc" ] && . "$rc"
 done
 unset rc
fi

Files are sourced in alphabetical order, so a 10-path.sh runs before a 20-aliases.sh. This keeps work-specific settings in one file that you can drop in or remove without editing .bashrc itself. A bash -n ~/.bashrc check does not read the sourced files, so check each of them separately after an edit.

Fedora and RHEL already source files from ~/.bashrc.d/ in their default configuration, so check your existing file before adding another loop.

What Not to Put in .bashrc

Commands that print output are the main thing to avoid. A neofetch call or an echo "Welcome back" line placed above the interactivity guard looks harmless in a terminal, but it also runs during scp, rsync, and ssh host 'command' sessions. The extra text can corrupt the protocol stream and make those tools fail. Keep printed output below the guard, or move a login banner to the login profile.

Long-running commands are worth avoiding too. Everything in .bashrc runs before you get a prompt, so a network call or a version-manager initialization that takes half a second adds that delay to every terminal you open.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Setting	Example	Purpose
Alias	`alias ll='ls -alF'`	Short name for a longer command
Function	`mkcd () { mkdir -p "$1" && cd "$1"; }`	Shortcut that takes arguments
Interactive PATH	`export PATH="$HOME/.local/bin:$PATH"`	Add an executable directory to interactive Bash
Environment variable	`export EDITOR=nano`	Setting inherited by programs launched from Bash
Prompt	`PS1='\u@\h:\w\$ '`	Format of the shell prompt
Shell option	`shopt -s autocd`	Toggle a Bash behavior
Source a file	`. ~/.bash_aliases`	Load settings from another file
Syntax check	`bash -n ~/.bashrc`	Check the file without running it
Reload	`source ~/.bashrc`	Apply edits to the current shell

Troubleshooting

Changes do not take effect
Bash reads ~/.bashrc only when a shell starts. Run bash -n ~/.bashrc, then source ~/.bashrc in the current terminal, or open a new one.

Settings work in a new terminal but not over SSH
ssh user@host opens a login shell, which reads the first available file from ~/.bash_profile, ~/.bash_login, and ~/.profile rather than ~/.bashrc. Debian and Ubuntu ship a ~/.profile that sources ~/.bashrc already, so the default setup works. On other systems, or after replacing the login file, add . ~/.bashrc to it so both shell types load the same interactive configuration.

scp or rsync fails after editing .bashrc
Something in the file may be printing output during the remote session. Move any echo, neofetch, or banner command below the interactivity guard, then test with ssh user@host 'true', which should print nothing at all.

A syntax error appears in every new terminal
Bash reports the offending line number. Open a shell that skips the file with bash --norc, fix the line, then run bash -n ~/.bashrc before reloading. A missing fi or an unclosed quote is the usual cause.

The file was deleted or emptied
Copy the distribution default back with cp /etc/skel/.bashrc ~/.bashrc and reload it.

A command is found in one terminal but not another
The two shells may read different startup files, or the $PATH addition may be below an early return or inside a conditional that does not match. Run echo "$PATH" in both shells to compare.

FAQ

Does .bashrc run when I execute a script?
Normally, no. A local script runs in a non-interactive shell, which does not read ~/.bashrc unless the script sources it or BASH_ENV points to it. Bash may also read .bashrc when a remote shell daemon starts a non-interactive command, but the interactivity guard usually stops the file immediately.

I use zsh. Where do these settings go?
Use ~/.zshrc, which serves the same role for zsh. Aliases, functions, and PATH changes carry over unchanged, but prompt escapes and some shopt options do not.

Should I put .bashrc in version control?
Yes, as long as it holds no secrets. A dotfiles repository makes it easy to set up a new machine. Keep tokens and passwords in a separate file that is listed in .gitignore and sourced from .bashrc.

Why is my .bashrc not read on macOS?
Terminal and iTerm2 normally open a login shell. If you configured them to use Bash, Bash reads the first available login file instead of ~/.bashrc. Current macOS releases use zsh by default, and its interactive configuration belongs in ~/.zshrc.

Conclusion

Treat ~/.bashrc as code that runs every time you open an interactive Bash shell. Keep it fast, keep secrets out of it, and check each edit with bash -n ~/.bashrc before loading the change.

Regex Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 28 Aug 2026 17:40:00 +0200

Metacharacters

Characters that mean something other than themselves.

Pattern	Description
`.`	Any single character except a newline
`*`	Zero or more of the item before it
`[...]`	Any one character from the set
`[^...]`	Any one character not in the set
`^`	Start of the line
`$`	End of the line
`\`	Escape a character or begin a special sequence, depending on the regex flavor

Most other characters match themselves. Line-based tools such as grep, sed, and awk read one line at a time, so . never matches the line ending.

Anchors and Word Boundaries

Tie a pattern to a position instead of a character.

Pattern	Description
`^error`	Line starts with `error`
`done$`	Line ends with `done`
`^exact$`	Match the whole line
`^$`	Match an empty line
`\<word`	Start of a word (GNU tools and Vim)
`word\>`	End of a word
`\bword\b`	Word boundary on both sides (GNU and PCRE)
`\B`	Any position that is not a word boundary

Anchors match a position of zero width, so they never consume a character. In awk, \b means a backspace rather than a word boundary; gawk provides \y instead.

Bracket Expressions

Match one character out of a set you define.

Pattern	Description
`[abc]`	One `a`, `b`, or `c`
`[^abc]`	Any character except `a`, `b`, or `c`
`[a-z]`	One lowercase letter
`[0-9a-fA-F]`	One hexadecimal digit
`[]abc]`	Include a literal `]` by putting it first
`[abc-]`	Include a literal `-` by putting it last
`[a^]`	`^` is literal when it is not first

Most metacharacters lose their meaning inside brackets, so [.*] matches a dot or an asterisk. Ranges follow the current locale, so use LC_ALL=C or a POSIX class when you need predictable results.

POSIX Character Classes

Portable, locale-aware sets that go inside a bracket expression.

Class	Matches
`[[:digit:]]`	Digits
`[[:alpha:]]`	Letters
`[[:alnum:]]`	Letters and digits
`[[:lower:]]` `[[:upper:]]`	Lowercase and uppercase letters
`[[:space:]]`	Whitespace, including tabs and newlines
`[[:blank:]]`	Spaces and tabs only
`[[:punct:]]`	Punctuation characters
`[[:xdigit:]]`	Hexadecimal digits
`[[:print:]]` `[[:graph:]]`	Printable, and printable except space
`[[:cntrl:]]`	Control characters

The double brackets are not a typo. The class itself is [:digit:], and the outer brackets are the bracket expression that holds it, so [[:digit:]_] matches a digit or an underscore.

Quantifiers

Say how many times the preceding item repeats.

Pattern	Description
`a*`	Zero or more `a`
`a\+` / `a+`	One or more, BRE and ERE forms
`a\?` / `a?`	Zero or one
`a\{3\}` / `a{3}`	Exactly three
`a{3,}`	Three or more
`a{,3}`	Up to three (GNU extension for `{0,3}`)
`a{2,4}`	Between two and four
`.*`	Any run of characters, including none

Quantifiers are greedy and take the longest match available. In a basic regular expression, a * at the very start of the pattern is a literal asterisk because there is nothing for it to repeat.

Groups, Alternation, and Backreferences

Treat several characters as one unit and reuse what they matched.

Pattern	Description
`(ab)+`	ERE group repeated one or more times
`$ab$\+`	The same group in BRE
`cat\|dog`	ERE alternation, either side matches
`cat\\|dog`	The same alternation in GNU BRE
`^(a\|b)c$`	Alternation limited to the group
`\1`	Whatever group 1 matched
`$.$\1`	Any character repeated twice

Groups are numbered from left to right by their opening parenthesis. Backreferences are part of POSIX BRE, and GNU grep and GNU sed also accept them in extended patterns. POSIX ERE and awk do not support backreferences. In a sed replacement, \1 inserts group 1 and & inserts the whole match.

Escaping Special Characters

Match a metacharacter as an ordinary character.

Pattern	Description
`\.`	A literal dot
`\\`	A literal backslash
`\*` `\[` `\^` `\$`	The literal symbol
`[.]`	A dot, escaped by a bracket expression instead
`grep -F 'a.b'`	Treat the whole pattern as a fixed string
`\Q...\E`	Quote a run of characters in PCRE

Quote patterns with single quotes so the shell passes the backslashes through untouched. Inside double quotes, the shell expands $ and consumes some backslashes before the tool ever sees the pattern.

Shorthand Classes

Short names for common sets, provided as extensions rather than by POSIX.

Pattern	Matches and Availability
`\w` `\W`	Word and non-word characters in GNU grep, GNU sed, gawk, PCRE, and Vim; the exact character set varies by engine and locale
`\s` `\S`	Whitespace and non-whitespace in GNU grep, GNU sed, gawk, PCRE, and Vim
`\d` `\D`	Digits and non-digits in PCRE and Vim; not defined by POSIX BRE or ERE
`\h` `\v`	Horizontal and vertical whitespace in PCRE; Vim assigns different meanings to both sequences

Do not use \d with grep’s basic or extended syntax. GNU grep documents an escaped ordinary character such as \d as unspecified, and other grep implementations may interpret it differently. Use [[:digit:]], [0-9], or grep -P instead.

PCRE Extras

Available with grep -P and other Perl-compatible engines.

Pattern	Description
`.*?` `+?` `??`	Lazy quantifiers that take the shortest match
`(?:...)`	Group without capturing it
`(?<name>...)`	Named capture group
`(?=...)`	Lookahead, text must follow
`(?!...)`	Negative lookahead
`(?<=...)`	Lookbehind, text must precede
`(?<!...)`	Negative lookbehind
`(?i)`	Case-insensitive from this point on
`\K`	Drop everything matched so far from the result

Lookarounds check their surroundings without adding them to the match, which pairs well with grep -oP. None of this works in sed or awk, and grep -P needs a build with PCRE support.

BRE, ERE, and PCRE

The same idea written three ways.

Feature	Syntax by Flavor
Grouping	BRE `$ab$`; ERE and PCRE `(ab)`
Alternation	GNU BRE `a\\|b`; ERE and PCRE `a\|b`
One or more	GNU BRE `a\+`; ERE and PCRE `a+`
Optional	GNU BRE `a\?`; ERE and PCRE `a?`
Interval	BRE `a\{2,4\}`; ERE and PCRE `a{2,4}`
Backreference	BRE and PCRE `\1`; GNU grep and GNU sed also accept `\1` in ERE, but POSIX ERE and awk do not
`\d` and lookaround	PCRE supports both; BRE and ERE do not
Default in	BRE: `grep`, `sed`; ERE: `grep -E`, `sed -E`, awk; PCRE: `grep -P`

In GNU grep, BRE and ERE provide the same pattern-matching functionality with different notation. The characters ?, +, (), {}, and | are special without backslashes in ERE and with backslashes in GNU BRE. This equivalence does not extend to POSIX ERE backreferences or PCRE-only features.

Regex in grep

Pick the flavor with a flag.

Command	Description
`grep 'pattern' file`	Basic regular expression, the default
`grep -E 'pattern' file`	Extended regular expression
`grep -P 'pattern' file`	Perl-compatible regular expression
`grep -F 'pattern' file`	No regex at all, fixed string
`grep -o 'pattern' file`	Print only the matched text
`grep -w 'pattern' file`	Require word boundaries around the match
`grep -i 'pattern' file`	Ignore case
`grep -v 'pattern' file`	Print the lines that do not match

Use -o while building a pattern to see exactly what it captures. GNU grep 3.8 and later print a warning for egrep and fgrep, so write grep -E and grep -F instead.

Regex in sed

Patterns select lines, and the same syntax drives substitutions.

Command	Description
`sed 's/old/new/' file`	Substitute using a basic regular expression
`sed -E 's/[0-9]+/N/g' file`	Extended syntax, with `-r` as a synonym
`sed -n '/error/p' file`	Print only matching lines
`sed '/^$/d' file`	Delete every empty line
`sed 's/$a$$b$/\2\1/' file`	Swap two captured groups
`sed 's/word/[&]/' file`	Wrap the whole match in brackets
`sed 's/error/ERROR/gI' file`	Replace every match, ignoring case
`sed -E 's/(\w+)/\U\1/' file`	Uppercase group 1 with a GNU escape

The delimiter does not have to be a slash. Writing sed 's|/usr/bin|/usr/local/bin|' avoids escaping every slash in a path.

Regex in awk

Patterns are extended regular expressions and sit between slashes.

Command	Description
`awk '/error/' file`	Print lines matching the pattern
`awk '$1 ~ /^web/' file`	Match a single field
`awk '$3 !~ /ok/' file`	Match fields that fail the pattern
`awk '/start/,/stop/' file`	Print an inclusive range of lines
`awk '{ gsub(/[0-9]+/, "N"); print }' file`	Replace every match on the line
`awk '{ sub(/^ +/, ""); print }' file`	Replace the first match only
`awk 'match($0, /[0-9]+/) { print substr($0, RSTART, RLENGTH) }' file`	Locate a match and extract it
`gawk '{ gsub(/\yroot\y/, "USER"); print }' file`	Word boundaries in gawk

Awk always uses extended syntax, so +, ?, and {n,m} work without a backslash. When the pattern is a string rather than a /.../ literal, every backslash needs doubling, so gsub(/\./, "-") becomes gsub("\\.", "-").

Regex in Vim

Vim uses its own flavor, close to ERE once you turn on very magic mode.

Pattern	Description
`/pattern`	Search forward in the file
`:%s/old/new/g`	Replace every match in the file
`a\+`	One or more, since `+` needs a backslash by default
`\v`	Very magic mode, so `+`, `?`, `(`, and `\|` work unescaped
`\v\d+`	Digits in very magic mode
`\<word\>`	Whole word match
`price: \zs\d\+`	Start the match after `\zs`, end it at `\ze`
`\cerror`	Ignore case for this pattern

Very magic mode is the shortcut worth remembering. Writing :%s/\v(\w+), (\w+)/\2 \1/g to swap two fields keeps a pattern readable instead of filling it with backslashes.

Regex in Bash

The =~ operator inside [[ ]] takes an extended regular expression.

Snippet	Description
`[[ $ip =~ ^[0-9.]+$ ]]`	Test a string against a pattern
`[[ ! $name =~ ^[a-z] ]]`	Negate the test
`re='^v([0-9]+)\.([0-9]+)$'`	Keep the pattern in a variable
`[[ $tag =~ $re ]]`	Use the variable unquoted so it stays a regex
`${BASH_REMATCH[0]}`	The whole match
`${BASH_REMATCH[1]}`	The first capture group
`case $file in *.txt) ;; esac`	A reminder that `case` uses globs, not regex

Quoting the right-hand side turns the pattern into a literal string, so [[ abc =~ "a.c" ]] fails while [[ abc =~ a.c ]] succeeds. Store the pattern in a variable when it contains spaces or quotes.

Common Patterns

Working starting points to copy and adjust.

Pattern	Matches
`grep -E '\b([0-9]{1,3}\.){3}[0-9]{1,3}\b'`	Anything shaped like an IPv4 address
`grep -P '\b((25[0-5]\|2[0-4][0-9]\|1[0-9]{2}\|[1-9]?[0-9])\.){3}(25[0-5]\|2[0-4][0-9]\|1[0-9]{2}\|[1-9]?[0-9])\b'`	An IPv4 candidate with each octet under 256
`grep -E '[[:alnum:]._%+-]+@[[:alnum:].-]+\.[[:alpha:]]{2,}'`	An email-shaped address
`grep -E '[0-9]{4}-[0-9]{2}-[0-9]{2}'`	An ISO date such as `2026-08-28`
`grep -E '#[0-9a-fA-F]{6}\b'`	A six-digit hex color
`grep -nE '[[:space:]]+$'`	Trailing whitespace, with line numbers
`grep -cE '^[[:space:]]*$'`	Count blank lines
`grep -E '^[[:space:]]*#'`	Commented-out configuration lines
`grep -vE '^[[:space:]]*(#\|$)'`	Everything except comments and blank lines
`grep -E '\b([[:alpha:]]+) \1\b'`	A word accidentally repeated twice
`grep -oE '"[^"]*"'`	A double-quoted string, quotes included
`grep -oP 'user=\K\S+'`	The value after a `user=` key, key excluded

The address patterns describe a shape rather than validate it. Use them to pull candidates out of logs, and check the results with a real parser when correctness matters.

Troubleshooting

Common regex problems and what to check first.

Problem	Check
`\d` fails or behaves unexpectedly	BRE and ERE do not define `\d`; use `[[:digit:]]`, `[0-9]`, or `grep -P`
`+` or `?` matched literally	The pattern is basic syntax; escape them as `\+` and `\?`, or switch to `grep -E`
Alternation found nothing	ERE takes a bare pipe, BRE takes an escaped one; `grep -E` is the simpler fix
The shell changed the pattern	Wrap the pattern in single quotes so backslashes and `$` survive
`[a-z]` also matched uppercase	Range order follows the locale; use `LC_ALL=C` or `[[:lower:]]`
Lookahead or lookbehind rejected	BRE and ERE do not support them; use `grep -P`, or the engine’s own syntax such as Vim’s `\@=`
`grep -P` is not supported	The build lacks PCRE; use `pcre2grep`, `perl -ne`, or rewrite the pattern
`\b` did nothing in awk	Awk reads `\b` as a backspace; use `\y` in gawk or `\<` and `\>`
The match ran too far	Quantifiers are greedy; use a negated class such as `[^"]`, or a lazy `.?` with `-P`
Intervals matched literally in Vim	Vim needs `\{2,4}` in magic mode, or `\v` first

Longer walkthroughs and per-tool references.

Guide	Description
Regular Expressions Basics	Learn the building blocks from the ground up
Regular Expressions in Grep	Every grep flavor with worked examples
grep Cheatsheet	Search options, recursion, and context output
sed Cheatsheet	Substitution, addresses, and in-place editing
awk Cheatsheet	Fields, patterns, actions, and built-in variables
Vim Cheatsheet	Motions, editing, search, and replace

parted Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 25 Aug 2026 18:50:00 +0200

Basic Usage

Core command forms and help options.

Command	Description
`parted [OPTIONS] DEVICE [COMMAND [ARGUMENTS]]`	General syntax
`sudo parted /dev/sdX`	Open a disk in interactive mode
`sudo parted /dev/sdX -- print`	Print one disk’s partition table
`sudo parted --list`	List partition tables on all detected disks
`parted --help`	Show command-line options
`parted --version`	Show the installed version

Always pass the whole-disk path explicitly. Most parted changes take effect immediately, even in interactive mode.

Identify the Target Disk

Confirm the device name, size, model, and current use before changing it.

Command	Description
`lsblk -d -o NAME,SIZE,MODEL,TRAN`	List whole disks with identifying details
`lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL`	Show disks, partitions, filesystems, and mounts
`lsblk -f`	Show filesystem labels and UUIDs
`findmnt -S /dev/sdX1`	Check whether a partition is mounted
`sudo parted /dev/sdX -- print`	Review the current partition table
`sudo parted /dev/sdX -- unit MiB print free`	Show partitions and unallocated space

Use /dev/sdX for the whole disk and /dev/sdX1 for its first partition. NVMe and eMMC disks insert p before the number, so partition 1 of /dev/nvme0n1 is /dev/nvme0n1p1. The MOUNTPOINTS column needs util-linux 2.37 or later; use MOUNTPOINT on older releases. Replace every placeholder with a verified device path.

Command-Line Options

Options must appear before the device and session command.

Option	Description
`-l`, `--list`	List partition layouts on all block devices
`-s`, `--script`	Never prompt for input
`-m`, `--machine`	Print colon-separated, machine-readable output
`-j`, `--json`	Print JSON output on supported versions
`-f`, `--fix`	Automatically choose `fix` for repairable exceptions in script mode
`-a optimal`, `--align optimal`	Use optimal alignment for new partitions
`--`	End option parsing before session commands and negative positions

Script mode is not a dry run. Inspect the disk separately before using --script or --fix.

Interactive Commands

Enter these commands at the (parted) prompt.

Command	Description
`help`	List available session commands
`help mkpart`	Show help for one command
`print`	Print the current partition table
`print free`	Include unallocated space
`unit MiB`	Set the default display and input unit
`select /dev/sdY`	Switch to another disk
`quit`	Exit Parted

The quit command does not undo earlier changes because Parted writes most changes as each command runs.

Create a Partition Table

Create a disk label on a new or intentionally cleared disk.

Command	Description
`sudo parted --script /dev/sdX -- mklabel gpt`	Create a GPT partition table
`sudo parted --script /dev/sdX -- mklabel msdos`	Create an MBR partition table
`sudo parted /dev/sdX -- print`	Confirm the new table type

mklabel replaces the existing partition table and makes its partitions inaccessible. Use GPT for current systems; use MBR only when legacy compatibility requires it.

Create GPT Partitions

Give each GPT partition a name, filesystem type hint, start, and end.

Command	Description
`sudo parted --script /dev/sdX -- mkpart data ext4 1MiB 100%`	Create one partition using the available disk
`sudo parted --script /dev/sdX -- mkpart data ext4 1MiB 50GiB`	Create a partition ending at 50 GiB
`sudo parted --script /dev/sdX -- mkpart backup ext4 50GiB 100%`	Use the remaining space for a second partition
`sudo parted /dev/sdX -- print`	Review the finished layout
`sudo parted /dev/sdX -- align-check optimal 1`	Check partition 1 alignment

The filesystem type is a partition-table hint. mkpart does not create a filesystem.

Create MBR Partitions

An MBR table takes a partition type where GPT takes a name.

Command	Description
`sudo parted --script /dev/sdX -- mkpart primary ext4 1MiB 100%`	Create one primary partition using the available disk
`sudo parted --script /dev/sdX -- mkpart primary ext4 1MiB 50GiB`	Create a primary partition ending at 50 GiB
`sudo parted --script /dev/sdX -- mkpart primary ext4 50GiB 100%`	Add a second primary partition
`sudo parted --script /dev/sdX -- mkpart extended 50GiB 100%`	Create an extended partition to hold logical partitions
`sudo parted --script /dev/sdX -- mkpart logical ext4 51GiB 100%`	Create a logical partition inside the extended partition
`sudo parted /dev/sdX -- print`	Review the finished layout

An MBR table holds four primary partitions, or three primary partitions plus one extended partition that contains the logical ones. Start the first logical partition after the extended partition’s start so Parted can write the extended boot record. The name command does not work on MBR partitions.

Units and Positions

Suffix boundary values so Parted does not have to infer the unit.

Value	Description
`s`	Sectors, used for exact sector positions
`MiB`, `GiB`, `TiB`	Exact IEC binary positions
`MB`, `GB`, `TB`	Decimal positions that may allow a nearby boundary
`1MiB`	Common aligned start for a new partition
`100%`	End at the last usable part of the disk
`-1s`	Last sector of the disk; put `--` before the command
`sudo parted /dev/sdX -- unit s print`	Display all boundaries in sectors

Use MiB or GiB for repeatable commands and unit MiB print free when comparing boundaries.

Partition Names and Flags

Names and available flags depend on the partition table type.

Command	Description
`sudo parted --script /dev/sdX -- name 1 data`	Rename GPT partition 1
`sudo parted --script /dev/sdX -- set 1 esp on`	Mark an EFI System Partition
`sudo parted --script /dev/sdX -- set 1 bios_grub on`	Mark a BIOS GRUB partition on GPT
`sudo parted --script /dev/sdX -- set 1 swap on`	Mark a swap partition
`sudo parted --script /dev/sdX -- set 1 lvm on`	Mark an LVM physical volume where supported
`sudo parted --script /dev/sdX -- set 1 raid on`	Mark a software RAID member where supported
`sudo parted --script /dev/sdX -- set 1 FLAG off`	Disable a flag

Run help set interactively to see the flags supported by the current table. Flags record a partition’s purpose but do not create an EFI filesystem, swap area, LVM volume, or RAID array.

Resize a Partition Boundary

Confirm that free space is adjacent to the partition before extending it.

Command	Description
`sudo parted /dev/sdX -- unit MiB print free`	Check the partition and adjacent free space
`sudo parted --script /dev/sdX -- resizepart 1 100%`	Move partition 1’s end to the end of the disk
`sudo partprobe /dev/sdX`	Ask the kernel to reread the partition table
`sudo resize2fs /dev/sdX1`	Grow an ext2, ext3, or ext4 filesystem afterward
`sudo xfs_growfs /mount/point`	Grow a mounted XFS filesystem afterward
`lsblk -f`	Check the resulting partition and filesystem size

resizepart changes only the partition boundary. When shrinking, shrink the filesystem first and use a filesystem-specific procedure.

Remove or Rescue a Partition

Keep inspection and removal as separate commands.

Command	Description
`sudo parted /dev/sdX -- print`	Note the target partition number and boundaries
`sudo parted --script /dev/sdX -- rm 2`	Remove partition 2 immediately
`sudo parted /dev/sdX`	Open interactive mode for recovery
`rescue START END`	Search near the old boundaries for a lost partition
`sudo partprobe /dev/sdX`	Ask the kernel to reread the changed table

After an accidental removal, stop writing to the disk and try rescue before creating another partition. Recovery is not guaranteed.

Format and Mount

Create a filesystem only after checking the new partition path.

Command	Description
`lsblk -f /dev/sdX`	Confirm the new partition and existing filesystems
`sudo mkfs.ext4 -L data /dev/sdX1`	Create an ext4 filesystem with label `data`
`sudo mkfs.xfs -L data /dev/sdX1`	Create an XFS filesystem with label `data`
`sudo mkswap -L swap /dev/sdX2`	Create swap space on partition 2
`sudo mkdir -p /mnt/data`	Create a mount point
`sudo mount /dev/sdX1 /mnt/data`	Mount the new filesystem
`lsblk -f`	Confirm filesystem and mount details

Formatting destroys data on the selected partition. A partition name and a filesystem label are separate values.

Troubleshooting

Common Parted problems and the next check to run.

Problem	Check
Partition is not aligned	Run `align-check optimal NUMBER`; recreate an empty partition with a suitable start
Kernel still shows the old table	Unmount filesystems, disable swap, then run `sudo partprobe /dev/sdX` or reboot
Device or resource is busy	Check `lsblk`, `findmnt`, swap, LVM, RAID, and encrypted mappings
New partition does not appear	Run `sudo partprobe /dev/sdX`, then check `lsblk`; reboot if the disk remains busy
`unrecognised disk label`	The disk has no supported table; verify it is the correct empty disk before using `mklabel`
`mkpart` rejects the partition name	The disk uses an MBR table; pass `primary`, `extended`, or `logical` instead of a name
Filesystem size did not change	Run the correct filesystem grow command after `resizepart`

Use these guides and cheatsheets for the complete storage workflow.

Guide	Description
parted Command in Linux	Full walkthrough for inspecting and changing partitions
Linux Block Devices, Partitions, Filesystems, and Mount Points	Understand where partitioning fits in the storage stack
fdisk Cheatsheet	Menu-driven partitioning command reference
mount Cheatsheet	Mount options, UUIDs, labels, and `/etc/fstab` entries

parted Command in Linux: Manage Disk Partitions

hello@linuxize.com (Linuxize) — Mon, 24 Aug 2026 20:40:00 +0200

When a new disk appears in lsblk, it is visible to Linux but still has nowhere to store files. The disk needs a partition table and at least one partition before you create a filesystem and mount it. The parted command manages those boundaries from the terminal, works with both GPT and MBR tables, and can run interactively or from a script.

Unlike fdisk, which stages changes until you write the table, parted applies most commands immediately. This guide explains how to inspect a disk, create a GPT partition table, add aligned partitions, resize a partition boundary, and remove a partition without losing track of which storage layer you are changing.

Warning

Partitioning the wrong disk can make its data inaccessible. Before every write operation, confirm the device with lsblk , use the whole-disk name such as /dev/sdb rather than a partition such as /dev/sdb1, and keep a current backup of any disk that holds data.

parted Command Syntax

The general form of the command is:

txt
parted [OPTIONS] [DEVICE [COMMAND [ARGUMENTS]]]

Always pass the device explicitly. If you omit it, parted tries to choose a device, which is not a risk worth taking on a machine with several disks.

The options you will use most often are:

-l, --list - List partition layouts on all detected block devices.
-s, --script - Never prompt for input. Use this only after validating the device and command.
-m, --machine - Produce colon-separated output for scripts.
-j, --json - Produce JSON output on versions that support it.
-a, --align - Choose the alignment type for newly created partitions. The default is optimal.

The examples place options before the device and put -- before the parted command. The separator matters when an argument begins with a dash, such as the -1s end position that means the last sector of the disk. Without it, parted reads -1s as an invalid option instead of a position.

Installing parted

Most distributions include parted. If the command is missing, install it with your distribution package manager.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt update
sudo apt install parted

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install parted

Confirm the installed version before continuing:

Terminal
parted --version

Listing Disks and Free Space

Start with lsblk so you can match each device name to its size, model, filesystem, and mount points:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL

A row with TYPE set to disk is a whole device, while rows marked part are partitions. Confirm the size and model instead of relying on a name such as /dev/sdb, since device names can change between boots.

Next, list the partition table on every detected disk:

Terminal
sudo parted --list

output

Model: ATA Samsung SSD 870 (scsi)
Disk /dev/sda: 500GB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
1 1049kB 538MB 537MB fat32 EFI System Partition boot, esp
2 538MB 500GB 500GB ext4

The Partition Table line identifies the layout as gpt or msdos (MBR). The partition rows show the boundaries, detected filesystem, GPT name, and any flags.

To inspect one disk in MiB and include its unallocated regions, use unit MiB followed by print free:

Terminal
sudo parted /dev/sdb -- unit MiB print free

output

Model: QEMU QEMU HARDDISK (scsi)
Disk /dev/sdb: 102400MiB
Sector size (logical/physical): 512B/512B
Partition Table: gpt
Disk Flags:
Number Start End Size File system Name Flags
0.02MiB 1.00MiB 0.98MiB Free Space
1 1.00MiB 51200MiB 51199MiB ext4 data
51200MiB 102400MiB 51200MiB Free Space

Rows without a number are unallocated regions. The small gap at the start of the disk holds the GPT header, while the 51200MiB region after partition 1 is space available for a new partition. This read-only command is the one to run before creating or extending a partition, since it shows whether free space exists and on which side of the existing partitions it sits.

On parted 3.4 and later, --json returns the same layout as structured data for scripts:

Terminal
sudo parted --json /dev/sdb -- unit MiB print

output

{
"disk": {
"path": "/dev/sdb",
"size": "102400MiB",
"model": "QEMU QEMU HARDDISK (scsi)",
"transport": "scsi",
"logical-sector-size": 512,
"physical-sector-size": 512,
"label": "gpt",
"max-partitions": 128,
"partitions": [
{
"number": 1,
"start": "1.00MiB",
"end": "51200MiB",
"size": "51199MiB",
"name": "data",
"filesystem": "ext4"
}
]
}
}

Pipe that into jq when a script needs a single value, such as jq -r '.disk.partitions[].size'.

You can also open an interactive session by passing only the device:

Terminal
sudo parted /dev/sdb

output

GNU Parted 3.7
Using /dev/sdb
Welcome to GNU Parted! Type 'help' to view a list of commands.
(parted)

At the (parted) prompt, enter commands such as print, mkpart, and quit. The remaining examples use command-line mode so each operation and its target are visible in one copy-pasteable command.

Creating a GPT Partition Table

A new disk needs a partition table before it can hold partitions. GPT is the standard choice for current systems and is required when an MBR table with 512-byte sectors would exceed its 2 TiB addressing limit.

Run the inspection command again immediately before creating the table:

Terminal
lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL /dev/sdb

Once /dev/sdb is confirmed as the intended disk, create the GPT label:

Terminal
sudo parted --script /dev/sdb -- mklabel gpt

This replaces the existing partition table and makes its old partitions inaccessible. The --script option suppresses prompts; it is not a dry run and does not make the operation safer. Use mklabel msdos only when you specifically need an MBR table for legacy compatibility.

Creating an Aligned Partition

The mkpart command takes a GPT partition name, a filesystem type hint, and the start and end positions. To create one data partition that fills the usable disk space, run:

Terminal
sudo parted --script /dev/sdb -- mkpart data ext4 1MiB 100%

The name is data, and ext4 sets the intended partition type. It does not create an ext4 filesystem. Starting at 1MiB leaves room for the GPT metadata and gives the partition a common aligned starting point; 100% extends it to the last usable part of the disk.

For two partitions, give each one its own range. This example creates a 50 GiB data partition and uses the remaining space for backups:

Terminal
sudo parted --script /dev/sdb -- mkpart data ext4 1MiB 50GiB
sudo parted --script /dev/sdb -- mkpart backup ext4 50GiB 100%

IEC units such as MiB and GiB identify exact positions. Decimal units such as MB and GB allow parted to choose a nearby position, so explicit IEC units are easier to reason about in repeatable commands.

Print the finished layout:

Terminal
sudo parted /dev/sdb -- unit MiB print free

Then check the alignment of partition 1:

Terminal
sudo parted /dev/sdb -- align-check optimal 1

output

1 aligned

The alignment check confirms that the partition starts on a boundary suited to the device. If it reports not aligned, recreate an empty partition with a suitable start position before writing data to it.

The new partition still has no filesystem. After verifying that /dev/sdb1 is the new empty partition, format it separately:

Terminal
sudo mkfs.ext4 -L data /dev/sdb1

The -L data option assigns a filesystem label, which is separate from the GPT partition name. Follow the mount and unmount guide when you are ready to attach the filesystem to the directory tree.

Renaming a GPT Partition

GPT stores a human-readable name for each partition. To rename partition 1 without changing its filesystem label, use the name command:

Terminal
sudo parted --script /dev/sdb -- name 1 archive

Run print afterward to confirm the new value in the Name column. Partition names are available with GPT and several other table formats, but not with an MBR table.

Setting Partition Flags

Flags mark what a partition is for so that firmware and other tools treat it correctly. The set command takes the partition number, the flag name, and on or off:

Terminal
sudo parted --script /dev/sdb -- set 1 esp on

The flags you will use most often on a GPT disk are:

esp - Mark the partition as an EFI System Partition. On GPT, boot and esp are the same flag.
bios_grub - Mark the small unformatted partition that GRUB needs to boot a GPT disk on BIOS firmware.
lvm - Mark the partition as an LVM physical volume.
raid - Mark the partition as a software RAID member.
msftdata - Mark the partition as Microsoft basic data, which is the type Windows expects.

Turn a flag off by passing off instead:

Terminal
sudo parted --script /dev/sdb -- set 1 lvm off

Flags record intent and set the GPT partition type, but they create nothing. Setting lvm does not run pvcreate, and setting esp does not put a FAT32 filesystem on the partition. To see which flags the current table supports, open an interactive session and run help set.

Resizing a Partition

Before extending a partition, use print free to confirm that unallocated space begins directly after it:

Terminal
sudo parted /dev/sdb -- unit MiB print free

If partition 1 is followed by free space, move its end boundary to the end of the disk:

Terminal
sudo parted --script /dev/sdb -- resizepart 1 100%

The resizepart command changes only the partition boundary. It does not resize the filesystem inside. For an ext4 filesystem, grow the filesystem afterward:

Terminal
sudo resize2fs /dev/sdb1

Use df to confirm the filesystem now sees the extra capacity. Other filesystems need their own resizing tools; XFS, for example, grows with xfs_growfs and cannot be shrunk. For the full grow workflow, including XFS, Btrfs, and LVM, see how to resize and extend a Linux partition .

Shrinking is a different workflow. You must unmount and shrink a shrinkable filesystem first, check it for errors, and only then move the partition boundary. Do not use resizepart alone to shrink a partition, since it can cut off live filesystem data.

Removing a Partition

List the table one final time and note the number of the partition you intend to remove:

Terminal
sudo parted /dev/sdb -- print

When the number is confirmed, remove partition 2:

Terminal
sudo parted --script /dev/sdb -- rm 2

The partition disappears from the table immediately, and its former space becomes unallocated. Script mode provides no confirmation, so keep the inspection and removal as separate commands rather than chaining them.

Quick Reference

For a printable quick reference, see the parted cheatsheet .

Task	Command
List all partition tables	`sudo parted --list`
Show one disk and its free space	`sudo parted /dev/sdb -- unit MiB print free`
Print the layout as JSON	`sudo parted --json /dev/sdb -- unit MiB print`
Open interactive mode	`sudo parted /dev/sdb`
Create a GPT table	`sudo parted --script /dev/sdb -- mklabel gpt`
Create an ext4 data partition	`sudo parted --script /dev/sdb -- mkpart data ext4 1MiB 100%`
Check optimal alignment	`sudo parted /dev/sdb -- align-check optimal 1`
Rename GPT partition 1	`sudo parted --script /dev/sdb -- name 1 archive`
Set the EFI system partition flag	`sudo parted --script /dev/sdb -- set 1 esp on`
Extend partition 1	`sudo parted --script /dev/sdb -- resizepart 1 100%`
Remove partition 2	`sudo parted --script /dev/sdb -- rm 2`

Troubleshooting

The kernel still uses the old partition table
Unmount filesystems on the disk, disable any swap partition it contains, and run sudo partprobe /dev/sdb to ask the kernel to reread the table. If the device is still busy, schedule a reboot instead of forcing another partition change.

parted reports that a partition is not properly aligned
Use sudo parted /dev/sdb -- align-check optimal NUMBER to verify the start boundary. If the partition is empty, recreate it with a 1MiB start or another boundary that satisfies the device’s reported alignment requirements.

A partition was removed by mistake
Stop writing to the disk. Open sudo parted /dev/sdb, run rescue START END with the approximate old boundaries, and confirm the discovered partition only when its location and filesystem match. Recovery is not guaranteed, especially after new data has been written.

parted says a partition is in use
Check lsblk and findmnt, then unmount the filesystem before changing its boundaries. A disk can also remain busy because it contains active swap, an LVM physical volume, software RAID, or an encrypted mapping.

FAQ

Should I use parted or fdisk?
Both tools support GPT and MBR tables. fdisk provides an interactive workflow that stages changes until you write them, while parted is convenient for one-line commands, scripts, alignment checks, and changing a partition’s end boundary.

Does parted format partitions?
No. parted creates the partition entry and can record an intended filesystem type, but it does not create the filesystem. Run the appropriate mkfs command on the new partition after checking the device name.

Does resizepart resize the filesystem too?
No. resizepart only moves the partition’s end boundary. Grow or shrink the filesystem separately with the tool designed for that filesystem, and always shrink the filesystem before shrinking its partition.

Should I use GPT or MBR?
Use GPT for current Linux systems, UEFI boot disks, and disks larger than 2 TiB. Use MBR only when an older operating system or firmware requires it.

Conclusion

parted is most useful when you need precise, repeatable control over partition boundaries, especially on GPT disks. Keep inspection and write commands separate, use explicit units, and stop after unexpected output instead of pushing through with --script.

DNS Record Types Explained: A, AAAA, CNAME, MX, TXT, and More

hello@linuxize.com (Linuxize) — Fri, 21 Aug 2026 16:00:00 +0200

A website can load normally while mail delivery, domain verification, or certificate issuance fails. Each service asks DNS a different question, and the answer comes from a specific record type.

A and AAAA records provide server addresses, MX records route email, TXT records publish verification and policy data, and several other types handle aliases, delegation, service discovery, and security. This guide explains the DNS record types you will encounter most often, shows their zone-file syntax, and demonstrates how to inspect them with dig.

What a DNS Record Contains

DNS is a distributed database that associates names with typed data. A resource record contains a name, time to live (TTL), class, type, and value. The class is almost always IN, which means Internet.

Here are three records in zone-file notation:

txt
example.com. 3600 IN A 203.0.113.10
www.example.com. 3600 IN CNAME example.com.
example.com. 3600 IN MX 10 mail.example.com.

The final dot marks each name as fully qualified. DNS control panels often hide this detail and let you enter @ for the zone apex or only the subdomain label, such as www.

The TTL in this example is 3600 seconds, so a resolver may reuse a cached answer for up to one hour. A shorter TTL lets resolvers fetch a changed record sooner, but it does not shorten the lifetime of copies already cached with the old value. Before a planned migration, lower the TTL at least one old-TTL interval in advance, wait for existing caches to expire, and then make the change.

A Records: IPv4 Addresses

An A record maps a hostname to an IPv4 address:

txt
example.com. 3600 IN A 203.0.113.10

This is the usual record for pointing a website or another network service at an IPv4 server. The value must be an IPv4 address, not a URL, port number, or hostname.

A name can have several A records. Resolvers usually return the complete set, and clients may try the addresses in different orders. This provides basic round-robin traffic distribution, but DNS does not check whether each server is healthy. An unavailable address can remain in the answer until you remove it and its cached TTL expires.

AAAA Records: IPv6 Addresses

An AAAA record maps a hostname to an IPv6 address:

txt
example.com. 3600 IN AAAA 2001:db8::10

A dual-stack service commonly publishes both A and AAAA records. Current clients usually request both types and use a connection strategy such as Happy Eyeballs to try IPv6 and IPv4 without waiting through a long failure.

Publish an AAAA record only when the service is reachable at that IPv6 address. IPv4-only clients will continue using the A record, but an incorrect AAAA record can delay or break connections for visitors whose systems prefer IPv6.

CNAME Records: Aliases

A CNAME record makes one name an alias of another name:

txt
www.example.com. 3600 IN CNAME example.com.

When a resolver receives this answer, it continues the lookup at example.com. CNAME records are useful when a subdomain must follow a hostname managed by a CDN, application host, or other provider whose IP addresses may change.

The owner of a CNAME cannot also hold ordinary A, AAAA, MX, or TXT data. The zone apex (example.com) must hold SOA and NS records, so it cannot be a CNAME. Providers implement apex aliasing through non-standard features named ALIAS, ANAME, or CNAME flattening, which resolve the target and publish A or AAAA answers on your behalf.

MX Records: Mail Routing

MX records identify the servers that accept email for a domain. Each value starts with a preference number, and lower numbers are preferred:

txt
example.com. 3600 IN MX 10 mail1.example.com.
example.com. 3600 IN MX 20 mail2.example.com.

A sending server tries mail1.example.com first and falls back to mail2.example.com if the preferred server is unavailable. Records with equal preference can share delivery attempts.

An MX target must be a hostname that resolves directly through A or AAAA records. It cannot be an IP address or a CNAME alias. The trailing dot is also important in a zone file because omitting it may cause the DNS server to append the zone name.

TXT Records: Verification and Policy Data

TXT records store text associated with a name. Providers use them for domain-ownership challenges, while email systems use them for SPF, DKIM, and DMARC:

txt
example.com. 3600 IN TXT "v=spf1 mx -all"
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine"

The SPF value lists which systems may send mail for the domain. A domain must not publish multiple TXT records beginning with v=spf1 at the same name. DMARC lives at _dmarc, while DKIM keys use a selector name such as default._domainkey.example.com.

Long TXT data can appear as several quoted strings because each individual character-string has a size limit. DNS clients concatenate those strings into one record value. Our guide to SPF, DKIM, and DMARC explains how the three email checks work together.

NS Records: Zone Delegation

NS records name the authoritative servers for a DNS zone:

txt
example.com. 86400 IN NS ns1.dns-provider.net.
example.com. 86400 IN NS ns2.dns-provider.net.

The parent zone publishes a delegation that directs resolvers to these servers, and the delegated zone publishes its own NS set at the apex. Changing name servers at a registrar updates the parent delegation. The parent and authoritative-zone sets should agree, or different resolution paths may produce inconsistent results.

DNS zones should have at least two authoritative servers for availability, and most registries require it. Managed providers normally create the apex NS records automatically, although you still select or confirm the delegation through the registrar.

SOA Records: Zone Metadata

Every zone contains one SOA (start of authority) record. It identifies the primary server, encodes the administrator contact, and stores a serial number and timers used by secondary servers:

txt
example.com. 86400 IN SOA ns1.dns-provider.net. admin.example.com. (
 2026082101 ; serial
 7200 ; refresh
 3600 ; retry
 1209600 ; expire
 3600 ) ; minimum

In this example, admin.example.com. represents the email address admin@example.com. Secondary servers compare the serial number with their copy and transfer the zone when the serial increases.

The final MINIMUM field participates in negative caching. A resolver may cache a response stating that a name or record does not exist for the lower of this value and the SOA record’s own TTL. Managed DNS services maintain the SOA fields for you, but the serial and timers remain useful when diagnosing stale or inconsistent authoritative servers.

PTR Records: Reverse DNS

A PTR record maps an IP address to a hostname. IPv4 records live below in-addr.arpa, with the address octets reversed, while IPv6 uses ip6.arpa:

txt
10.113.0.203.in-addr.arpa. 3600 IN PTR mail.example.com.

The organization that controls the IP block also controls its reverse zone. For a server address, this is usually your hosting provider or ISP, so you configure PTR data through its control panel rather than your domain’s normal DNS zone.

Forward and reverse records are independent. Mail systems often check that the PTR hostname resolves forward to the sending address, so a mail server should have matching PTR and A or AAAA data.

SRV Records: Service Discovery

An SRV record advertises the hostname and port for a service. Its owner name begins with underscore-prefixed service and protocol labels:

txt
_sip._tcp.example.com. 3600 IN SRV 10 60 5060 sipserver.example.com.

The four values are priority, weight, port, and target. Clients prefer lower priorities. When several records share a priority, weight helps distribute requests among their targets.

SRV records are common with SIP, XMPP, LDAP, Active Directory, and some game servers. Web browsers did not adopt SRV for ordinary HTTP and HTTPS navigation, so websites still depend on address, alias, and newer HTTPS records.

CAA Records: Certificate Issuance

A CAA record authorizes a certificate authority to issue TLS certificates for a domain:

txt
example.com. 3600 IN CAA 0 issue "letsencrypt.org"

A public certificate authority checks the relevant CAA set before issuance. If a name has no CAA record, the search continues up its DNS name hierarchy, so a policy at example.com also applies to subdomains that do not publish their own CAA set.

The issue property covers standard certificates, issuewild can set a separate wildcard policy, and iodef supplies a contact for policy reports. Check the issuer identifier required by your certificate authority before adding CAA records. An incorrect policy can block both initial issuance and automated renewal.

Other DNS Record Types

DNSSEC uses DNSKEY, DS, RRSIG, NSEC, and NSEC3 records so validating resolvers can authenticate DNS answers. The DNS provider creates signatures and DNSKEY records in the zone, while a DS record in the parent zone completes the chain of trust. Enabling DNSSEC only at the provider without publishing the required DS record does not establish that chain.

SVCB and HTTPS records publish connection parameters and alternative service endpoints. HTTPS records can advertise supported application protocols, including HTTP/3, and provide address hints before a client opens its connection. DNS providers and content delivery networks may create these records automatically.

You may also encounter TLSA for DANE certificate association, SSHFP for SSH host-key fingerprints, and NAPTR for rule-based service discovery. These specialized types are not needed for most domain setups.

Querying DNS Records with dig

The general short-answer form of a dig query is:

txt
dig +short NAME TYPE

For a stable public example, query the A records for Cloudflare’s resolver hostname:

Terminal
dig +short one.one.one.one A

output

1.0.0.1
1.1.1.1

The order may vary because both addresses belong to the same A record set. Remove +short when you need the response status, authoritative flag, TTL, and server details.

To inspect a domain’s mail routing, request its MX records:

Terminal
dig +short gmail.com MX

output

5 gmail-smtp-in.l.google.com.
10 alt1.gmail-smtp-in.l.google.com.
20 alt2.gmail-smtp-in.l.google.com.
30 alt3.gmail-smtp-in.l.google.com.
40 alt4.gmail-smtp-in.l.google.com.

Each answer starts with its preference number, followed by the mail-server hostname. A sending server tries gmail-smtp-in.l.google.com first because its preference of 5 is the lowest. The returned servers and their order can change as the domain operator updates its mail infrastructure.

TXT, CAA, NS, and other records use the same pattern:

Terminal
dig +short example.com TXT
dig +short example.com CAA
dig +short example.com NS

For reverse DNS, pass an address to -x instead of building the reverse-zone name manually:

Terminal
dig +short -x 1.1.1.1

output

one.one.one.one.

The dig command guide covers server selection, trace queries, and DNSSEC checks. The host and nslookup commands provide simpler alternatives. After changing a record, remember that your resolver or operating system may keep the previous answer until its TTL expires, although you can clear the local DNS cache during testing.

Quick Reference

Task	Record type	Value
Point a name to an IPv4 address	A	`203.0.113.10`
Point a name to an IPv6 address	AAAA	`2001:db8::10`
Make a name follow another hostname	CNAME	`example.com.`
Route incoming email	MX	`10 mail.example.com.`
Publish verification or policy text	TXT	`"v=spf1 mx -all"`
Delegate a zone to authoritative servers	NS	`ns1.dns-provider.net.`
Store zone authority and transfer data	SOA	Primary server, serial, and timers
Map an IP address back to a hostname	PTR	`mail.example.com.`
Advertise a service hostname and port	SRV	`10 60 5060 sip.example.com.`
Restrict certificate authorities	CAA	`0 issue "letsencrypt.org"`

Conclusion

Before saving a DNS change, confirm the record owner, value format, and whether the target must be an address or a hostname. Lower the TTL ahead of planned migrations, keep the old service available while caches expire, and use dig to verify the answers that resolvers actually receive.

Block Devices, Partitions, and Filesystems in Linux Explained

hello@linuxize.com (Linuxize) — Sat, 15 Aug 2026 10:35:00 +0200

You attach a new disk to a server, run lsblk , and the drive is there. Then you try to copy a file onto it and nothing works, because there is no path to copy to. The disk is visible to the kernel, but it has no partition, no filesystem, and no place in the directory tree.

Linux storage is built from four layers stacked on top of each other, and most confusion comes from treating them as one thing. This guide explains what a block device, a partition, a filesystem, and a mount point each are, how they connect, and which command shows you the state of each layer.

What a Block Device Is

A block device is how the kernel represents a piece of storage that can be read and written in fixed-size chunks called blocks, rather than one byte at a time. Hard drives, SSDs, USB sticks, SD cards, and the virtual disks of a cloud instance are all block devices.

Every block device gets a file under /dev. The name depends on the driver that claims the hardware:

/dev/sda, /dev/sdb - SATA, SAS, and USB storage
/dev/nvme0n1 - the first namespace of the first NVMe drive
/dev/vda - a virtual disk on a KVM or cloud guest
/dev/mmcblk0 - an SD card or eMMC device

These files are not ordinary files. Running ls -l on one shows what they really are:

Terminal
ls -l /dev/sda /dev/null

output

brw-rw---- 1 root disk 8, 0 Aug 14 09:12 /dev/sda
crw-rw-rw- 1 root root 1, 3 Aug 14 09:12 /dev/null

The first character of the permission string is the giveaway. b marks a block device and c marks a character device such as /dev/null. The pair of numbers where a file size would normally appear, 8, 0, is the major and minor number that identifies the driver and the specific device it handles.

The kernel also publishes every block device under /sys/block, which is where tools such as lsblk read their information from. A block device at this stage is just an addressable range of storage. Nothing on it means anything yet.

Partitions Divide a Disk

A partition is a labeled region of a block device. The disk keeps a small table near its start that records where each region begins and ends, and the kernel exposes each region as its own block device: /dev/sda1, /dev/sda2, and so on. NVMe and SD devices insert a p before the number, so the first partition of /dev/nvme0n1 is /dev/nvme0n1p1.

Two partition table formats are in common use:

MBR (also called msdos) is the older format. It supports four primary partitions, works around that limit with extended partitions, and cannot address a disk larger than 2 TiB with standard 512-byte sectors.
GPT is the modern format. It commonly provides 128 partition entries, supports disks far larger than MBR, and stores a backup copy of the table at the end of the disk. UEFI firmware supports both GPT and legacy MBR, though GPT is the standard choice for current UEFI installations.

To see which format a disk uses, run fdisk with the -l flag:

Terminal
sudo fdisk -l /dev/sda

The output starts with the disk size and model, then prints a Disklabel type line that reads either gpt or dos, followed by the partition list.

Partitioning is a convention rather than a hard requirement. You can create a filesystem directly on a whole disk, and some storage appliances do exactly that. On a system that boots from the disk, though, partitions are what separate the EFI system partition, the boot files, and the root filesystem from each other.

A partition still holds no structure. It marks out space and stops there.

Filesystems Give a Partition Structure

A filesystem is the format written inside a partition that turns raw space into directories, filenames, permissions, and timestamps. Creating one is called formatting, and the mkfs family of commands does it:

Warning

Creating a filesystem destroys any existing filesystem and data on the target. Before running mkfs, confirm the device name with lsblk -f, verify that it is the intended empty partition, and make sure it is not mounted.

Terminal
sudo mkfs.ext4 /dev/sdb1

This writes ext4 metadata across /dev/sdb1, including the superblock, the inode tables, and the free-space maps. From that moment the partition can hold files, and each file gets an inode that stores its metadata.

Linux supports many filesystem types, and the choice matters:

ext4 - the default on most Debian and Ubuntu installations, stable and well understood
xfs - the default on RHEL and derivatives, strong with large files and parallel writes
btrfs - supports snapshots, checksums, and built-in volume management
vfat - used for EFI System Partitions and broadly compatible removable drives
exfat - suited to large removable drives shared with Windows and macOS
swap - not a filesystem for files at all, but a formatted area the kernel uses as swap space

Formatting also assigns the filesystem a UUID, and optionally a label. Both identify the filesystem itself rather than the device it happens to sit on. This distinction matters more than it first appears: device names are assigned in detection order, so a disk that is /dev/sdb today can come up as /dev/sdc after you add another drive or reboot a cloud instance. The UUID does not move. That is why configuration files should reference UUID= instead of /dev/sdb1.

Mount Points Attach a Filesystem to the Tree

Linux has no drive letters. Every filesystem on the machine appears somewhere inside a single tree that starts at /. A mount point is the directory where a filesystem is attached, and mounting is the act of attaching it. Create the mount point, then attach the filesystem:

Terminal
sudo mkdir -p /srv/data
sudo mount /dev/sdb1 /srv/data

The first command creates the directory if it does not already exist. After the second command, everything written under /srv/data lands on /dev/sdb1, while the rest of the tree stays on whatever filesystem holds /. The reader cannot tell from the path alone which disk a file lives on, which is the point of the design.

A mount point is an ordinary directory. There is no special flag that makes /srv/data mountable, and any empty directory works.

Info

If the directory already contains files when you mount over it, those files are hidden rather than deleted. They are still on the underlying filesystem and reappear once you unmount.

A manual mount command lasts until reboot. To make it persistent, the filesystem needs an entry in /etc/fstab , which the system reads at boot and mounts automatically.

Walking Through One Real Layout

Putting the four layers side by side makes the stack easier to read. The -o flag selects the columns, and adding TYPE shows what each row actually is:

Terminal
lsblk -o NAME,TYPE,FSTYPE,LABEL,MOUNTPOINTS

output

NAME TYPE FSTYPE LABEL MOUNTPOINTS
nvme0n1 disk
├─nvme0n1p1 part vfat /boot/efi
├─nvme0n1p2 part ext4 boot /boot
└─nvme0n1p3 part LVM2_member
├─vg0-root lvm ext4 root /
└─vg0-swap lvm swap [SWAP]
sdb disk
└─sdb1 part xfs data /srv/data

Read it from the outside in. nvme0n1 and sdb have TYPE of disk and no filesystem of their own, because they are the block devices. The indented rows marked part are partitions. The FSTYPE column tells you which of those partitions were formatted, and with what. The MOUNTPOINTS column tells you where each formatted filesystem was attached.

nvme0n1p3 shows all four layers coming apart cleanly. It is a partition, it has a format, but that format is LVM2_member rather than a filesystem you can browse, and it has no mount point. Its two children are the layer that carries the actual filesystems.

The sdb disk is the simple case: one disk, one partition, one XFS filesystem labeled data, mounted at /srv/data.

Where LVM, RAID, and Encryption Fit

The four layers describe the common path, but Linux lets you insert extra layers between the partition and the filesystem. Each one consumes a block device and produces a new one.

LVM groups one or more physical volumes into a volume group, then carves logical volumes out of it. The logical volume is a block device at /dev/mapper/vg0-root, and you format that instead of the partition. Logical volumes can be resized and moved between disks without repartitioning, which is why servers so often use them.

Software RAID combines several devices into one /dev/md0 device with mirroring or striping across the members. The filesystem sits on /dev/md0 and never sees the individual disks.

LUKS encryption wraps a device in an encrypted container. Unlocking it produces a decrypted block device under /dev/mapper, and the filesystem goes there. lsblk shows the container with TYPE of crypt.

These stack in any sensible order, and a common server layout runs all of them at once: partition, then LUKS, then LVM, then ext4. Each layer only needs to know about the block device directly beneath it.

Quick Reference

Layer	What it is	Typical name	Inspect with
Block device	Raw addressable storage exposed by the kernel	`/dev/sda`, `/dev/nvme0n1`	`lsblk -d`, `ls -l /dev/sd*`
Partition	A labeled region of a block device	`/dev/sda1`, `/dev/nvme0n1p1`	`sudo fdisk -l`, `lsblk`
Filesystem	The format written inside a partition	ext4, xfs, btrfs, vfat	`lsblk -f`, `blkid`
Mount point	The directory where a filesystem is attached	`/`, `/boot`, `/srv/data`	`findmnt`, `df -h`

FAQ

What is the difference between a partition and a filesystem?
A partition reserves a region of a disk and records its boundaries in the partition table. A filesystem is the structure written inside that region so it can store files. A freshly created partition has no filesystem, which is why mkfs is a separate step after fdisk or parted.

Is /dev/sda a file or a device?
Both, in a sense. /dev/sda is a special file that acts as the interface to the device, so tools can open, read, and write it with ordinary file operations. The leading b in ls -l output marks it as a block device rather than a regular file.

Why does my disk name change between reboots?
Kernel device names are assigned in detection order, not fixed to the hardware. Adding a drive or rebooting a virtual machine can shift /dev/sdb to /dev/sdc. Refer to filesystems by UUID= or LABEL= in /etc/fstab and scripts so the reference survives reordering.

How do I tell which disk a directory lives on?
Pass the path to findmnt --target, for example findmnt --target /srv/data, and it prints the source device, filesystem type, and mount options for the filesystem containing that path. Running df -h /srv/data shows the source device, capacity, usage, and mount point instead.

Can I create a filesystem without partitioning first?
Yes. Running mkfs.ext4 /dev/sdb creates an ext4 filesystem directly on the whole disk with no partition table. Filesystem-aware tools such as lsblk -f and blkid still detect it, while partitioning tools report that no partition table is present. This is destructive and should only be done intentionally on a verified empty data disk. Use partitions for boot disks and workflows that expect a partition table.

Conclusion

Once you can name which layer a problem sits on, the next check becomes clearer: a missing device is a kernel or cabling question, an unknown partition or filesystem needs inspection before you change it, and a known unmounted filesystem calls for mount. Start with lsblk -f on any unfamiliar machine, since it shows three of the four layers in a single screen.

nmap Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 14 Aug 2026 15:15:00 +0200

Basic Syntax

Core nmap command forms.

Command	Description
`nmap 192.168.1.10`	Scan the 1000 most common TCP ports on one host
`sudo nmap 192.168.1.10`	Same scan as root, which enables the faster SYN scan
`nmap -v 192.168.1.10`	Increase verbosity, repeat as `-vv` for more detail
`nmap --reason 192.168.1.10`	Show why each port is in its reported state
`nmap --open 192.168.1.10`	Report only ports that are open

Target Specification

Point a scan at one host, a range, a subnet, or a list.

Command	Description
`nmap 192.168.1.10 10.0.0.5`	Scan several hosts in one run
`nmap 192.168.1.0/24`	Scan a whole subnet in CIDR notation
`nmap 192.168.1.1-50`	Scan an address range
`nmap -iL targets.txt`	Read targets from a file, one per line
`nmap --exclude 192.168.1.1 192.168.1.0/24`	Skip specific hosts in a larger scan
`nmap -6 2001:db8::1`	Scan an IPv6 target

Host Discovery

Find which hosts are up before spending time on port scans.

Command	Description
`sudo nmap -sn 192.168.1.0/24`	Ping scan: list live hosts without scanning ports
`nmap -Pn 192.168.1.10`	Skip discovery and treat the host as online
`nmap -PS22,80,443 192.168.1.0/24`	Discover hosts with TCP SYN probes to those ports
`nmap -PA80 192.168.1.0/24`	Discover hosts with TCP ACK probes
`sudo nmap -PE 192.168.1.0/24`	Discover hosts with ICMP echo requests
`nmap -n 192.168.1.0/24`	Skip reverse DNS lookups to speed up the scan

Port Selection

Control which ports the scan covers.

Command	Description
`nmap -p 22 192.168.1.10`	Scan a single port
`nmap -p 22,80,443 192.168.1.10`	Scan a list of ports
`nmap -p 1-1024 192.168.1.10`	Scan a port range
`nmap -p- 192.168.1.10`	Scan all 65535 TCP ports
`nmap -F 192.168.1.10`	Fast scan of the top 100 ports
`nmap --top-ports 20 192.168.1.10`	Scan the 20 most common ports
`sudo nmap -sU -sS -p U:53,T:80,443 192.168.1.10`	Mix UDP and TCP ports, which needs both scan types

Scan Types

Pick how nmap probes each port. The raw-packet scans need root.

Command	Description
`sudo nmap -sS 192.168.1.10`	TCP SYN scan: fast, the default when running as root
`nmap -sT 192.168.1.10`	TCP connect scan: the fallback for an unprivileged user
`sudo nmap -sU 192.168.1.10`	UDP scan: slow, so pair it with `--top-ports`
`sudo nmap -sA 192.168.1.10`	ACK scan: map which ports a firewall filters
`sudo nmap -sn 192.168.1.0/24`	No port scan at all, discovery only
`nmap -sL 192.168.1.0/24`	List scan: show the targets without sending probes

Service and OS Detection

Identify what is listening and what the host is running.

Command	Description
`nmap -sV 192.168.1.10`	Detect service names and version numbers
`nmap -sV --version-intensity 9 192.168.1.10`	Probe harder for versions, from 0 (light) to 9
`sudo nmap -O 192.168.1.10`	Guess the operating system from TCP/IP fingerprints
`sudo nmap -A 192.168.1.10`	Aggressive scan: `-sV`, `-O`, default scripts, and traceroute
`sudo nmap --traceroute 192.168.1.10`	Trace the route to each target

Timing and Performance

Trade speed against accuracy and network load.

Command	Description
`nmap -T4 192.168.1.10`	Faster timing, a good default on a local network
`nmap -T2 192.168.1.10`	Slower and gentler on fragile or busy networks
`nmap --min-rate 1000 192.168.1.0/24`	Send at least 1000 packets per second
`nmap --max-retries 1 192.168.1.0/24`	Give up sooner on unanswered probes
`nmap --host-timeout 5m 192.168.1.0/24`	Abandon any host still scanning after 5 minutes

Output Formats

Save results for review, diffing, or scripting.

Command	Description
`nmap -oN scan.txt 192.168.1.10`	Write human readable output to a file
`nmap -oX scan.xml 192.168.1.10`	Write XML for other tools to parse
`nmap -oG scan.gnmap 192.168.1.10`	Write grepable output for `grep` and `awk`
`nmap -oA scan 192.168.1.10`	Write all three formats using one base name
`nmap --append-output -oN scan.txt 192.168.1.11`	Append to an existing output file

NSE Scripts

Run the Nmap Scripting Engine for deeper checks.

Command	Description
`nmap -sC 192.168.1.10`	Run the default script set
`nmap --script http-title 192.168.1.10`	Run one named script
`nmap --script "http-*" 192.168.1.10`	Run every script matching a pattern
`nmap --script vuln 192.168.1.10`	Run the vulnerability script category
`nmap --script ssl-enum-ciphers -p 443 example.com`	List the TLS ciphers a server accepts
`nmap --script-help ssh-auth-methods`	Read what a script does before running it

Common Use Cases

Practical scans for day-to-day network work.

Command	Description
`sudo nmap -sn 192.168.1.0/24`	Inventory the hosts on a local network
`sudo nmap -p- -T4 192.168.1.10`	Find every open TCP port on one server
`nmap -sV --open 192.168.1.10`	List running services and their versions
`nmap -p 80,443 --open 192.168.1.0/24`	Locate the web servers on a subnet
`sudo nmap -sU --top-ports 20 192.168.1.10`	Check the most common UDP services
`sudo nmap -A -oA audit 192.168.1.10`	Full audit of one host, saved in every format

Troubleshooting

Quick checks for common nmap problems.

Issue	Check
`You requested a scan type which requires root privileges`	Run the command with `sudo`, or use `-sT` instead of `-sS`
`Note: Host seems down`	Add `-Pn` when ICMP is blocked but the host is reachable
Scan takes far too long	Add `-T4`, narrow the ports with `-F` or `--top-ports`, and add `-n`
Every UDP port shows `open\|filtered`	UDP has no handshake, so add `-sV` or scan fewer ports for a clearer answer
Results differ from a local port check	The firewall may filter the port; compare with `ss -tulpn` on the host itself

Use these guides for broader port and network troubleshooting.

Guide	Description
nmap Command in Linux	Full `nmap` guide with detailed examples
How to Check Open Ports in Linux	Scan a host for open ports with nmap, netcat, or telnet
ss Command in Linux	Inspect sockets and listening services
netcat cheatsheet	Test single ports and move data between hosts
tcpdump cheatsheet	Capture the packets behind a scan result

lsblk Command in Linux: List Block Devices

hello@linuxize.com (Linuxize) — Thu, 13 Aug 2026 11:20:00 +0200

When you plug in a new drive, set up a fresh partition, or try to remember which disk is mounted where, you need a quick way to see every block device attached to the system. The lsblk command reads information from sysfs and the udev database and prints a tidy tree of disks, partitions, loop devices, and LVM volumes, together with their sizes and mount points.

This guide explains how to use lsblk to inspect block devices, pick the columns you need, and format the output for scripts.

lsblk Syntax

The general form of the command is:

txt
lsblk [OPTIONS] [DEVICE...]

With no arguments, lsblk lists every block device except RAM disks and empty devices. You can pass one or more device paths to limit the output, for example lsblk /dev/sda.

Unlike fdisk , lsblk does not need root privileges for most queries, which makes it safer for quick checks.

Basic Usage

Run lsblk with no options to see a tree of all devices on the system:

Terminal
lsblk

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
├─sda2 8:2 0 16G 0 part [SWAP]
└─sda3 8:3 0 449.3G 0 part /
sdb 8:16 1 14.3G 0 disk
└─sdb1 8:17 1 14.3G 0 part /media/john/usb
sr0 11:0 1 1024M 0 rom

Each row describes one device. The tree characters on the left show which partitions belong to which disk. The TYPE column tells you whether the entry is a whole disk, a partition, an optical rom, an LVM lvm volume, a crypt container, and so on. The MOUNTPOINTS column is empty when the partition is not mounted.

The RM column is 1 when the kernel marks a device as removable, and RO is 1 for read-only devices. Some USB drives report RM as 0, so use the TRAN column when you specifically need to identify USB storage.

Hide Partitions and Child Devices

When you only care about top-level devices, pass the -d (or --nodeps) flag to hide their partitions, holders, and slaves:

Terminal
lsblk -d

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
sdb 8:16 1 14.3G 0 disk
sr0 11:0 1 1024M 0 rom

This is handy when you do not want partition noise. It does not filter by device type, so entries such as the sr0 optical drive can still appear.

Snap packages mount as loop devices, so on an Ubuntu desktop the list can fill with loop0 through loop20 before you reach the real disks. Exclude them by major number with -e (or --exclude):

Terminal
lsblk -e 7

Major number 7 is the loop driver. You can pass several numbers as a comma-separated list, for example lsblk -e 7,11 to drop optical drives as well.

Show Filesystem Information

Passing -f (or --fs) replaces the default columns with filesystem details such as the type, label, UUID, and how full each mounted filesystem is:

Terminal
lsblk -f

output

NAME FSTYPE FSVER LABEL UUID FSAVAIL FSUSE% MOUNTPOINTS
sda
├─sda1 vfat FAT32 4F3A-91BC 470.1M 8% /boot/efi
├─sda2 swap 1 9f4b5a44-6d1e-44a8-a0ae-2c3d3e4f1234 [SWAP]
└─sda3 ext4 1.0 root be2e1f8e-7a0b-4ab1-9f1d-5c6d7e8f9012 312.5G 25% /
sdb
└─sdb1 vfat FAT32 USB 1A2B-3C4D 12.8G 10% /media/john/usb

This is usually the fastest way to find a UUID for /etc/fstab or to confirm which filesystem type sits on a given partition.

Pick Specific Columns

The default columns cover the common cases, but you can choose exactly what to show with the -o (or --output) option. Pass a comma-separated list of column names:

Terminal
lsblk -o NAME,SIZE,TYPE,MOUNTPOINTS

output

NAME SIZE TYPE MOUNTPOINTS
sda 465.8G disk
├─sda1 512M part /boot/efi
├─sda2 16G part [SWAP]
└─sda3 449.3G part /
sdb 14.3G disk
└─sdb1 14.3G part /media/john/usb
sr0 1024M rom

To see the full list of columns lsblk understands, run:

Terminal
lsblk --list-columns

On util-linux versions older than 2.41, that option does not exist yet, and lsblk --help prints the column list instead.

Useful columns include UUID, LABEL, MODEL, SERIAL, VENDOR, FSTYPE, PARTTYPE, HOTPLUG, and TRAN (transport, for example sata, nvme, or usb).

To add columns to the default set rather than replace it, prefix the list with +. For example, this command adds the model and serial number:

Terminal
lsblk -o +MODEL,SERIAL

The -O (or --output-all) flag has a different purpose: it displays every available column.

Show Device Paths

By default, lsblk prints short names such as sda1. If you want the full /dev path in the NAME column, add -p (or --paths):

Terminal
lsblk -p

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
/dev/sda 8:0 0 465.8G 0 disk
├─/dev/sda1 8:1 0 512M 0 part /boot/efi
├─/dev/sda2 8:2 0 16G 0 part [SWAP]
└─/dev/sda3 8:3 0 449.3G 0 part /

Full paths are easier to copy into a script or a mount command.

List a Single Device

You can pass a device path to inspect only that device and its partitions:

Terminal
lsblk /dev/sda

This narrows the output to one disk, which is useful on servers with many drives.

Flat and ASCII Output

The tree layout is readable in a terminal but awkward to parse in scripts. Use -l (or --list) to print one device per line with no tree characters:

Terminal
lsblk -l

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
sda1 8:1 0 512M 0 part /boot/efi
sda2 8:2 0 16G 0 part [SWAP]
sda3 8:3 0 449.3G 0 part /

If your terminal does not render Unicode box-drawing characters correctly, swap them for plain ASCII with -i (or --ascii).

Machine-Readable Output

For scripts, the -J (or --json) flag prints the same information as structured JSON that is easy to parse with tools such as jq:

Terminal
lsblk -J -o NAME,SIZE,FSTYPE /dev/sda

output

{
"blockdevices": [
{
"name": "sda",
"size": "465.8G",
"fstype": null,
"children": [
{
"name": "sda1",
"size": "512M",
"fstype": "vfat"
},
{
"name": "sda2",
"size": "16G",
"fstype": "swap"
},
{
"name": "sda3",
"size": "449.3G",
"fstype": "ext4"
}
]
}
]
}

Each disk becomes an object, and its partitions appear in the children array, so the tree relationship survives the conversion. Fields that do not apply are null rather than empty strings, which keeps the types stable for jq.

You can also use -P (pairs) for line-oriented KEY="value" output, or -r (raw) for space-separated fields with no padding.

The default columns can change between util-linux releases. In scripts, always select the columns you expect with -o, then choose a predictable format such as -J, -P, or -l.

For example, to list only mounted ext4 partitions in a script:

Terminal
lsblk -lnp -o NAME,FSTYPE,MOUNTPOINTS | awk '$2 == "ext4" && $3 != "" {print $1, $3}'

The -n (or --noheadings) flag drops the header row so that the output is pure data.

Show Sizes in Bytes

Sizes are printed in human-readable units by default, for example 465.8G. For exact values, use -b (or --bytes):

Terminal
lsblk -b -o NAME,SIZE

This is the form you want when comparing sizes in a script, since 465.8G is not directly comparable with 449.3G as a string.

Quick Reference

Common lsblk flags and what they do:

-a - Include empty devices and RAM disks that are normally hidden.
-b - Print sizes in bytes instead of human-readable units.
-d - Hide partitions, holders, and slaves.
-e LIST - Exclude devices by major number (7 is loop).
-f - Show filesystem information (type, label, UUID, usage).
-i - Use plain ASCII characters for the tree instead of Unicode.
-J - Output as JSON.
-l - Use a flat list instead of the tree layout.
-n - Omit the header row.
-o LIST - Choose which columns to display.
-o +LIST - Add columns to the default output.
-O - Display every available column.
-p - Print full device paths such as /dev/sda1.
-P - Output as KEY="value" pairs for shell scripts.
-r - Raw output with no padding.
-S - Show information about SCSI devices only.
-t - Print topology information (alignment, I/O sizes).

FAQ

How is lsblk different from fdisk -l?
lsblk reads from sysfs and udev and shows a tree of devices with mount points and filesystem details, all without root privileges for the common cases. fdisk -l reads the partition table directly from the device and focuses on partition layout, sector offsets, and disk identifiers. Use lsblk for a quick overview and fdisk when you care about the raw partition table.

Why is a device missing from lsblk output?
Run lsblk -a to include empty devices and RAM disks that are normally hidden. If you just connected or changed a device, run udevadm settle before trying lsblk again so udev can finish processing the event. A drive that the kernel never detected cannot appear in the list; check the cable or port and inspect recent messages with sudo dmesg | tail -n 30.

How can I get only the UUID of a partition?
Combine -n to drop the header, -o UUID to pick the column, and the device path:
lsblk -no UUID /dev/sda3.

Does lsblk show LVM and encrypted volumes?
Yes. LVM logical volumes appear as children of their physical volume with type lvm, and LUKS-encrypted containers show as crypt. The tree layout makes the stacking relationship easy to follow.

Can lsblk show disk model or serial number?
Yes. Add them to the output list: lsblk -o NAME,MODEL,SERIAL,SIZE. Some virtual devices do not expose these fields, so they may be empty.

Conclusion

lsblk is the fastest way to answer the “what disks and partitions does this machine have?” question, and its JSON and column-selection options make it equally useful inside scripts. Pair it with df for usage stats and with mount when you are ready to attach a new device.

How to Tail and Filter Logs in Real Time on Linux

hello@linuxize.com (Linuxize) — Tue, 11 Aug 2026 09:30:00 +0200

When you reproduce a bug or restart a service, the most useful view is often the log scrolling live as it happens. You want to see each new line when it is written, but you may also need to hide routine entries so the warning or error that matters does not disappear in the noise.

Linux provides several ways to follow logs. Use tail -F for a plain log file, less +F when you need to pause and search, and journalctl -f for output stored in the systemd journal. This guide shows how to use each tool and filter the live stream.

Quick Reference

For printable quick references, see the tail , grep , less , and journalctl cheatsheets.

Task	Command
Follow a file	`tail -f /var/log/app.log`
Follow and survive rotation	`tail -F /var/log/app.log`
Follow only newly appended lines	`tail -n 0 -F /var/log/app.log`
Show last N lines, then follow	`tail -n 100 -f /var/log/app.log`
Follow several files at once	`tail -F /var/log/a.log /var/log/b.log`
Follow, scroll, search, and filter	`less +F /var/log/app.log`
Follow a systemd unit	`journalctl -f -u nginx`
Follow errors and more severe entries	`journalctl -f -p err`
Filter file logs by text	`tail -F app.log \| grep -i error`
Filter journal messages by text	`journalctl -f -u nginx -g 'timeout\|failed'`

Follow a File with tail -f

The tail command prints the end of a file, and the -f (--follow) option keeps reading as new data is appended. This is the quickest way to watch a plain-text log:

Terminal
tail -f /var/log/nginx/access.log

The terminal shows the last 10 lines and then waits, adding each new request as it arrives. Press Ctrl+C to stop. To start with more context, specify the number of existing lines to show:

Terminal
tail -n 100 -f /var/log/nginx/access.log

If you want to ignore existing entries and display only lines appended after the command starts, set the initial line count to zero:

Terminal
tail -n 0 -f /var/log/nginx/access.log

One catch is log rotation. Plain -f follows the open file descriptor, so it can keep watching the old file after that file is renamed. On GNU tail, -F is equivalent to --follow=name --retry: it watches the path and keeps trying to reopen the file when it is replaced or temporarily unavailable.

Terminal
tail -F /var/log/nginx/access.log

You can also watch more than one file in the same session. Pass several paths, and tail prints a ==> path <== header each time the output switches to a different file:

Terminal
tail -F /var/log/nginx/access.log /var/log/nginx/error.log

Those headers tell you which file produced the lines that follow, which matters when two logs use a similar format.

Use -F for a long-running session on a rotating log. The tail command guide covers line counts, byte offsets, and other follow options.

Filter a Live Stream with grep

Pipe the followed output into grep to keep only matching lines. The following command ignores case, so it matches error, ERROR, and other capitalization variants:

Terminal
tail -F /var/log/app.log | grep -i error

In this two-command pipeline, grep writes directly to the terminal and normally displays each match immediately. If you send its output into another command, GNU grep switches to full buffering. Add --line-buffered before the next pipeline stage so matches continue moving one line at a time:

Terminal
tail -F /var/log/app.log | grep --line-buffered -i error | awk '{ print $1, $2, $NF }'

Here, grep flushes each match to awk, which prints the first two and last whitespace-separated fields. A later command can still have its own buffering rules, so check each stage if output remains delayed.

Use extended regular expressions to match several severity words in one pass:

Terminal
tail -F /var/log/app.log | grep -Ei 'error|warning|critical'

To hide a noisy health-check endpoint while keeping all other requests, invert the match with -v:

Terminal
tail -F /var/log/nginx/access.log | grep -v '/health'

The grep command guide covers fixed strings, regular expressions, and inverted matches in more detail.

Scroll and Search with less +F

tail -f shows new lines but does not let you inspect earlier entries without stopping the command. The less pager has its own follow mode and lets you switch between live output and normal navigation:

Terminal
less +F /var/log/app.log

Press Ctrl+C to pause following. You can then scroll with the arrow keys or search forward by typing /pattern and pressing Enter.

To hide nonmatching lines, type &pattern and press Enter. Enter & followed by Enter to clear the filter. Press uppercase F to return to follow mode; any active filter remains in effect while new lines arrive. The less command guide covers navigation, searches, and display options.

Follow a Service with journalctl -f

On a systemd system, service output captured by systemd-journald is read with journalctl. Use -f to follow new journal entries and -u to limit them to one unit:

Terminal
journalctl -f -u nginx

This follows entries associated with the nginx unit, including service lifecycle messages and output sent to the journal. Applications can also write dedicated files. If Nginx access requests are stored in /var/log/nginx/access.log, follow that file with tail -F instead.

Because journal entries contain structured fields, you can filter by priority. A single priority includes that level and all more severe levels, so err shows err, crit, alert, and emerg entries:

Terminal
journalctl -f -u nginx -p err

Use -g (--grep) to match a regular expression against the MESSAGE field while following:

Terminal
journalctl -f -u nginx -g 'timeout|failed'

To follow warnings and more severe entries from the current boot across all accessible units, combine -f, -p, and -b:

Terminal
journalctl -f -b -p warning

The journalctl command guide covers time ranges, boot selection, unit filters, and journal fields.

Which Tool to Use

The log destination determines the first choice. Use tail -F for a rotating plain-text file, then pipe it through grep when you need text filtering. Use less +F when you expect to pause, scroll backward, search, or interactively hide nonmatching lines. Use journalctl -f when the messages are stored in the systemd journal and you want to filter by unit, priority, boot, or message text.

Troubleshooting

Permission denied when opening a log
Check the file permissions with ls -l /path/to/log. Run sudo tail -F /path/to/log only if your account is authorized to read that log. For the system journal, administrators can use sudo journalctl, while many distributions also grant journal access through groups such as adm or systemd-journal.

No new lines appear
Confirm that the application is still appending to the path you opened. If the file was rotated or recreated, restart with tail -F. Also remember that tail follows appended data; it does not report text rewritten in place earlier in the file.

journalctl -p err misses a message containing ERROR
The -p option checks the structured PRIORITY field, not words inside the message. If an application logs the word ERROR without assigning an error priority, use a text filter such as journalctl -f -u SERVICE -g 'error'.

Conclusion

Start with the unfiltered stream to confirm that you have the correct source, then add one filter at a time so you do not hide the event you are trying to diagnose. When a filter proves useful more than once, save it as a shell alias or a short script so the next incident starts from a view you already trust.

Regular Expressions Explained: How Regex Patterns Work

hello@linuxize.com (Linuxize) — Mon, 03 Aug 2026 10:10:00 +0200

Sooner or later every command line session runs into a matching problem that plain text search cannot solve: find lines that start with a number, pull every email address out of a log, or replace dates in one format with another. Regular expressions (regex) are the pattern language that solves these problems, and the same core syntax works in grep, sed, awk, text editors, and most programming languages.

This guide explains the building blocks of regular expressions, anchors, character classes, quantifiers, grouping, and alternation, and shows how the same pattern carries from grep to sed and awk.

What a Regular Expression Is

A regular expression is a pattern that describes a set of strings. Instead of matching one literal word, a pattern like ^error [0-9]+ matches any line that starts with “error” followed by a space and one or more digits.

The examples in this guide use GNU grep -E (extended regular expressions), so every pattern works as written. You can test any of them by piping text into grep :

Terminal
echo "error 404" | grep -E '^error [0-9]+'

output

error 404

The line prints because it matches the pattern. When there is no match, grep prints nothing and returns a non-zero exit status. Always single-quote the pattern so the shell does not interpret characters like $ and * before grep sees them.

Literal Characters and Metacharacters

Most characters in a regex match themselves: the pattern cat matches the string “cat” anywhere in a line, including inside “concatenate”. A handful of characters have special meanings instead of matching literally:

txt
. ^ $ * + ? ( ) [ ] { } | \

These are the metacharacters, and the rest of this guide is about what they do. To match one of them literally, escape it with a backslash: \. matches a real dot, \$ a real dollar sign.

Anchors and Word Boundaries

Anchors and word boundaries do not match characters; they match positions in the line.

^ - Matches the start of the line.
$ - Matches the end of the line.
\b - Matches a word boundary, the position between a word character and a non-word character.

The \b boundary is a GNU grep extension rather than part of POSIX extended regular expression syntax.

The difference is easiest to see on real input. The following input contains three similar lines, but the pattern prints only the line that consists of exactly the word “root”:

Terminal
printf 'root\nroot:x:0:0\nchroot\n' | grep -E '^root$'

output

root

Without anchors, the pattern root would also match “chroot” or a line where “root” appears in the middle. Word boundaries solve the substring problem without pinning the match to the whole line:

Terminal
echo "the cat scattered" | grep -E -o '\bcat\b'

output

cat

The -o flag prints only the matched text. Notice that “scattered” did not produce a match, because “cat” inside it is not surrounded by word boundaries.

Character Classes: Matching Sets

Square brackets match one character from a set:

[abc] - One character: a, b, or c.
[a-z] - One lowercase letter; ranges also work for [0-9] and [A-Z].
[^abc] - Negation: one character that is NOT a, b, or c.

For example, to match “gray” and “grey” with one pattern:

Terminal
printf 'gray\ngrey\ngroy\n' | grep -E 'gr[ae]y'

output

gray
grey

The third line does not match because “o” is not in the set. Inside brackets, most metacharacters lose their special meaning; [.] matches a literal dot.

POSIX character classes are named shortcuts that work inside brackets: [[:digit:]] is equivalent to [0-9], [[:alpha:]] matches letters, [[:space:]] matches whitespace. Many tools also support the Perl-style shorthands \d wherever PCRE is available (grep -P), but the bracket forms are the portable choice for shell work.

The Dot and Quantifiers: Matching Repetition

The dot . matches any single character except a newline. Quantifiers apply to the preceding item and control how many times it may repeat:

* - Zero or more times.
+ - One or more times.
? - Zero or one time (optional).
{n} - Exactly n times.
{n,m} - Between n and m times.

Combining the dot with a quantifier gives .*, which matches anything, including nothing. A more precise example matches an IPv4-looking address by requiring one to three digits in each group:

Terminal
echo "server at 192.168.1.10 is up" | grep -E -o '[0-9]{1,3}(\.[0-9]{1,3}){3}'

output

192.168.1.10

Reading it piece by piece: [0-9]{1,3} matches the first number group, \. matches a literal dot, and the parentheses with {3} repeat the dot-plus-number sequence three times.

A common beginner mistake is reaching for * when + is meant. The pattern [0-9]* happily matches an empty string, so it succeeds on every line; [0-9]+ actually requires a digit.

Grouping and Alternation

Parentheses group parts of a pattern, and the pipe | provides alternation (OR):

Terminal
printf 'error: disk full\nwarning: low memory\ninfo: started\n' | grep -E '^(error|warning):'

output

error: disk full
warning: low memory

The group limits the alternation to the two words before the colon; without parentheses, ^error|warning: would mean “starts with error, OR contains warning: anywhere”, which is rarely what you want.

Groups also capture what they match, and the captured text can be reused. In sed , \1 refers to the first group, which makes reordering text possible:

Terminal
echo "2026-01-15" | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3.\2.\1/'

output

15.01.2026

The three groups capture the year, month, and day, and the replacement writes them back in reverse order.

Basic vs Extended Regular Expressions

POSIX defines two regex dialects, and the difference trips up almost everyone at some point. In basic regular expressions (BRE), which plain grep and sed use, the characters +, ?, |, {}, and () match literally, and you must escape them (\+, $ … $) to get the special behavior. In extended regular expressions (ERE), they are special by default.

Construct	ERE (`grep -E`, `sed -E`, `awk`)	BRE (plain `grep`, `sed`)
One or more	`+`	`\+`
Optional	`?`	`\?`
Repetition	`{n,m}`	`\{n,m\}`
Grouping	`(...)`	`$...$`
Alternation	`a\|b`	`a\\|b`, GNU extension only

That last row is the one to watch. Alternation is not part of POSIX BRE at all, so \| works in GNU grep and GNU sed but fails silently on the BSD sed that ships with macOS.

In practice, the simplest rule is: pass -E to grep and sed and write in the extended dialect, as every example in this guide does. awk uses extended syntax natively:

Terminal
printf 'alice 92\nbob 47\ncarol 78\n' | awk '/^[ab]/ {print $1}'

output

alice
bob

The awk pattern selects lines starting with “a” or “b” and prints the first field. grep -P enables a third dialect, Perl-compatible regular expressions (PCRE), which adds features like \d and lookarounds; reach for it when the POSIX dialects run out.

One Pattern, Three Tools

The syntax is shared, but each tool wraps it differently, which is the part that usually causes confusion when moving a working pattern from one command to another. Create a small log file to follow along:

Terminal
printf 'error: disk full\nwarning: low memory\ninfo: started\n' > app.log

Because grep is a filter, the pattern is the whole job and needs nothing around it:

Terminal
grep -E '^(error|warning):' app.log

sed prints every input line unless you suppress that with -n, so selecting lines takes an address followed by an explicit p command:

Terminal
sed -E -n '/^(error|warning):/p' app.log

awk reads a bare pattern with no action block as “print the matching line”:

Terminal
awk '/^(error|warning):/' app.log

output

error: disk full
warning: low memory

All three print the same two lines and skip the “info” line. Where the tools part company is what happens after the match. grep reports lines and stops there, sed can rewrite the matched text, and awk splits each matching line into fields you can work with:

Terminal
awk -F': ' '/^(error|warning):/ {print $2}' app.log

output

disk full
low memory

Setting the field separator to ': ' makes $2 the message text, so the pattern selects the lines and the action block pulls out the part you actually wanted. This is why it pays to learn regex once as its own subject: the pattern you write today for grep is the same pattern you will paste into sed, awk, a text editor, or a Python script tomorrow.

Quick Reference

For a printable quick reference, see the Regex cheatsheet .

Pattern	Matches
`.`	Any single character
`^` / `$`	Start / end of line
`\b`	Word boundary in GNU grep
`[abc]` / `[^abc]`	One of the set / one not in the set
`[0-9]`, `[[:digit:]]`	One digit
`*` / `+` / `?`	Zero or more / one or more / optional
`{n,m}`	Between n and m repetitions
`(foo\|bar)`	foo or bar
`\1`	Text captured by the first group
`\.`	Literal dot (escaped metacharacter)

Conclusion

Anchors, character classes, quantifiers, and groups combine into patterns that handle most day-to-day matching on Linux, and the same vocabulary carries over to editors and programming languages. To put the syntax to work in specific tools, see our guides to regular expressions in grep and find and replace with sed .

git worktree: Work on Multiple Branches at Once

hello@linuxize.com (Linuxize) — Sun, 02 Aug 2026 09:20:00 +0200

A common frustration when working with Git is needing to switch branches while your current working tree has uncommitted changes. You can stash the changes , switch branches, make the fix, switch back, and restore the stash, but that flow interrupts your work and can create conflicts. git worktree lets you check out another branch in a separate directory, so both workspaces remain available at the same time.

This guide explains how to create, list, lock, prune, and remove linked worktrees, with a hotfix workflow you can copy.

How git worktree Works

A Git repository normally has one working tree: the directory where you edit files. With git worktree, you can attach additional working trees to the same repository. Each linked worktree has its own working directory, index, and HEAD, while all worktrees share the same object store and repository history. You do not create another clone; you create another workspace for the same repository.

git worktree Syntax

The most-used forms of the command are:

txt
git worktree add [OPTIONS] <path> [<commit-ish>]
git worktree list [OPTIONS]
git worktree remove [--force] <worktree>
git worktree prune [OPTIONS]
git worktree lock [--reason <string>] <worktree>
git worktree unlock <worktree>

Add a Worktree for an Existing Branch

Suppose you are working on a feature branch and want a separate checkout of main. Add it in a sibling directory without leaving your current branch:

Terminal
git worktree add ../project-main main

output

Preparing worktree (checking out 'main')
HEAD is now at a1b2c3d Fix typo in README

The new directory ../project-main contains main, while your original working tree stays on the feature branch. Git refuses this command if main is already checked out in another worktree.

Add a Worktree with a New Branch

For a hotfix, create a new branch from main and check it out in one step:

Terminal
git worktree add -b hotfix/payment-null ../project-hotfix main

output

Preparing worktree (new branch 'hotfix/payment-null')
HEAD is now at a1b2c3d Fix typo in README

The -b flag creates hotfix/payment-null from main and checks it out in the new directory. After making the fix and running your tests, commit and push from that worktree:

Terminal
cd ../project-hotfix
# Edit the files and run your tests
git add .
git commit -m "Fix payment handler"
git push -u origin hotfix/payment-null

Your original directory remains on the feature branch throughout this workflow.

List All Worktrees

To display the main worktree and every linked worktree, run:

Terminal
git worktree list

output

/home/user/project abc1234 [feature/new-dashboard]
/home/user/project-hotfix def5678 [hotfix/payment-null]
/home/user/project-main a1b2c3d [main]

The first entry is always the main worktree. Each linked worktree shows its path, current commit, and checked-out branch.

Run Tests Across Branches in Parallel

Worktrees are useful for running a test suite against two commits at the same time. For a temporary test directory that does not need its own branch, create a detached worktree:

Terminal
git worktree add --detach ../project-test main
(cd ../project-test && npm ci && npm test) &
npm test &
wait

The first background job installs dependencies and runs the tests against main in ../project-test, while the second runs in your current worktree. Both worktrees share the Git object store but keep their working files and installed dependencies separate.

Remove a Worktree

When you are done with a linked worktree, remove it:

Terminal
git worktree remove ../project-hotfix

This deletes the linked directory and unregisters it from the repository. It does not delete the hotfix/payment-null branch.

Git refuses to remove a worktree with modified or untracked files. Check its status before deciding whether to force removal:

Terminal
git -C ../project-hotfix status

Warning

The --force option deletes the linked directory even when it contains modified or untracked files. Commit or copy anything you need before running it.

If you are certain that the remaining files are disposable, force the removal with:

Terminal
git worktree remove --force ../project-hotfix

Prune Stale Worktree References

If you delete a worktree directory manually, Git retains its administrative entry. Preview the stale entries that qualify for removal with:

Terminal
git worktree prune --dry-run --verbose

After reviewing the output, remove those entries with:

Terminal
git worktree prune --verbose

This command removes stale metadata, not active worktree directories. git gc also prunes missing entries older than the configured gc.worktreePruneExpire period, which defaults to three months.

Lock a Worktree

If a worktree lives on a removable drive or a network path that may be temporarily unavailable, lock it so prune does not remove it:

Terminal
git worktree lock --reason "on external drive" ../project-hotfix

Unlock it when the path is available again:

Terminal
git worktree unlock ../project-hotfix

A lock also protects the worktree from git worktree remove, and a single --force is not enough to override it:

output

fatal: cannot remove a locked working tree, lock reason: on external drive
use 'remove -f -f' to override or unlock first

Unlock the worktree first, or pass the force option twice:

Terminal
git worktree remove --force --force ../project-hotfix

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git worktree add ../path branch`	Check out an existing branch in a linked worktree
`git worktree add -b new-branch ../path main`	Create a new branch from `main` in a linked worktree
`git worktree add --detach ../path main`	Create a detached worktree for testing
`git worktree list`	List the main and linked worktrees
`git worktree lock --reason "text" ../path`	Protect a temporarily unavailable worktree from pruning
`git worktree remove ../path`	Delete and unregister a clean linked worktree
`git worktree prune --dry-run --verbose`	Preview stale administrative entries
`git worktree repair /new/path`	Repair the link to a manually moved worktree

Troubleshooting

Git reports that a branch is already checked out
A branch can normally be checked out in only one worktree. Create a new branch from it instead:

Terminal
git worktree add -b new-branch ../project-new main

If you only need the files for testing and do not plan to commit, use a detached worktree:

Terminal
git worktree add --detach ../project-test main

Git cannot find a manually moved worktree
If you moved a linked directory without git worktree move, repair its administrative link from another worktree:

Terminal
git worktree repair /new/path

Use the new location as the argument. Git reconnects the linked directory without checking it out again.

Conclusion

git worktree keeps parallel tasks isolated without creating another clone or disturbing your current files. Create a dedicated branch for changes, use detached worktrees for temporary tests, and see the git branch guide when you need to rename, inspect, or delete the branches afterward.

killall Command in Linux: Kill Processes by Name

hello@linuxize.com (Linuxize) — Sat, 01 Aug 2026 08:40:00 +0200

When a program misbehaves, it may leave several processes running. Modern browsers start separate worker processes, and a stuck script may have been launched several times in different terminals. Killing each one with the kill command means looking up every PID first. The killall command skips that step: you give it a process name, and it signals every process running under that name.

This guide explains how to use killall to terminate processes by name, choose the signal to send, and narrow matches by user, age, or pattern.

Installing killall

killall is part of the psmisc package, which is preinstalled on most desktop and server distributions. If the command is missing, install it from the standard repositories.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install psmisc

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install psmisc

Warning

On Linux, the psmisc version of killall affects only processes matching the given name. On some other Unix systems, such as Solaris and AIX, killall signals nearly every process on the machine, which is how those systems tear things down at shutdown. Confirm which implementation is installed before running killall on a remote system, especially as root.

killall Syntax

The general syntax of the killall command is as follows:

txt
killall [OPTIONS] NAME...

NAME is the process name to match. You can pass more than one name, and killall signals every process that matches any of them. Unlike pkill, which matches partial names, killall requires the name to match exactly.

killall exits with status zero when it successfully signals at least one process for every name you supplied. If a name does not match, it prints a message and returns a non-zero status:

Terminal
killall firefox

output

firefox: no process found

Killing a Process by Name

To terminate a process, pass its exact name:

Terminal
killall firefox

By default, killall sends the SIGTERM signal, which asks each matching process to shut down cleanly. The command produces no output when it succeeds. Add -v to confirm what was signalled:

Terminal
killall -v vlc

output

Killed vlc(8143) with signal 15

The output shows the process name, its PID, and the signal number. Signal 15 is SIGTERM.

Before sending a signal, use pgrep to preview exact matches and their full command lines:

Terminal
pgrep -a -x firefox

If this command prints nothing, check ps -e -o pid,comm to find the process name that Linux reports.

Sending a Specific Signal

When a process ignores SIGTERM, you can send a stronger signal. The -s option accepts a signal name or number:

Terminal
killall -s KILL myscript

SIGKILL cannot be caught or ignored, so the process is terminated immediately without a chance to clean up. The same signal can be written in two shorter forms:

Terminal
killall -9 myscript
killall -SIGKILL myscript

Use SIGKILL only after a plain killall has failed. A process killed this way cannot flush buffers or remove its temporary files, which is why trying SIGTERM first is the safer habit. For a longer discussion of signals and when to use each, see our guide on how to kill a process in Linux .

Signals are also useful for more than termination. For example, BIND reloads its configuration when the named process receives SIGHUP:

Terminal
sudo killall -s HUP named

To list all signal names that killall understands, use -l:

Terminal
killall -l

output

HUP INT QUIT ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT
CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH POLL PWR SYS

Matching Names Case-Insensitively

Process name matching is case-sensitive by default. If you are not sure about the capitalization, add -I:

Terminal
killall -I "teamviewer"

This matches TeamViewer, teamviewer, and any other case variant of the name.

Matching with Regular Expressions

The -r option interprets the name as an extended regular expression, so you can signal several related processes at once:

Terminal
killall -r '^chrom.*'

The ^ anchor limits the match to names that begin with chrom, such as chrome and chromium. Quote the pattern so the shell does not interpret special characters before killall sees them.

Killing Processes Owned by a User

The -u option restricts matches to processes owned by a specific user:

Terminal
killall -u sarah node

This terminates only the node processes running under the sarah account, leaving other users’ node processes alone.

If you pass -u without a process name, killall signals every process the user owns:

Terminal
sudo killall -u sarah

Be careful with this form. It terminates the user’s entire session, including their shell and any editors with unsaved work. Combine it with -i when you want to review each process first.

Confirming Each Kill Interactively

The -i option asks for confirmation before signalling each matching process:

Terminal
killall -i node

output

Kill node(2211) ? (y/N)
Kill node(2384) ? (y/N)

Answer y to signal a process or press Enter to skip it. Interactive mode is a good safety net when a name is common enough to match processes you did not have in mind.

Filtering by Process Age

The -o (older) and -y (younger) options filter matches by how long a process has been running. The time is a whole number followed by a unit: s for seconds, m for minutes, h for hours, d for days, w for weeks, M for months, and y for years.

To kill myscript processes that have been running for more than an hour:

Terminal
killall -o 1h myscript

To kill only instances started within the last ten minutes:

Terminal
killall -y 10m myscript

The age filters are handy for cleaning up stuck workers or runaway cron jobs while leaving fresh, healthy instances running.

Waiting for Processes to Die

By default, killall sends the signal and returns immediately. The -w option makes it wait until all signalled processes have actually terminated:

Terminal
killall -w myscript && echo "all stopped"

This is useful in scripts that must not continue until a service is fully down. The wait can continue forever if the signal is ignored, has no effect, or leaves the process in a zombie state.

To put a ten-second limit on the wait, run killall through the timeout command :

Terminal
timeout 10s killall -w myscript

If the limit expires, timeout stops the killall command, but the target process may still be running. Inspect it with pgrep before deciding whether to send SIGKILL. A process that remains in a zombie state can also cause killall -w to keep waiting.

killall vs kill vs pkill

All three commands send signals; they differ in how you select the target processes:

kill targets a specific PID. It is the most precise option, but you have to look the PID up first.
killall targets an exact process name and signals every instance of it.
pkill targets a name pattern, so pkill fire matches firefox. It can also match against the full command line with -f.

The exact-name behavior of killall makes it more predictable than pkill for everyday use: killall node cannot accidentally match node_exporter. Linux limits the process name stored in /proc/PID/stat to 15 characters. For longer names, killall may have to fall back to those first 15 characters when the full name is unavailable. Add -e to skip a long-name match that cannot be verified exactly.

Common Options

-s SIGNAL - Send the given signal instead of SIGTERM. Also accepts the -SIGNAL and numeric forms.
-l - List known signal names.
-v - Report each signal that was successfully sent.
-q - Do not complain when no process matched.
-I - Match process names case-insensitively.
-r - Interpret the name as an extended regular expression.
-e - Require an exact match for names longer than 15 characters.
-u USER - Match only processes owned by the given user.
-i - Ask for confirmation before signalling each process.
-o TIME - Match only processes older than the given age.
-y TIME - Match only processes younger than the given age.
-w - Wait until all signalled processes have died.

Quick Reference

For a printable quick reference, see the kill cheatsheet .

Task	Command
Terminate all processes with a name	`killall firefox`
Force kill after a failed terminate	`killall -9 firefox`
Reload BIND’s configuration	`sudo killall -s HUP named`
Ignore name capitalization	`killall -I teamviewer`
Match names by regex	`killall -r '^chrom.*'`
Kill a user’s instances of a program	`killall -u sarah node`
Kill all of a user’s processes	`sudo killall -u sarah`
Confirm each kill	`killall -i node`
Kill instances older than one hour	`killall -o 1h myscript`
Wait until processes exit	`killall -w myscript`
List signal names	`killall -l`

Troubleshooting

killall: no process found
killall requires the process name to match exactly unless you use -r or -I. Run pgrep -a pattern or ps -e -o pid,comm to check the reported name, capitalization, and command line before trying again.

Operation not permitted
You can signal your own processes, but another user’s process normally requires root privileges. Verify the exact target first, then rerun the command with sudo only when needed.

killall -w does not return
The process may have ignored the signal, stayed in a zombie state, or been replaced by a new process with the same PID while killall was checking it. Stop waiting with Ctrl+C, inspect the target with pgrep -a -x NAME, and use SIGKILL only if the process is still running and cannot shut down cleanly.

Conclusion

killall terminates every instance of a program in one command, with filters for user, age, and case when the name alone is too broad. When you need pattern matching instead of exact names, reach for pkill , and when you need to inspect processes before killing them, start with pgrep .

AWS CLI Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 31 Jul 2026 13:35:00 +0200

Installation and Setup

Install AWS CLI version 2 and set the basic configuration. Full walkthrough in installing and configuring the AWS CLI on Linux .

Command	Description
`curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip`	Download the x86_64 installer
`curl https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip -o awscliv2.zip`	Download the ARM64 installer
`unzip awscliv2.zip`	Extract the installer
`sudo ./aws/install`	Install AWS CLI version 2
`sudo ./aws/install --update`	Update from a freshly extracted installer
`aws --version`	Show the installed version
`aws configure`	Interactive credential and region setup
`aws configure list`	Show active settings and where they come from
`aws configure get region`	Read a single config value
`aws configure set region eu-central-1`	Write a single config value
`complete -C aws_completer aws`	Enable Bash command completion
`aws ec2 help`	Open the reference for a service

Profiles and Authentication

Static access keys configured with aws configure live in ~/.aws/credentials, while other settings live in ~/.aws/config. Prefer temporary credentials from aws login or IAM Identity Center.

Command	Description
`aws login`	Sign in with AWS console credentials
`aws login --profile dev`	Sign in to a named profile
`aws login --remote`	Sign in from a host without a browser
`aws logout --profile dev`	Clear cached login credentials for a profile
`aws configure --profile dev`	Configure a profile with an access key
`aws s3 ls --profile dev`	Run one command as a profile
`export AWS_PROFILE=dev`	Use a profile for the whole shell
`aws configure list-profiles`	List configured profiles
`aws configure sso`	Set up an IAM Identity Center profile
`aws sso login --profile dev`	Start or refresh an SSO session
`aws sso logout`	Clear cached SSO credentials
`aws sts get-caller-identity`	Show the account and identity in use
`aws sts assume-role --role-arn arn --role-session-name cli`	Get temporary role credentials
`export AWS_REGION=eu-west-1`	Override the region for the shell

Common Options

Frequently used options. Availability depends on the service and operation.

Option	Description
`--region eu-west-1`	Target a specific region
`--profile dev`	Use a named profile
`--output json`	Set the response format
`--no-cli-pager`	Print output instead of opening a pager
`--dry-run`	Check permissions without acting on supported EC2 operations
`--cli-auto-prompt`	Prompt for parameters interactively
`--no-paginate`	Return only the first page from a paginated operation
`--page-size 100`	Set the API page size for a paginated operation
`--max-items 20`	Limit output from a paginated operation
`--cli-input-json file://params.json`	Read parameters for a modeled API operation
`--generate-cli-skeleton`	Print a parameter template for a modeled API operation
`--debug`	Print the full request and response trace

Output Formatting and Queries

The --query option uses JMESPath and runs client side. Service-specific options such as --filters run server side, which can reduce response size and improve response time for large data sets. Pipe --output json into jq when a query gets hard to read.

Command	Description
`aws s3api list-buckets --output table`	Human-readable table
`aws s3api list-buckets --output text`	Tab-delimited text
`aws s3api list-buckets --output yaml`	YAML response
`aws s3api list-buckets --query "Buckets[].Name"`	Return one field
`aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name]" --output text`	Return several fields as columns
`aws ec2 describe-instances --query "Reservations[].Instances[?State.Name=='running'].InstanceId"`	Filter results client side
`aws ec2 describe-instances --filters Name=instance-state-name,Values=running`	Filter results server side
`aws ec2 describe-volumes --query "Volumes[0:5]"`	Slice the result list
`aws ec2 wait instance-running --instance-ids i-0abc123`	Block until a state is reached

S3 Buckets and Objects

Everyday transfers with the high-level aws s3 commands. More examples in aws s3 commands .

Command	Description
`aws s3 ls`	List all buckets
`aws s3 ls s3://bucket --recursive --summarize`	List objects with a size total
`aws s3 cp file.txt s3://bucket/`	Upload a file
`aws s3 cp s3://bucket/file.txt .`	Download a file
`aws s3 cp ./dir s3://bucket/dir --recursive`	Upload a directory
`aws s3 sync ./dir s3://bucket/dir`	Copy only new and changed files
`aws s3 sync ./dir s3://bucket/dir --delete --dryrun`	Preview a mirror that removes stale files
`aws s3 rm s3://bucket/dir/ --recursive --dryrun`	Preview a recursive delete
`aws s3 mb s3://bucket`	Create a bucket
`aws s3 rb s3://bucket`	Remove an empty bucket
`aws s3 presign s3://bucket/file.txt --expires-in 3600`	Generate a temporary download link

EC2 Instances

Launch, inspect, and control instances.

Command	Description
`aws ec2 describe-instances`	List instances and their details
`aws ec2 describe-instances --instance-ids i-0abc123`	Details for one instance
`aws ec2 describe-instance-status`	Health and scheduled events
`aws ec2 run-instances --image-id ami-0abc --instance-type t3.micro --key-name mykey`	Launch an instance
`aws ec2 start-instances --instance-ids i-0abc123`	Start a stopped instance
`aws ec2 stop-instances --instance-ids i-0abc123`	Stop an instance
`aws ec2 reboot-instances --instance-ids i-0abc123`	Reboot an instance
`aws ec2 terminate-instances --instance-ids i-0abc123`	Permanently terminate an instance
`aws ec2 create-tags --resources i-0abc123 --tags Key=Name,Value=web`	Tag a resource
`aws ec2 describe-images --owners 099720109477 --filters "Name=name,Values=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"`	Find official Ubuntu 24.04 AMIs
`aws ec2 get-console-output --instance-id i-0abc123`	Read the instance console log

Security Groups and Key Pairs

Network access and SSH keys for EC2. Private key files are unencrypted, so keep them readable only by your user.

Command	Description
`aws ec2 describe-security-groups`	List security groups
`aws ec2 create-security-group --group-name web --description "Web tier"`	Create a security group
`aws ec2 authorize-security-group-ingress --group-id sg-0abc --protocol tcp --port 22 --cidr 203.0.113.10/32`	Allow inbound traffic
`aws ec2 revoke-security-group-ingress --group-id sg-0abc --protocol tcp --port 22 --cidr 203.0.113.10/32`	Remove an inbound rule
`aws ec2 delete-security-group --group-id sg-0abc`	Delete a security group
`aws ec2 create-key-pair --key-name mykey --query KeyMaterial --output text > mykey.pem`	Create a key pair and save the private key
`chmod 400 mykey.pem`	Restrict private key permissions
`aws ec2 describe-key-pairs`	List key pairs
`aws ec2 delete-key-pair --key-name mykey`	Delete a key pair
`aws ec2 describe-vpcs`	List VPCs
`aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-0abc`	List subnets in a VPC
`aws ec2 allocate-address`	Reserve an elastic IP
`aws ec2 associate-address --instance-id i-0abc123 --allocation-id eipalloc-0abc`	Attach an elastic IP

EBS Volumes and Snapshots

Block storage and backups.

Command	Description
`aws ec2 describe-volumes`	List volumes
`aws ec2 create-volume --size 20 --availability-zone eu-central-1a`	Create a volume
`aws ec2 attach-volume --volume-id vol-0abc --instance-id i-0abc123 --device /dev/sdf`	Attach a volume
`aws ec2 detach-volume --volume-id vol-0abc`	Detach a volume
`aws ec2 delete-volume --volume-id vol-0abc`	Permanently delete a volume
`aws ec2 create-snapshot --volume-id vol-0abc --description "nightly"`	Snapshot a volume
`aws ec2 describe-snapshots --owner-ids self`	List your snapshots
`aws ec2 copy-snapshot --region eu-west-1 --source-region eu-central-1 --source-snapshot-id snap-0abc`	Copy a snapshot from eu-central-1 to eu-west-1
`aws ec2 delete-snapshot --snapshot-id snap-0abc`	Permanently delete a snapshot

IAM Users and Roles

Identities, policies, and access keys. Creating an access key prints its secret once, so store it securely and never commit it to version control.

Command	Description
`aws iam list-users`	List IAM users
`aws iam create-user --user-name dev`	Create a user
`aws iam delete-user --user-name dev`	Permanently delete a user after removing dependencies
`aws iam list-roles`	List roles
`aws iam get-role --role-name deploy`	Show a role and its trust policy
`aws iam attach-user-policy --user-name dev --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess`	Attach a managed policy
`aws iam list-attached-user-policies --user-name dev`	List policies attached to a user
`aws iam create-access-key --user-name dev`	Create an access key
`aws iam list-access-keys --user-name dev`	List access keys and creation dates
`aws iam update-access-key --user-name dev --access-key-id AKIA123 --status Inactive`	Disable a key before deleting it
`aws iam delete-access-key --user-name dev --access-key-id AKIA123`	Permanently delete an access key
`aws iam get-account-summary`	Account-wide IAM counts and limits

Systems Manager and Secrets

Shell access without SSH, plus configuration and secret storage. The start-session command needs the Session Manager plugin installed locally. Pass secret values from protected files so they do not enter shell history, and keep decrypted output out of shared logs.

Command	Description
`aws ssm start-session --target i-0abc123`	Open a shell on an instance
`aws ssm describe-instance-information`	List instances managed by SSM
`aws ssm send-command --instance-ids i-0abc123 --document-name AWS-RunShellScript --parameters commands="uptime"`	Run a command on an instance
`aws ssm get-command-invocation --command-id 1a2b --instance-id i-0abc123`	Read the output of a sent command
`aws ssm put-parameter --name /app/db_url --value file://db-url.txt --type SecureString`	Store an encrypted parameter from a file
`aws ssm get-parameter --name /app/db_url --with-decryption`	Read and decrypt a parameter
`aws ssm get-parameters-by-path --path /app --recursive`	List parameters under a path
`aws secretsmanager list-secrets`	List secrets
`aws secretsmanager get-secret-value --secret-id prod/db --query SecretString --output text`	Print a decrypted secret value
`aws secretsmanager create-secret --name prod/db --secret-string file://secret.json`	Create a secret from a file

CloudWatch Logs and Alarms

Read application and service logs from the terminal.

Command	Description
`aws logs describe-log-groups`	List log groups
`aws logs describe-log-streams --log-group-name /aws/lambda/fn`	List streams in a group
`aws logs tail /aws/lambda/fn --follow`	Stream new log events live
`aws logs tail /aws/lambda/fn --since 1h --format short`	Show the last hour of logs
`aws logs filter-log-events --log-group-name /aws/lambda/fn --filter-pattern ERROR`	Search log events
`aws logs create-log-group --log-group-name /app/web`	Create a log group
`aws logs put-retention-policy --log-group-name /app/web --retention-in-days 30`	Set log retention
`aws logs delete-log-group --log-group-name /app/web`	Permanently delete a log group and its logs
`aws cloudwatch describe-alarms`	List alarms and their state
`aws cloudwatch describe-alarms --state-value ALARM`	Show only firing alarms

Lambda Functions

Deploy and invoke functions. AWS CLI version 2 expects base64 input for blob parameters by default, so literal JSON passed to --payload needs --cli-binary-format raw-in-base64-out.

Command	Description
`aws lambda list-functions`	List functions
`aws lambda get-function --function-name fn`	Show configuration and code location
`aws lambda invoke --function-name fn out.json`	Invoke a function
`aws lambda invoke --function-name fn --cli-binary-format raw-in-base64-out --payload '{"key":"value"}' out.json`	Invoke with a JSON payload
`aws lambda update-function-code --function-name fn --zip-file fileb://fn.zip`	Deploy new code
`aws lambda update-function-configuration --function-name fn --timeout 30`	Change a setting
`aws lambda publish-version --function-name fn`	Publish an immutable version
`aws lambda list-versions-by-function --function-name fn`	List published versions
`aws lambda delete-function --function-name fn`	Permanently delete a function

ECR Container Images

Authenticate Docker against a registry with aws ecr get-login-password --region eu-central-1 piped into docker login --username AWS --password-stdin 123456789012.dkr.ecr.eu-central-1.amazonaws.com. Container commands are in the Docker cheatsheet .

Command	Description
`aws ecr get-login-password --region eu-central-1`	Print a registry password for Docker
`aws ecr describe-repositories`	List repositories
`aws ecr create-repository --repository-name app`	Create a repository
`aws ecr list-images --repository-name app`	List image tags and digests
`aws ecr describe-images --repository-name app`	Show image size and push date
`aws ecr batch-delete-image --repository-name app --image-ids imageTag=old`	Delete an image
`aws ecr delete-repository --repository-name app --force`	Permanently delete a repository and its images

aws s3 Commands: cp, sync, ls, and rm Examples

hello@linuxize.com (Linuxize) — Fri, 31 Jul 2026 10:10:00 +0200

Uploading a file to Amazon S3 through the web console works fine once. The tenth time, or the first time you need to move a whole directory tree, you want it in your shell history instead. The aws s3 command group gives you familiar Unix-style operations for S3: ls to list, cp to copy, sync to mirror directories, and rm to delete.

This guide shows practical examples of the most used aws s3 commands, including recursive copies, include and exclude filters, and safe deletion with --dryrun.

Prerequisites

The examples require AWS CLI version 2 and an identity with permission to access the S3 resources you use. If the CLI is not ready yet, follow our guide on installing and configuring the AWS CLI on Linux .

Confirm that the CLI can authenticate to your account with:

Terminal
aws sts get-caller-identity

If the command prints your account ID and IAM identity, authentication is working. Individual S3 commands can still return AccessDenied when that identity lacks the required bucket or object permissions.

The AWS CLI has two command groups for S3. The aws s3 group used in this guide provides high-level file operations. The aws s3api group exposes the raw API, one call per operation, and is only needed for tasks such as managing bucket policies or object versions.

S3 paths use the form s3://bucket-name/key. The general command structure is:

txt
aws s3 <subcommand> [ARGUMENTS] [OPTIONS]

Commands such as cp, mv, and sync take source and destination arguments. The remaining commands operate on one S3 path, except aws s3 ls, which can omit the path to list every bucket.

Listing Buckets and Objects

Run aws s3 ls with no arguments to list all buckets in the account:

Terminal
aws s3 ls

output

2025-11-04 09:12:33 my-bucket
2026-01-15 17:40:21 my-site-backups

To list the contents of a bucket, pass the bucket path:

Terminal
aws s3 ls s3://my-bucket

output

 PRE logs/
2026-02-10 08:30:12 1048576 backup.tar.gz
2026-02-11 09:02:44 4523 notes.txt

Entries marked PRE are prefixes, the S3 equivalent of directories. To look inside one, append it to the path with a trailing slash, for example aws s3 ls s3://my-bucket/logs/.

Add --recursive to walk the whole bucket, and combine it with --human-readable and --summarize to get readable sizes and totals:

Terminal
aws s3 ls s3://my-bucket --recursive --human-readable --summarize

output

2026-02-10 08:30:12 1.0 MiB backup.tar.gz
2026-02-11 09:02:44 4.4 KiB notes.txt
2026-02-12 06:15:09 12.7 MiB logs/app.log
Total Objects: 3
Total Size: 13.7 MiB

The summary at the bottom shows the count and combined size of the current objects listed under the bucket or prefix. It does not include noncurrent versions in a versioned bucket.

Uploading and Downloading Files with cp

The cp subcommand copies files between your machine and S3, in either direction. To upload a file to a bucket:

Terminal
aws s3 cp backup.tar.gz s3://my-bucket/

output

upload: ./backup.tar.gz to s3://my-bucket/backup.tar.gz

The object keeps its original name. To store it under a different key, spell out the full target path:

Terminal
aws s3 cp backup.tar.gz s3://my-bucket/backups/backup-2026-02-10.tar.gz

Downloading works the same way with the arguments reversed. The . target saves the file into the current directory:

Terminal
aws s3 cp s3://my-bucket/backup.tar.gz .

You can also copy directly between two buckets. The transfer happens inside AWS, so the data does not pass through your machine:

Terminal
aws s3 cp s3://my-bucket/backup.tar.gz s3://my-site-backups/backup.tar.gz

Copying Directories

To copy a directory and everything under it, add --recursive:

Terminal
aws s3 cp ./logs s3://my-bucket/logs --recursive

When you only want some of the files, combine --exclude and --include. The filters are evaluated in the order given, and the later filter wins, so the usual pattern is to exclude everything and then include what you want:

Terminal
aws s3 cp ./logs s3://my-bucket/logs --recursive --exclude "*" --include "*.log"

This uploads only the .log files and skips everything else in the directory.

The most useful cp options:

--recursive - Copy all files under a directory or prefix.
--exclude / --include - Filter files by pattern; later filters override earlier ones.
--storage-class - Choose the destination storage class, for example STANDARD_IA for backups accessed infrequently.
--dryrun - Print what would be copied without transferring anything.

Streaming to and from S3

The cp command accepts - as a stand-in for standard input or output, which lets you pipe data straight to a bucket without a temporary file:

Terminal
pg_dump mydb | gzip | aws s3 cp - s3://my-bucket/backups/mydb.sql.gz

Reading works the same way in reverse. This prints an object to standard output where you can pipe it further:

Terminal
aws s3 cp s3://my-bucket/backups/mydb.sql.gz - | gunzip | head

Moving and Renaming Objects with mv

Amazon S3 does not rename an object in place. The mv command copies the source to the new key and then deletes the source, so preview the operation before running it:

Terminal
aws s3 mv s3://my-bucket/report-draft.pdf s3://my-bucket/report-final.pdf --dryrun

Check both paths carefully, then run the command again without --dryrun. The same command can move files between your machine and S3 or between two buckets.

Synchronizing Directories with sync

Where cp --recursive copies everything every time, sync transfers files that are missing, differ in size, or have a newer source modification time. To mirror a local directory to a bucket:

Terminal
aws s3 sync ./website s3://my-bucket/website

Run it again immediately and nothing is transferred, because both sides already match. This makes sync the right tool for repeated jobs such as publishing a static site or shipping nightly backups.

The reverse direction downloads new and changed objects from the bucket:

Terminal
aws s3 sync s3://my-bucket/website ./website

Syncing between two buckets also works: aws s3 sync s3://my-bucket s3://my-site-backups.

By default, sync never deletes anything. Files removed from the source remain on the target. To make the target an exact mirror, add --delete, but preview the result first because deleted objects are gone for good:

Terminal
aws s3 sync ./website s3://my-bucket/website --delete --dryrun

output

(dryrun) upload: website/index.html to s3://my-bucket/website/index.html
(dryrun) delete: s3://my-bucket/website/old-page.html

Every line is prefixed with (dryrun), so nothing has happened yet. Review the delete: lines, and when the plan looks right, run the same command without --dryrun.

The same --exclude and --include filters from cp apply here. A common one keeps repository metadata out of the bucket:

Terminal
aws s3 sync ./website s3://my-bucket/website --exclude ".git/*"

Because sync is idempotent, it pairs well with a scheduled job. See our guide on scheduling cron jobs with crontab if you want to run a sync every night.

Deleting Objects with rm

To delete a single object, pass its full path:

Terminal
aws s3 rm s3://my-bucket/old-backup.tar.gz

output

delete: s3://my-bucket/old-backup.tar.gz

Warning

There is no trash bin in S3. Unless the bucket has versioning enabled, a deleted object cannot be recovered. Always test recursive deletions with --dryrun first.

To delete everything under a prefix, add --recursive and preview the damage before committing:

Terminal
aws s3 rm s3://my-bucket/logs/ --recursive --dryrun

If the listed objects are the ones you expect, run the command again without --dryrun to perform the deletion.

On buckets with versioning enabled, rm only inserts a delete marker; previous versions remain and continue to incur storage costs. Removing versions permanently requires the aws s3api delete-object call with a version ID.

Creating and Removing Buckets

The mb (make bucket) subcommand creates a new bucket. General purpose bucket names must be unique across AWS accounts and Regions within an AWS partition, so pick something difficult to collide with:

Terminal
aws s3 mb s3://my-unique-bucket-name --region eu-central-1

The rb (remove bucket) subcommand deletes a bucket, but only when it is empty:

Terminal
aws s3 rb s3://my-unique-bucket-name

Adding --force deletes the current objects in an unversioned bucket and then removes the bucket. It does not permanently delete object versions or delete markers, so removal fails when a versioned bucket still contains them. Treat --force with the same caution as rm --recursive.

Generating Temporary Download Links

Sometimes you need to hand a file to someone without making the bucket public. The presign subcommand generates a URL that grants temporary access to a single object:

Terminal
aws s3 presign s3://my-bucket/report.pdf --expires-in 3600

The command prints a long URL that anyone can use to download the object for the next hour (3600 seconds). The default lifetime is one hour, and the maximum is seven days. A URL signed with temporary credentials expires when those credentials expire, even when --expires-in requests a later time.

Quick Reference

For a printable quick reference, see the AWS CLI cheatsheet .

Task	Command
List all buckets	`aws s3 ls`
List bucket contents	`aws s3 ls s3://bucket`
List recursively with totals	`aws s3 ls s3://bucket --recursive --summarize`
Upload a file	`aws s3 cp file.txt s3://bucket/`
Download a file	`aws s3 cp s3://bucket/file.txt .`
Upload a directory	`aws s3 cp ./dir s3://bucket/dir --recursive`
Preview renaming an object	`aws s3 mv s3://bucket/old.txt s3://bucket/new.txt --dryrun`
Mirror a directory	`aws s3 sync ./dir s3://bucket/dir`
Preview removing stale files during a mirror	`aws s3 sync ./dir s3://bucket/dir --delete --dryrun`
Delete an object	`aws s3 rm s3://bucket/file.txt`
Preview deleting a prefix	`aws s3 rm s3://bucket/dir/ --recursive --dryrun`
Create a bucket	`aws s3 mb s3://bucket`
Remove an empty bucket	`aws s3 rb s3://bucket`
Temporary download link	`aws s3 presign s3://bucket/file.txt`

FAQ

What is the difference between cp –recursive and sync?
cp --recursive copies every file on every run. sync compares both sides and transfers only new or changed files, which is faster and cheaper for repeated jobs.

Can I use shell wildcards in S3 paths?
No. The AWS CLI does not interpret Unix-style wildcards in an S3 path such as s3://bucket/*.log. Use --recursive together with --exclude and --include filters instead.

How do I delete all files in a bucket?
For an unversioned bucket, preview aws s3 rm s3://bucket --recursive --dryrun, then remove --dryrun to empty it. The aws s3 rb s3://bucket --force command can empty and remove an unversioned bucket in one step, but it fails when object versions or delete markers remain.

Conclusion

Make --dryrun a habit before mv, recursive rm, or sync --delete, then reuse the reviewed commands in your scripts and scheduled jobs.

How to Install and Configure the AWS CLI on Linux

hello@linuxize.com (Linuxize) — Thu, 30 Jul 2026 09:20:00 +0200

Clicking through the AWS console works for a one-off task, but the moment you manage instances, buckets, or DNS records regularly, you want those actions in your shell history and your scripts. The AWS CLI puts every AWS API behind a single aws command, so listing instances, syncing a bucket, or rotating a key becomes a one-liner you can repeat and automate.

This guide explains how to install AWS CLI version 2 on Linux, authenticate with short-term credentials, manage named profiles, and verify that your setup can access your AWS account.

Installing AWS CLI Version 2

AWS maintains an install script that downloads, verifies, and installs the current AWS CLI release. It detects whether your Linux system uses an x86_64 or ARM processor, so the same command works on both architectures:

Terminal
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash

The script installs the program for your user under ~/.local/share/aws-cli and creates ~/.local/bin/aws. This avoids requiring root access. Open a new terminal after installation, then verify the version:

Terminal
aws --version

The first part of the output should begin with aws-cli/2.. The remaining version and system details depend on the current release and your Linux distribution.

To install the CLI for every user instead, run the installer in system mode:

Terminal
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system

System mode installs the files under /usr/local/aws-cli and creates the command links in /usr/local/bin.

When a newer release is available, update a per-user installation with:

Terminal
aws update

Use sudo aws update if you installed the CLI in system mode.

Configuring AWS CLI Authentication

AWS recommends short-term credentials for people and workloads. The best configuration method depends on how your AWS account manages identities:

Use aws login when you already sign in to the AWS Management Console with an IAM or federated identity.
Use aws configure sso when your organization uses AWS IAM Identity Center.
Use aws configure with an IAM access key only when neither short-term method is available.

Do not configure the CLI with root-user access keys. Use a non-root identity with only the permissions required for your work.

Signing In with AWS Console Credentials

AWS CLI version 2.32.0 and later supports aws login , which exchanges an existing console session for temporary credentials. Your AWS administrator must allow local developer sign-in for the identity. Start the browser-based flow with:

Terminal
aws login

The CLI asks for a default Region if one is not already configured, then opens your browser. Select the console session and identity you want to use. AWS stores the temporary session under ~/.aws/login/cache and refreshes its credentials while the session remains valid.

To create or sign in to a named profile, add --profile:

Terminal
aws login --profile work

On a remote Linux server without a browser, use the cross-device flow:

Terminal
aws login --remote

When the session reaches its maximum duration, run aws login again. You can end it earlier with aws logout.

Configuring IAM Identity Center

If your organization provides an AWS access portal, follow the IAM Identity Center configuration instead of using aws login. Run the setup wizard with a descriptive profile name:

Terminal
aws configure sso --profile work

The wizard asks for the SSO session name, start or issuer URL, SSO Region, account, permission set, default Region, and output format. It opens a browser so you can authorize the session.

Terminal
aws sso login --profile work

IAM Identity Center stores the profile settings in ~/.aws/config and caches its tokens under ~/.aws/sso/cache.

Configuring an IAM Access Key

Some legacy tools and workloads still require a long-term access key. If you cannot use temporary credentials, create the key for a dedicated IAM user with least-privilege permissions, then configure a named profile:

Terminal
aws configure --profile legacy

output

AWS Access Key ID [None]: <your-access-key-id>
AWS Secret Access Key [None]: <your-secret-access-key>
Default region name [None]: eu-central-1
Default output format [None]: json

Choose the Region where most of your resources run. JSON is a practical default output format for scripts, while table is easier to scan interactively.

The CLI writes access keys to ~/.aws/credentials and other settings to ~/.aws/config.

Warning

Never commit access keys, paste them into scripts, or bake them into images. If a key enters Git history or another public location, deactivate it immediately and create a replacement. Prefer temporary credentials whenever the application supports them.

Verifying the Configuration

Ask AWS Security Token Service which identity the CLI resolved:

Terminal
aws sts get-caller-identity

output

{
"UserId": "AROAXAMPLE:dejan",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/Developer/dejan"
}

The response identifies the account, IAM user, or assumed role behind the current credentials. To test a named profile, add it to the command:

Terminal
aws sts get-caller-identity --profile work

If the call succeeds, authentication works. Individual service commands can still fail when the identity lacks permission for that action.

Working with Named Profiles

Profiles keep settings and credentials for separate accounts or roles from interfering with each other. List the profiles currently available:

Terminal
aws configure list-profiles

Select a profile for one command with --profile:

Terminal
aws s3 ls --profile work

To use the same profile for the rest of the shell session, set AWS_PROFILE:

Terminal
export AWS_PROFILE=work

The default profile is used when neither --profile nor AWS_PROFILE is set. A command-line --profile option overrides the environment variable.

On EC2 instances, ECS tasks, and other AWS compute services, attach an IAM role to the workload instead of storing access keys. For CI systems, use the platform’s OpenID Connect integration to assume an IAM role when available.

Running Your First Commands

The CLI follows a aws <service> <operation> pattern. List your S3 buckets:

Terminal
aws s3 ls

output

2025-11-02 14:11:20 backups-prod
2026-01-01 09:48:03 static-assets

List EC2 instances, trimmed down to the fields you care about with --query:

Terminal
aws ec2 describe-instances \
 --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name}' \
 --output table

output

-------------------------------------------------
| DescribeInstances |
+----------------------+-----------+------------+
| ID | Type | State |
+----------------------+-----------+------------+
| i-0abcd1234ef567890 | t3.small | running |
| i-0fe9876543ba21001 | t3.micro | stopped |
+----------------------+-----------+------------+

The --query option takes a JMESPath expression and works on every command, which saves you from piping JSON into other tools for simple filtering. The --output option switches between json, yaml, text, and table per invocation.

Every service has built-in help, so aws s3 help and aws ec2 describe-instances help open the relevant manual pages without leaving the terminal.

Enabling Command Completion

The installer includes aws_completer, which suggests services, operations, and options when you press Tab. Confirm that your shell can find it:

Terminal
command -v aws_completer

The path is usually ~/.local/bin/aws_completer for a per-user installation or /usr/local/bin/aws_completer for a system installation.

For Bash, add this line to ~/.bashrc:

~/.bashrcsh
complete -C "$(command -v aws_completer)" aws

Reload the file:

Terminal
source ~/.bashrc

For Zsh, add these lines to ~/.zshrc:

~/.zshrcsh
autoload bashcompinit && bashcompinit
complete -C "$(command -v aws_completer)" aws

Then reload the Zsh configuration:

Terminal
source ~/.zshrc

Troubleshooting

aws: command not found
For a per-user installation, ~/.local/bin may be missing from PATH. Add export PATH="$HOME/.local/bin:$PATH" to ~/.bashrc or ~/.zshrc, reload the file, and run aws --version again. For a system installation, check that /usr/local/bin is in PATH.

Unable to locate credentials
No authentication method is configured, or AWS_PROFILE points to a profile that does not exist. Run aws configure list to see where the CLI is looking and what it found.

ExpiredToken after aws login
An older access key in ~/.aws/credentials can take precedence over login credentials for the same profile. Run aws configure list, remove the stale key entries for that profile, and sign in again.

An error occurred (InvalidClientTokenId)
For an access-key profile, the key is inactive, deleted, or mistyped. Replace it in IAM and run aws configure --profile <profile-name> again.

An error occurred (UnauthorizedOperation) or AccessDenied
The credentials are valid, but the current identity lacks permission for that action. Ask your AWS administrator to grant the required permission through the relevant role, permission set, or IAM policy.

Could not connect to the endpoint URL
Check the configured Region with aws configure get region. A value such as eu-central1 is invalid; the correct format is eu-central-1.

Conclusion

With AWS CLI version 2 installed and aws sts get-caller-identity returning the expected account, you can start using service commands without storing long-lived credentials. For day-to-day bucket work, see our guide on the aws s3 commands , and if you want those syncs on a schedule, our guide on using cron to schedule jobs .

How to Install Kubernetes with kubeadm on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Wed, 29 Jul 2026 09:40:00 +0200

When you outgrow a single Docker host and need to run containers across several machines with rolling updates, self-healing, and service discovery built in, Kubernetes is the standard answer. The kubeadm tool provides a minimal upstream method for bootstrapping a self-managed cluster on plain Linux servers.

This guide explains how to set up Kubernetes 1.36 on Ubuntu 26.04 using kubeadm, kubelet, and kubectl from the Kubernetes apt repository, with containerd as the container runtime. By the end you will have a control-plane node, one or more worker nodes, and a test workload running across the cluster.

Quick Reference

Task	Command
Disable swap	`sudo swapoff -a`
Install containerd	`sudo apt install -y containerd`
Add Kubernetes apt key	`curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key \| sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg`
Install kube tools	`sudo apt install -y kubelet kubeadm kubectl`
Hold kube versions	`sudo apt-mark hold kubelet kubeadm kubectl`
Init control plane	`sudo kubeadm init --pod-network-cidr=10.244.0.0/16`
Configure kubectl	`mkdir -p ~/.kube && sudo cp /etc/kubernetes/admin.conf ~/.kube/config && sudo chown $(id -u):$(id -g) ~/.kube/config`
Get nodes	`kubectl get nodes`
Get pods (all namespaces)	`kubectl get pods -A`
Generate join command	`sudo kubeadm token create --print-join-command`

Prerequisites

Before starting, make sure you have:

Two or more servers running Ubuntu 26.04 with at least 2 GB of RAM each. The control-plane node needs at least 2 CPUs.
A user with sudo privileges on each server.
Full network connectivity between the nodes and Internet access for downloading packages and container images.
A stable IP address plus a unique hostname, MAC address, and product UUID on every node.

The same instructions apply to control-plane and worker nodes up to the cluster bootstrap step. Run every command on every node unless the section says otherwise.

If a host or cloud firewall filters traffic between the nodes, allow the required traffic between these sources and destination ports:

Destination	Source	Ports
Control plane API	Cluster nodes and administrators	TCP `6443`
etcd on the control plane	Control-plane nodes only	TCP `2379-2380`
Control-plane kubelet	Control-plane components	TCP `10250`
Scheduler and controller manager	Control-plane node itself	TCP `10257` and `10259`
Worker kubelet	Control-plane nodes	TCP `10250`
kube-proxy health endpoint	Node itself and load balancers that use it	TCP `10256`
NodePort services	Clients that need access	TCP and UDP `30000-32767`
Flannel VXLAN	Other cluster nodes	UDP `8472`

Restrict these rules to trusted cluster and administration networks. Do not expose the etcd or kubelet ports directly to the Internet.

Step 1: Prepare the System

The kubelet refuses to start when swap is active unless you configure it to tolerate swap. This guide uses the default behavior, so turn swap off for the current session and comment out swap entries in /etc/fstab:

Terminal
sudo swapoff -a
sudo sed -i '/[[:space:]]swap[[:space:]]/ s/^[^#]/#&/' /etc/fstab

Check that no active swap devices remain:

Terminal
swapon --show

The command should return no output.

Load the kernel modules required by the container runtime and Kubernetes networking:

Terminal
sudo tee /etc/modules-load.d/k8s.conf <<EOF
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

Confirm that both modules are loaded:

Terminal
lsmod | grep -E 'br_netfilter|overlay'

Enable the sysctl settings that allow iptables to see bridged traffic and let IP forwarding work:

Terminal
sudo tee /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

sudo sysctl --system

Verify the two main networking settings:

Terminal
sysctl net.ipv4.ip_forward net.bridge.bridge-nf-call-iptables

Both values should be 1.

Step 2: Install containerd

Kubernetes uses the Container Runtime Interface (CRI) to communicate with a container runtime. Ubuntu 26.04 provides containerd 2.x in its repositories:

Terminal
sudo apt update
sudo apt install -y containerd

If Docker is already installed from the official Docker repository, the containerd.io package provides the same runtime and conflicts with the containerd package. Skip the install above and continue with the configuration below.

Generate a complete containerd configuration, then enable the systemd cgroup driver so it matches the kubelet configuration created by kubeadm:

Terminal
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd
sudo systemctl enable containerd

Confirm that the service is running and the setting is present:

Terminal
systemctl is-active containerd
sudo grep 'SystemdCgroup = true' /etc/containerd/config.toml

The first command should print active, and the second should show the enabled cgroup setting.

Step 3: Add the Kubernetes apt Repository

Kubernetes publishes a separate package repository for every minor release. This guide follows the supported v1.36 series, and apt installs the newest patch release available in that repository.

Install the prerequisites and download the signing key:

Terminal
sudo apt install -y apt-transport-https ca-certificates curl gpg
sudo mkdir -p -m 755 /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

Add the repository:

Terminal
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list

Refresh the package index:

Terminal
sudo apt update

Step 4: Install kubelet, kubeadm, and kubectl

Install the three Kubernetes tools and pin their versions so an apt upgrade does not change them by accident:

Terminal
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

Confirm the install:

Terminal
kubeadm version
kubelet --version
kubectl version --client

The apt-mark hold flag is important because Kubernetes upgrades follow a specific procedure (kubeadm upgrade), and a casual apt upgrade could break the cluster.

The kubelet may restart repeatedly at this point because it does not have a cluster configuration yet. This is expected and stops after kubeadm init or kubeadm join configures the node.

Step 5: Initialize the Control Plane

Run the next two steps only on the control-plane node.

Warning

This procedure creates one control-plane node, so the cluster is not highly available. For production workloads that must survive a control-plane failure, design a multi-control-plane cluster with a load balancer and a shared --control-plane-endpoint before initialization.

Pick a CIDR for the pod network that does not overlap with your host network. The example uses 10.244.0.0/16, which is the default for Flannel. Bootstrap the cluster:

Terminal
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

The command pulls the control-plane container images, generates certificates, writes the kubeconfig files under /etc/kubernetes/, and starts the static pods for the API server, controller manager, scheduler, and etcd. When it finishes you will see a block similar to this:

output

Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.1.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:1234...

Copy the join command somewhere safe. The bootstrap token is a credential that allows a node to authenticate while joining the cluster, so do not publish or share it with untrusted users.

Set up the kubeconfig for your sudo user so kubectl works without root:

Terminal
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

The copied admin.conf grants cluster administrator access. Keep ~/.kube/config private and do not distribute it as a general user credential.

Verify that the API server is reachable:

Terminal
kubectl get nodes

The output lists the control-plane node with a status of NotReady. The status changes to Ready after you install a pod network in the next step.

Step 6: Install a Pod Network

Pods cannot communicate until the cluster has a network plugin. Flannel is one of the simplest options that works with the default 10.244.0.0/16 CIDR:

Terminal
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

Watch the system pods come up:

Terminal
kubectl get pods -n kube-flannel
kubectl get pods -n kube-system
kubectl get nodes

After a minute or so, the Flannel and core system pods should report Running, and the control-plane node should show Ready.

If you prefer Calico, Cilium, or another CNI plugin, install it now instead of Flannel and pass the matching --pod-network-cidr value to kubeadm init.

Step 7: Join Worker Nodes

Run this step on each worker node.

Use the kubeadm join command that was printed at the end of kubeadm init. If you lost it or the token has expired (tokens are valid for 24 hours by default), generate a new one on the control-plane node:

Terminal
sudo kubeadm token create --print-join-command

Then run the printed command on the worker:

Terminal
sudo kubeadm join 192.168.1.10:6443 --token <token> \
 --discovery-token-ca-cert-hash sha256:<hash>

Back on the control-plane node, verify that the new node has joined:

Terminal
kubectl get nodes

The output now lists the worker. It moves from NotReady to Ready once the kubelet finishes its registration and the network plugin reports healthy.

Step 8: Test the Cluster

Deploy a small workload to confirm the cluster schedules pods and that networking is working:

Terminal
kubectl create deployment nginx-test --image=nginx
kubectl expose deployment nginx-test --port=80 --type=NodePort
kubectl rollout status deployment/nginx-test
kubectl get pods,svc

The output shows the nginx-test pod in the Running state and a NodePort service with a port in the 30000-32767 range:

output

NAME READY STATUS RESTARTS AGE
pod/nginx-test-7b7bf6d9b8-8pxnf 1/1 Running 0 25s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/nginx-test NodePort 10.105.10.123 <none> 80:31234/TCP 12s

Open http://<node_ip>:<nodeport> in a browser and you should see the Nginx welcome page. Tear the demo down once you confirm it works:

Terminal
kubectl delete service nginx-test
kubectl delete deployment nginx-test

Troubleshooting

kubeadm init fails with “container runtime is not running”
containerd is not running, or its CRI plugin is disabled. Inspect the service with sudo systemctl status containerd --no-pager and check /etc/containerd/config.toml for a disabled_plugins entry containing cri. Remove cri from that list, confirm that SystemdCgroup = true, and restart the service with sudo systemctl restart containerd.

Nodes stay NotReady after init
The pod network is not installed or the CNI pods are crashing. Run kubectl get pods -n kube-flannel and kubectl logs -n kube-flannel daemonset/kube-flannel-ds --tail=50 to inspect Flannel. Confirm that the --pod-network-cidr passed to kubeadm init matches the CIDR expected by the CNI plugin.

Cgroup driver mismatch warning in kubelet logs
The kubelet uses systemd and the runtime uses cgroupfs, or vice versa. Edit /etc/containerd/config.toml, set SystemdCgroup = true, and restart containerd. Restart the kubelet with sudo systemctl restart kubelet.

The connection to the server localhost:8080 was refused
kubectl is reading the wrong kubeconfig. Run kubectl config view to confirm the current context, and make sure ~/.kube/config exists for the user running the command. On the control-plane node, copy /etc/kubernetes/admin.conf to ~/.kube/config and fix ownership.

Worker join times out
The control-plane host is not reachable from the worker on TCP port 6443, or the token has expired. Confirm the route and firewall rules, then run sudo kubeadm token create --print-join-command on the control plane to generate a fresh join command.

The Nginx NodePort does not respond
The workload can be healthy while a host or cloud firewall blocks the assigned NodePort. Read the port from kubectl get service nginx-test, then allow that TCP port only from the client network that needs access.

FAQ

Do I still need Docker?
No. Kubernetes communicates with container runtimes through the CRI, and containerd is enough for this cluster. Kubernetes 1.24 removed the built-in Docker integration known as dockershim. If you also want to build images on the same host, install Docker as a separate tool. See How to Install Docker on Ubuntu 26.04 for the build environment.

Why is swap disabled?
The kubelet refuses to start by default when it detects active swap. Kubernetes can use swap with an explicit kubelet configuration, but disabling it keeps this installation aligned with the default behavior.

Can I run a single-node cluster on the control plane?
Yes. Remove the control-plane taint with kubectl taint nodes --all node-role.kubernetes.io/control-plane-. After that, the scheduler places workload pods on the control-plane node.

How do I upgrade Kubernetes later?
Follow the kubeadm node upgrade procedure and move through one minor version at a time. The process includes upgrading kubeadm, running kubeadm upgrade plan and kubeadm upgrade apply, then upgrading the kubelet and kubectl. The package holds prevent these components from changing during a routine apt upgrade.

Next Steps

You now have a working Kubernetes cluster on Ubuntu 26.04. From here you can deploy applications with manifests or Helm charts, set up an ingress controller, and add storage classes that match your environment. For a single-node lab on the same host, an alternative is to start with k3s or minikube and migrate to a kubeadm cluster as your needs grow.

update-alternatives Command on Ubuntu and Debian

hello@linuxize.com (Linuxize) — Mon, 27 Jul 2026 09:10:00 +0200

When several installed programs provide the same command, you need a reliable way to choose which one runs by default. Hard-coding paths in scripts or rebuilding symbolic links by hand makes that choice difficult to maintain.

On Ubuntu, Debian, and their derivatives, the update-alternatives command manages these selections through symbolic links in /etc/alternatives. This guide explains how to inspect alternative groups, switch programs interactively or from a script, register new choices, and return a group to automatic mode.

How It Works

update-alternatives maintains link groups. Each group has a generic command name and one or more registered program paths. For example, the java group controls which installed Java runtime /usr/bin/java starts.

The generic command is not linked directly to the selected program. Instead, /usr/bin/java points to /etc/alternatives/java, which points to the active Java binary. You can read our symbolic links guide for more about this two-step link structure.

Each group operates in one of two modes:

Automatic mode selects the registered alternative with the highest priority.
Manual mode keeps the administrator’s selection until it is changed explicitly or becomes invalid.

The command stores its administrative state under /var/lib/dpkg/alternatives.

Syntax

The general command syntax is:

txt
update-alternatives [OPTIONS] COMMAND

Commands that change an alternative group require sudo. Listing and displaying alternatives does not.

List Alternative Groups

To see every master alternative group registered on the system, run:

Terminal
update-alternatives --get-selections

output

awk auto /usr/bin/mawk
editor auto /bin/nano
pager auto /bin/more
vi auto /usr/bin/vim.basic

The second column shows whether the group is in auto or manual mode. The final column contains the selected program path. Your groups and paths will differ according to the packages installed on your system.

To list only the registered paths for one group, pass its name to --list:

Terminal
update-alternatives --list java

output

/usr/lib/jvm/java-17-openjdk-amd64/bin/java
/usr/lib/jvm/java-21-openjdk-amd64/bin/java

This example has Java 17 and Java 21 registered. If the named group does not exist, the command reports that no alternatives are registered for it.

Display an Alternative

To see all registered options for a specific alternative and which one is currently active:

Terminal
update-alternatives --display java

output

java - auto mode
link best version is /usr/lib/jvm/java-21-openjdk-amd64/bin/java
link currently points to /usr/lib/jvm/java-21-openjdk-amd64/bin/java
link java is /usr/bin/java
slave java.1.gz is /usr/share/man/man1/java.1.gz
/usr/lib/jvm/java-17-openjdk-amd64/bin/java - priority 1711
slave java.1.gz: /usr/lib/jvm/java-17-openjdk-amd64/man/man1/java.1.gz
/usr/lib/jvm/java-21-openjdk-amd64/bin/java - priority 2111
slave java.1.gz: /usr/lib/jvm/java-21-openjdk-amd64/man/man1/java.1.gz

The output lists each registered path with its priority. In auto mode, the highest priority wins. The slave lines show related files that follow the same selection, in this case the java manual page.

Switch Between Alternatives

To choose interactively from the registered options, run:

Terminal
sudo update-alternatives --config java

output

There are 2 choices for the alternative java (providing /usr/bin/java).
Selection Path Priority Status
------------------------------------------------------------
* 0 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 auto mode
1 /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1711 manual mode
2 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 manual mode
Press <enter> to keep the current choice[*], or type selection number: 1

Type the number of a manual choice and press Enter to pin that version. Selecting 0 keeps or restores automatic mode, while pressing Enter without a number keeps the current choice.

When a group is in manual mode, a package installation can register another choice but will not replace your valid selection.

Set an Alternative Noninteractively

The --set command changes an alternative without displaying a menu, which makes it useful in provisioning scripts. Use --list as shown above to copy the exact path, then pass it to --set:

Terminal
sudo update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java

The selected group enters manual mode. The path must already be registered in that group.

Alternative groups are independent unless their provider registered related files as slave links. For example, switching the java group does not necessarily switch javac. Use --display to check which links belong to a group.

Register a New Alternative

When you install a program outside the package manager, you can register it with --install. Assume two releases of a program are installed at /opt/acme-tool-1.0/bin/acme-tool and /opt/acme-tool-2.0/bin/acme-tool. Confirm that both executable paths exist before registering them:

Terminal
ls -l /opt/acme-tool-1.0/bin/acme-tool /opt/acme-tool-2.0/bin/acme-tool

Terminal
sudo update-alternatives --install /usr/local/bin/acme-tool acme-tool /opt/acme-tool-1.0/bin/acme-tool 100
sudo update-alternatives --install /usr/local/bin/acme-tool acme-tool /opt/acme-tool-2.0/bin/acme-tool 200

The arguments are:

txt
--install LINK NAME PATH PRIORITY

LINK is the path where the generic command link will be created (/usr/local/bin/acme-tool).
NAME is the alternative group name (acme-tool).
PATH is the actual binary (/opt/acme-tool-1.0/bin/acme-tool).
PRIORITY is the numeric weight used in auto mode (higher wins).

In this example, automatic mode selects version 2.0 because it has the higher priority.

Warning

Do not use update-alternatives to replace /usr/bin/python3 on Ubuntu or Debian. System tools depend on the distribution’s default Python interpreter. Use versioned commands, virtual environments, pyenv, or a separate command under /usr/local/bin instead.

Remove an Alternative

Before removing a registered path, display the group and confirm the exact path:

Terminal
update-alternatives --display acme-tool

Then deregister the path:

Terminal
sudo update-alternatives --remove acme-tool /opt/acme-tool-1.0/bin/acme-tool

The command removes the path from the alternatives database but does not delete the program itself. If you remove the active path, the group returns to automatic mode and selects the best remaining alternative.

Reset to Auto Mode

If you manually pinned an alternative and want to go back to automatic selection by priority:

Terminal
sudo update-alternatives --auto java

The system returns to the highest-priority option.

Switch the Editor Alternative

The editor alternative provides the system-wide /usr/bin/editor command. Programs that invoke this path follow the selected alternative, while tools such as sensible-editor may honor user-specific settings and environment variables first. To switch the system editor choice:

Terminal
sudo update-alternatives --config editor

Select an installed editor such as vim.basic from the list. Applications with their own editor setting do not necessarily follow this choice. Git, for example, checks GIT_EDITOR, core.editor, VISUAL, and EDITOR before using its compiled default.

Quick Reference

Task	Command
List all alternative groups	`update-alternatives --get-selections`
List paths in one group	`update-alternatives --list NAME`
Display group details	`update-alternatives --display NAME`
Choose interactively	`sudo update-alternatives --config NAME`
Select a path noninteractively	`sudo update-alternatives --set NAME PATH`
Return to automatic mode	`sudo update-alternatives --auto NAME`
Register a path	`sudo update-alternatives --install LINK NAME PATH PRIORITY`
Deregister a path	`sudo update-alternatives --remove NAME PATH`

Troubleshooting

no alternatives for NAME The group is not registered. Check the available names with update-alternatives --get-selections. Install a package that provides the group or register an existing executable with --install.

alternative path ... does not exist The path passed to --install must already exist. Check it with ls -l PATH, then correct the path or install the program before trying again.

A regular file blocks the alternatives link Do not immediately add --force. Check which package owns the path with dpkg -S /path/to/command, and back up locally installed files before replacing them with an alternatives-managed link.

Conclusion

Use --config for interactive changes, --set for scripts, and --auto when you want priority-based selection again. For a practical example with multiple JDKs, see How to Check Java Version .

How to Convert MP4 to MP3 with ffmpeg

hello@linuxize.com (Linuxize) — Sun, 26 Jul 2026 08:20:00 +0200

A recorded lecture, a podcast published as video, a concert clip you only ever listen to: sometimes all you want from an MP4 is its audio track. ffmpeg does this in one command, with full control over the output quality.

This guide shows how to convert MP4 to MP3 with ffmpeg, pick sensible quality settings, extract audio without any quality loss, and convert files in bulk.

Prerequisites

You need ffmpeg installed. On Ubuntu, Debian, and derivatives:

Terminal
sudo apt update
sudo apt install ffmpeg

These commands install both ffmpeg and ffprobe. For version-specific instructions, see our guides on installing ffmpeg on Ubuntu and Debian .

Converting MP4 to MP3

The simplest form gives ffmpeg an input, selects the LAME MP3 encoder, and names the output file:

Terminal
ffmpeg -i video.mp4 -c:a libmp3lame audio.mp3

This decodes the audio track from video.mp4, encodes it as MP3 with default settings, and writes audio.mp3. The video stream is dropped automatically, since an MP3 file cannot contain one.

For better control, the recommended form adds two options:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3

The -vn flag explicitly discards the video stream, -c:a libmp3lame selects the LAME MP3 encoder, and -q:a 2 selects variable bitrate (VBR) quality level 2. This level typically averages around 190 kb/s, although the actual bitrate depends on the audio.

Choosing the Quality

The MP3 encoder accepts a VBR quality scale from 0 (best) to 9 (smallest). These approximate bitrates vary with the source:

-q:a 0 - Around 245 kb/s; highest quality VBR, for music you care about.
-q:a 2 - Around 190 kb/s; the common sweet spot.
-q:a 5 - Around 130 kb/s; fine for speech and podcasts.
-q:a 7 - Around 100 kb/s; small files, audible compression on music.

If you need a constant bitrate instead, for example for a device that struggles with VBR, use -b:a:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -b:a 192k audio.mp3

Keep in mind that encoding cannot add quality back: if the source audio is a 96 kb/s stream, encoding it at 320 kb/s only produces a larger file, not a better-sounding one.

Extracting Audio Without Quality Loss

Converting to MP3 always re-encodes, which costs a small amount of quality. If you only need the original audio track, check its codec before deciding whether to convert it:

Terminal
ffprobe -v error -select_streams a:0 -show_entries stream=codec_name -of default=noprint_wrappers=1:nokey=1 video.mp4

output

aac

AAC audio is common in MP4 files and can be copied into an .m4a container without re-encoding:

Terminal
ffmpeg -i video.mp4 -map 0:a:0 -c:a copy audio.m4a

The -map 0:a:0 option selects the first audio stream, and -c:a copy moves the compressed audio without decoding or encoding it. The audio data remains unchanged, and the operation usually finishes much faster than an MP3 conversion. If ffprobe reports another codec, use a compatible container or convert the audio instead.

Converting Part of a File

To convert only a section, combine the conversion with a start time and a duration:

Terminal
ffmpeg -ss 00:05:30 -i video.mp4 -t 00:06:30 -vn -c:a libmp3lame -q:a 2 clip.mp3

The -ss option starts at 5:30, and -t 00:06:30 converts the next six minutes and thirty seconds, ending at 12:00. This is handy for pulling one song out of a concert recording or one answer out of a long interview.

Batch Converting Multiple Files

ffmpeg takes one input at a time, so converting a directory of MP4 files uses a small bash for loop :

Terminal
shopt -s nullglob
for f in *.mp4; do
 ffmpeg -n -i "$f" -vn -c:a libmp3lame -q:a 2 "${f%.mp4}.mp3"
done

The nullglob setting skips the loop when the directory contains no MP4 files. The ${f%.mp4} expansion strips the .mp4 extension so each MP3 keeps the original filename, while -n prevents existing files from being overwritten. The quotes around the variables keep filenames with spaces intact.

Troubleshooting

Unknown encoder ’libmp3lame’
Your ffmpeg build lacks the LAME MP3 encoder, which happens with some minimal or codec-restricted packages. Check for it with ffmpeg -hide_banner -encoders | grep -w libmp3lame, then install an FFmpeg package that includes the encoder.

Output file has no sound
The source may carry multiple audio tracks and the wrong one was picked. Inspect the file with ffprobe -hide_banner video.mp4, then select the track explicitly with -map, for example -map 0:a:1 for the second audio stream.

Could not write the M4A output header
The source audio codec is not compatible with the M4A container. Use a container that supports the original codec, or replace -c:a copy with -c:a aac -b:a 192k to create a compatible M4A file.

The output file already exists
FFmpeg asks before replacing an existing file. Use a different output name, add -n to keep the existing file, or add -y only when you intend to overwrite it.

Conclusion

One command covers the everyday case: ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3, with -q:a trading size against quality. For more conversion, compression, and inspection examples, see our ffmpeg command guide .

How to Find Which Process Is Using a Port in Linux

hello@linuxize.com (Linuxize) — Sat, 25 Jul 2026 07:30:00 +0200

You start a service, and it refuses to launch with an error like “bind: address already in use”. Something is already holding the port, but the message does not tell you what. Before you can fix it, you need to map the port back to a process, find its PID, and decide whether to stop it. Linux gives you several tools for this, and each one answers the question in a slightly different way.

This guide shows how to find the process using a port with ss, lsof, fuser, and netstat, and how to stop it once you have the PID.

If you need an inventory of every service accepting connections instead of one specific port, see the guide on checking listening ports in Linux . Note that 127.0.0.1:8080 and 0.0.0.0:8080 collide, because binding to all interfaces includes the loopback address .

Quick Reference

For printable quick references, see the ss cheatsheet , lsof cheatsheet , and netstat cheatsheet .

Task	Command
Find a TCP listener with ss	`sudo ss -ltnp 'sport = :80'`
Find a UDP socket with ss	`sudo ss -lunp 'sport = :53'`
Find a TCP listener with lsof	`sudo lsof -nP -iTCP:80 -sTCP:LISTEN`
Find processes with fuser	`sudo fuser -v 80/tcp`
Find a TCP listener with netstat	`sudo netstat -ltnp \| grep ':80 '`
Inspect a process	`ps -fp PID`
Stop an unmanaged process	`sudo kill PID`
Send SIGTERM with fuser	`sudo fuser -k -TERM 80/tcp`

Finding the Process with ss

The ss command is the standard choice on current Linux distributions. It comes from the iproute2 package and supports filters that match an exact port without piping the output through another command.

Terminal
sudo ss -ltnp 'sport = :80'

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1433,fd=5),("nginx",pid=1432,fd=5))
LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=1433,fd=6),("nginx",pid=1432,fd=6))

Run the command with sudo so ss can show process details for sockets owned by other users. The options provide the following information:

-l - Show only listening sockets.
-t - Show TCP sockets.
-n - Print numeric port numbers instead of resolving service names.
-p - Show the process that owns each socket.

The sport = :80 expression matches local port 80 exactly, so it does not also return ports such as 8080. In the output above, nginx holds the port. The Process column lists two process IDs because the master process, 1432, opened the socket and passed it to its worker, 1433. Either PID leads you back to the same service. The two rows show that nginx listens on both IPv4 and IPv6.

UDP sockets do not use the TCP LISTEN state. To check a UDP port, replace -t with -u. For example, the following command identifies the process bound to UDP port 53:

Terminal
sudo ss -lunp 'sport = :53'

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
UNCONN 0 0 0.0.0.0:53 0.0.0.0:* users:(("dnsmasq",pid=902,fd=4))

The UNCONN state is normal for a UDP server because UDP does not establish connections before exchanging data.

Finding the Process with lsof

The lsof command lists open files, including network sockets. Use numeric output and restrict the result to TCP listeners on the port:

Terminal
sudo lsof -nP -iTCP:80 -sTCP:LISTEN

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1432 root 6u IPv4 28319 0t0 TCP *:80 (LISTEN)
nginx 1432 root 7u IPv6 28320 0t0 TCP *:80 (LISTEN)
nginx 1433 www-data 6u IPv4 28319 0t0 TCP *:80 (LISTEN)
nginx 1433 www-data 7u IPv6 28320 0t0 TCP *:80 (LISTEN)

The -nP options prevent hostname and service-name lookups, while -iTCP:80 selects TCP port 80 and -sTCP:LISTEN excludes established connections. The output reports the command, PID, user, and file descriptor. Here lsof gives you the same two nginx processes that ss reported, each listed once for IPv4 and once for IPv6, and it also shows the user each one runs as, which is useful when a master process drops privileges for its workers.

For UDP port 53, use this form:

Terminal
sudo lsof -nP -iUDP:53

The pattern is the same, except that -iUDP:53 selects the UDP port and there is no state filter, because UDP sockets never enter the LISTEN state.

Finding the Process with fuser

When you want a PID without the full socket table, fuser provides a short command. Pass the port number followed by the protocol:

Terminal
sudo fuser 80/tcp

output

80/tcp: 1432 1433

You get the PID list and nothing else, which makes the plain form easy to pass to another command. To include the user, access type, and command name, add the -v option:

Terminal
sudo fuser -v 80/tcp

output

 USER PID ACCESS COMMAND
80/tcp: root 1432 F.... nginx
www-data 1433 F.... nginx

The port appears once on the first row, and every process below it belongs to that same port. The ACCESS column describes how each process uses the socket, where F marks it as open for writing.

You must specify tcp or udp because the same numeric port can be used by both protocols.

Finding the Process with netstat

On older systems you may still find netstat , part of the net-tools package. Use it as a fallback when ss is not available:

Terminal
sudo netstat -ltnp | grep ':80 '

output

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1432/nginx: master
tcp6 0 0 :::80 :::* LISTEN 1432/nginx: master

The last column ties PID 1432 to the nginx master process, and netstat truncates that name if it grows too long. Unlike ss and lsof, it reports a single process per socket rather than the whole group. The space after :80 in the filter prevents it from matching a longer port number such as 8080. For a UDP port, use -lunp instead of -ltnp.

Inspecting and Stopping the Process

Once you have the PID, confirm what started the process before stopping it. The following ps command shows the full command and its parent PID:

Terminal
ps -fp 1432

output

UID PID PPID C STIME TTY TIME CMD
root 1432 1 0 07:10 ? 00:00:00 nginx: master process /usr/sbin/nginx

A service manager or container runtime may own the process. In that case, stop it through its manager so it does not immediately start again. For example, stop an Nginx systemd service with:

Terminal
sudo systemctl stop nginx

Warning

Make sure you understand what the process does before stopping it. Terminating a database or another production service to free a port can interrupt active work or cause data loss.

For an unmanaged process, send SIGTERM with kill:

Terminal
sudo kill 1432

SIGTERM asks the process to shut down cleanly. If the process ignores it, you can use sudo kill -KILL 1432 as a last resort, but SIGKILL gives it no opportunity to save state or remove temporary files. For more detail about signals, see the guide on how to kill a process in Linux .

After inspecting the verbose fuser output, you can send SIGTERM to every process using the TCP port:

Terminal
sudo fuser -k -TERM 80/tcp

The explicit -TERM matters because fuser -k sends SIGKILL by default.

Confirming the Port Is Free

Run the same ss query after stopping the process:

Terminal
sudo ss -ltnp 'sport = :80'

If no socket row appears below the header, nothing is listening on TCP port 80 in the current network namespace. If you changed a service configuration instead of stopping it, start the service again and check the new port with the same command.

Troubleshooting

The port appears but the process name is missing
Run the command with sudo. Without root privileges, these tools may not be able to read details for sockets owned by another user.

ss returns nothing but the application still reports a conflict
Check that you are using the correct protocol. Use -lunp for UDP instead of -ltnp for TCP. The listener may also be inside another network namespace or container, so run the check in the same environment as the application.

The process starts again after you stop it
A service manager or container runtime is restarting it. Stop or reconfigure the systemd service, Docker container, or other supervisor instead of repeatedly killing its PID.

Several PIDs appear for the same port
Some servers use a master process with several workers that share one socket. Other applications can use the SO_REUSEPORT option. Identify the parent service and manage the group instead of stopping one worker at a time.

netstat: command not found
The net-tools package is not installed on many current distributions. Use ss instead.

Conclusion

Use ss first when you need the process behind a specific port, then turn to lsof or fuser when you need a different view. Inspect the PID and its manager before stopping anything, especially on a production system.

CIDR Notation and Subnetting Explained

hello@linuxize.com (Linuxize) — Fri, 24 Jul 2026 10:50:00 +0200

When you assign a static address, configure a firewall rule, or divide a private network, you will encounter values such as 192.168.10.0/24. The address identifies the network, while the number after the slash tells you how much of the address is fixed and how much remains available for hosts.

This guide explains how CIDR prefixes map to subnet masks, how to find network and broadcast addresses, and how to divide an IPv4 block into smaller subnets.

For instant calculations and a visual binary split, use the subnet calculator .

What CIDR Notation Means

CIDR stands for Classless Inter-Domain Routing. It replaced the older class-based system with variable-length prefixes, allowing networks to be sized and routed more precisely.

An IPv4 CIDR block contains an address followed by a slash and a prefix length:

txt
192.168.10.0/24

An IPv4 address contains 32 bits. The /24 prefix means the first 24 bits identify the network, leaving 8 bits for addresses inside that network. A longer prefix fixes more network bits and creates a smaller block. A shorter prefix leaves more host bits and creates a larger block.

The prefix can range from /0, which covers the entire IPv4 address space, to /32, which identifies one address. CIDR notation is used for both network allocation and routing, so the same format can describe a LAN subnet, a firewall source range, or a single host route.

Network Bits and Host Bits

To see the /24 boundary, write the address and mask in binary:

txt
Address: 11000000.10101000.00001010.00000000
Mask: 11111111.11111111.11111111.00000000
 <------ network ------><-- host -->

Every 1 in the mask belongs to the network prefix. Every 0 leaves a bit that can vary within the block. Because /24 leaves 8 host bits, the block contains 2^8, or 256, addresses.

The network portion stays constant for every address in the block. Only the last 8 bits change, producing the range 192.168.10.0 through 192.168.10.255.

Convert a CIDR Prefix to a Subnet Mask

A subnet mask expresses the same boundary as a CIDR prefix, but in dotted-decimal form. A /24 has 24 one bits followed by 8 zero bits:

txt
11111111.11111111.11111111.00000000
255.255.255.0

Prefixes that end on an octet boundary are easy to recognize: /8 is 255.0.0.0, /16 is 255.255.0.0, and /24 is 255.255.255.0.

For a prefix such as /26, the first two bits of the final octet also belong to the network:

txt
11111111.11111111.11111111.11000000
255.255.255.192

The binary value 11000000 equals 192, so /26 maps to 255.255.255.192. The remaining six host bits provide 2^6, or 64, total addresses per subnet.

Calculate the Number of Addresses and Hosts

For a normal IPv4 subnet, calculate the total number of addresses with this formula:

txt
Total addresses = 2^(32 - prefix length)

A /27 leaves five host bits, so it contains 2^5 = 32 addresses. The first address is normally reserved as the network address, and the last is the broadcast address, leaving 30 addresses for host interfaces.

Two prefixes need separate treatment:

A /31 contains two addresses. On a point-to-point link, RFC 3021 treats both as host addresses because that link has no need for a separate network or broadcast address.
A /32 contains one address and represents a host route, not a conventional multi-host subnet.

The familiar total minus 2 rule therefore applies to conventional IPv4 subnets from /0 through /30, not blindly to every prefix.

Find the Network and Broadcast Addresses

Consider the address 192.168.10.34/27. A /27 mask is 255.255.255.224, which creates blocks of 32 addresses in the final octet:

txt
0-31, 32-63, 64-95, 96-127, 128-159, 160-191, 192-223, 224-255

The address .34 falls in the 32-63 block. That gives us:

Network address: 192.168.10.32
First usable address: 192.168.10.33
Last usable address: 192.168.10.62
Broadcast address: 192.168.10.63

You can find the block size by subtracting the changing mask octet from 256. For /27, 256 - 224 = 32. Starting at zero, count in increments of 32 until you find the range that contains the address.

On Linux, the ip command displays each interface address together with its CIDR prefix:

Terminal
ip -brief address

output

lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.10.34/27

The output shows that eth0 uses the /27 network calculated above.

Subnet a /24 Network into /26 Blocks

Suppose you have 192.168.10.0/24 and need four equal networks. Moving from /24 to /26 borrows two host bits for subnetting. Two borrowed bits produce 2^2 = 4 subnets.

Each /26 contains 64 total addresses and 62 conventional host addresses:

Subnet	Usable host range	Broadcast
`192.168.10.0/26`	`192.168.10.1` to `192.168.10.62`	`192.168.10.63`
`192.168.10.64/26`	`192.168.10.65` to `192.168.10.126`	`192.168.10.127`
`192.168.10.128/26`	`192.168.10.129` to `192.168.10.190`	`192.168.10.191`
`192.168.10.192/26`	`192.168.10.193` to `192.168.10.254`	`192.168.10.255`

The subnet boundaries increase by 64 because /26 leaves six host bits and 2^6 = 64. A network address must start on one of these boundaries. For example, 192.168.10.64/26 is valid, but 192.168.10.70/26 is an address inside that network rather than the network identifier.

Combine Networks with Route Aggregation

CIDR also lets routers summarize adjacent networks into one larger route. For example, these four /24 networks are contiguous:

txt
168.0.0/24
168.1.0/24
168.2.0/24
168.3.0/24

They can be advertised as the single route 192.168.0.0/22. A /22 contains 1024 addresses, exactly the same total as four /24 blocks.

Aggregation works only when the networks are contiguous and aligned on the larger prefix boundary. The four networks from 192.168.1.0/24 through 192.168.4.0/24 cannot form one /22, even though their total size is the same, because the range does not start on a /22 boundary.

CIDR Notation in IPv6

IPv6 uses CIDR prefixes over a 128-bit address. For example:

txt
2001:db8:1234:5600::/64

The /64 prefix fixes the first 64 bits and leaves the remaining 64 bits for the interface identifier. A /64 is the common size for an IPv6 LAN, especially when Stateless Address Autoconfiguration (SLAAC) is used, although routing prefixes can have other lengths.

IPv6 has no broadcast address. Multicast replaces broadcast behavior, and all-zero or all-one values are legal within address fields unless a specific rule says otherwise. See the IPv4 vs IPv6 comparison for the broader differences between the protocols.

Quick Reference

Prefix	Subnet mask	Total addresses	Conventional usable hosts
`/8`	`255.0.0.0`	16,777,216	16,777,214
`/16`	`255.255.0.0`	65,536	65,534
`/20`	`255.255.240.0`	4,096	4,094
`/22`	`255.255.252.0`	1,024	1,022
`/24`	`255.255.255.0`	256	254
`/25`	`255.255.255.128`	128	126
`/26`	`255.255.255.192`	64	62
`/27`	`255.255.255.224`	32	30
`/28`	`255.255.255.240`	16	14
`/29`	`255.255.255.248`	8	6
`/30`	`255.255.255.252`	4	2
`/31`	`255.255.255.254`	2	2 on point-to-point links
`/32`	`255.255.255.255`	1	1 host route

Conclusion

The CIDR prefix tells you exactly where the network bits end and the host bits begin. Once you can convert that boundary to a mask and block size, you can calculate ranges, divide networks, and check firewall rules without relying on the old address classes.

mount Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 24 Jul 2026 07:45:00 +0200

Basic Syntax

Core mount and umount command forms.

Command	Description
`mount DEVICE DIR`	Attach a device to a mount point
`mount -t TYPE DEVICE DIR`	Mount with an explicit filesystem type
`mount -o OPTIONS DEVICE DIR`	Mount with a comma-separated option list
`mount DIR`	Mount an entry already defined in `/etc/fstab`
`mount -a`	Mount `/etc/fstab` filesystems except `noauto` entries
`umount DIR`	Detach the filesystem mounted at `DIR`

Most mount operations require root privileges, so prefix them with sudo.

List Mounted Filesystems

Inspect what is currently mounted and where.

Command	Description
`mount`	List all mounts using the legacy display; prefer `findmnt`
`findmnt`	Show mounts as a readable tree
`findmnt /dev/sdb1`	Show where a specific device is mounted
`findmnt -t ext4,xfs`	List only the given filesystem types
`findmnt --fstab --verify`	Check `/etc/fstab` for errors before rebooting
`cat /proc/mounts`	Read active mounts in the current mount namespace
`lsblk -f`	List block devices with type, label, and UUID
`df -hT`	Show mounted filesystems with type and free space

Common Mount Options

Values passed to -o or listed in the fourth /etc/fstab field.

Option	Description
`defaults`	Common defaults are `rw,suid,dev,exec,auto,nouser,async`; exact defaults vary
`ro` / `rw`	Mount read-only or read-write
`noexec`	Block execution of binaries on the filesystem
`nosuid`	Ignore setuid and setgid bits
`nodev`	Ignore device files on the filesystem
`noatime`	Skip access-time updates, which reduces disk writes
`sync` / `async`	Write synchronously or let the kernel buffer writes
`noauto`	Skip this entry during `mount -a` and at boot
`user`	Allow a non-root user to mount; implies `noexec,nosuid,nodev` unless overridden
`nofail`	Continue booting when the device is missing
`uid=1000,gid=1000`	Set owner and group on filesystems without Unix permissions
`remount`	Change options on an already mounted filesystem

Example: sudo mount -o remount,rw / remounts the root filesystem read-write.

Mount by UUID or Label

Device names such as /dev/sdb1 can change between boots, so identify the filesystem instead.

Command	Description
`lsblk -f`	Show the UUID and label of every filesystem
`sudo blkid`	Print device type, label, and UUID
`sudo blkid /dev/sdb1`	Print the attributes of one device
`sudo mount UUID=1a2b3c4d-... /mnt/data`	Mount by filesystem UUID
`sudo mount LABEL=backup /mnt/backup`	Mount by filesystem label
`sudo mount -U 1a2b3c4d-... /mnt/data`	Short form of the UUID lookup
`sudo mount -L backup /mnt/backup`	Short form of the label lookup
`sudo e2label /dev/sdb1 backup`	Set a label on an ext2, ext3, or ext4 filesystem

Prefer UUID= or LABEL= for persistent local mounts in /etc/fstab because device names can change.

Filesystem Types

Values for -t and for the third /etc/fstab field.

Type	Description
`ext4`	Widely used general-purpose Linux filesystem
`xfs`	High-performance journaling filesystem, default on RHEL
`btrfs`	Copy-on-write filesystem with snapshots and subvolumes
`vfat`	FAT32, used by USB drives and EFI system partitions
`exfat`	Large-file FAT variant for USB drives and SD cards
`ntfs3`	In-kernel NTFS driver available on supported kernels
`iso9660`	Optical disc and ISO image filesystem
`tmpfs`	In-memory filesystem backed by RAM and swap
`nfs`	Network File System share
`cifs`	SMB or Windows network share
`auto`	Let `mount` detect the type

Network and Special Mounts

Mount forms beyond a plain local partition.

Command	Description
`sudo mount -t nfs server:/srv/data /mnt/data`	Mount an NFS export
`sudo mount -t cifs //server/share /mnt/share -o username=user`	Mount a Windows or Samba share
`sudo mount -t cifs //server/share /mnt/share -o credentials=/etc/smb-credentials`	Mount CIFS with a credentials file
`sshfs user@host:/remote/dir /mnt/remote`	Mount a remote directory over SSH
`sudo mount -o loop image.iso /mnt/iso`	Mount an ISO image through a loop device
`sudo mount --bind /src /dst`	Expose an existing directory at a second path
`sudo mount --rbind /src /dst`	Bind a directory together with its submounts
`sudo mount -t tmpfs -o size=512M tmpfs /mnt/ram`	Create a 512 MB RAM-backed filesystem

Keep CIFS credentials outside project directories and version control. Protect the file with sudo chmod 600 /etc/smb-credentials.

Unmounting

Detach a filesystem and deal with a busy mount point.

Command	Description
`sudo umount /mnt/data`	Unmount by mount point
`sudo umount /dev/sdb1`	Unmount by device (obsolete; use the mount point)
`sudo umount -R /mnt/data`	Unmount a mount point and everything below it
`sudo umount -l /mnt/data`	Lazy unmount: detach now, release when no longer in use
`sudo umount -f /mnt/share`	Force an unmount, mainly for unreachable network shares
`sudo umount -a -t nfs`	Unmount every NFS filesystem
`lsof +f -- /mnt/data`	List open files under the mount point
`fuser -mv /mnt/data`	Show processes and users holding the mount point
`sudo fuser -km /mnt/data`	Kill every process using the mount point; destructive

Review fuser -mv output before using fuser -km. Use lazy or forced unmounts only when a normal unmount cannot work: -f can lose unwritten data, while -l hides the path before all references are released.

Persistent Mounts in /etc/fstab

Each line has six space-separated fields.

Field	Description
1. Device	`UUID=`, `LABEL=`, a device path, or a remote share
2. Mount point	Existing directory, or `none` for swap
3. Type	Filesystem type, such as `ext4`, `nfs`, or `cifs`
4. Options	Comma-separated mount options, or `defaults`
5. Dump	`0` in nearly all cases; `1` marks the filesystem for `dump`
6. Pass	Order of `fsck` at boot: `1` for root, `2` for others, `0` to skip

Example: UUID=1a2b3c4d-... /mnt/data ext4 defaults,nofail 0 2

Command	Description
`sudo findmnt --fstab --verify`	Validate the file before rebooting
`sudo mount -a`	Apply mountable entries after validating `/etc/fstab`
`sudo systemctl daemon-reload`	Regenerate the systemd mount units after an edit
`sudo mount /mnt/data`	Mount one entry using only its mount point

Use nofail only for optional mounts. Add _netdev when a network-backed filesystem is not recognized as network-dependent from its type.

Troubleshooting

Common mount errors and what to check.

Error	Check
`target is busy`	Find the holder with `fuser -mv DIR` or `lsof +f -- DIR`, then close it
`unknown filesystem type`	Install the required helper or driver, such as `ntfs-3g`, `nfs-common` or `nfs-utils`, or `cifs-utils`; confirm kernel support for exFAT
`wrong fs type, bad option, bad superblock`	Confirm the type with `lsblk -f` and check `dmesg`. If repair is needed, unmount it and use the correct filesystem checker
`mount point does not exist`	Create the directory first with `sudo mkdir -p DIR`
`permission denied` on CIFS	Verify credentials and server share permissions; `uid=` and `gid=` only control local ownership
`special device does not exist`	Recheck the UUID with `blkid`; the device name may have changed
Files are hidden after mounting	The mounted filesystem covers existing directory contents; unmount it and inspect the underlying path
Boot drops to emergency mode	Remount root with `mount -o remount,rw /`, fix the bad `/etc/fstab` line, and validate it; add `nofail` only if the mount is optional

Use these guides and cheatsheets for complete storage workflows.

Guide	Description
How to Mount and Unmount File Systems in Linux	Full guide to `mount` and `umount` with practical examples
Understanding the /etc/fstab File in Linux	Field-by-field breakdown of persistent mount entries
How to Mount an NFS Share in Linux	Install the client, mount a share, and troubleshoot errors
How to Mount a Windows Share on Linux Using CIFS	Credentials files, ownership, and permissions for SMB shares
How to Mount ISO File on Linux	Loop devices and the graphical mounting method
How to Use SSHFS to Mount Remote Directories over SSH	Mount a remote directory and browse it like a local one
df Cheatsheet	Check free space on mounted filesystems
fdisk Cheatsheet	Partition a disk before creating a filesystem

SSH Connection Refused: Causes and Fixes

hello@linuxize.com (Linuxize) — Thu, 23 Jul 2026 14:20:00 +0200

You try to log in and SSH stops immediately with connect to host example.com port 22: Connection refused. The failure happens before SSH checks your key or password, so changing authentication settings will not fix it.

An immediate refusal means the target address has no process listening on that port, or a firewall or network device actively rejected the request. The usual causes are a stopped SSH server, the wrong host or port, a listener bound to another address, a firewall reject rule, or port forwarding to the wrong machine. A connection that hangs and then times out is different because no response came back.

This guide starts with checks you can run from the client, then moves to the SSH service, listening port, firewall, and network path on the server.

Quick Reference

For a printable quick reference, see the SSH cheatsheet .

Check	Command
Confirm the destination address	`getent ahosts example.com`
Show SSH connection details	`ssh -vvv user@example.com`
Test the default SSH port	`nc -vz example.com 22`
Check for a listener on port 22	`sudo ss -ltnp 'sport = :22'`
Show the effective SSH port and addresses	`sudo sshd -T \| grep -E '^(port\|listenaddress) '`
Check SSH on Ubuntu or Debian	`sudo systemctl status ssh.service ssh.socket`
Check SSH on Fedora or RHEL	`sudo systemctl status sshd`
Check UFW rules	`sudo ufw status numbered`
Check firewalld services	`sudo firewall-cmd --list-services`

Confirm the Host and Port from the Client

Before changing the server, confirm that the hostname resolves to the address you expect:

Terminal
getent ahosts example.com

If the result points to an old server or the wrong public address, correct the DNS record or connect to the intended IP address directly. Reaching the wrong host can produce a refusal even when SSH is working on the real server.

Next, run SSH with verbose output:

Terminal
ssh -vvv user@example.com

The relevant lines look like this:

output

debug1: Connecting to example.com [203.0.113.10] port 22.
ssh: connect to host example.com port 22: Connection refused

The client resolved example.com to 203.0.113.10 and received an immediate refusal from port 22. You can test the TCP port without starting an SSH login:

Terminal
nc -vz example.com 22

If the server uses a custom port, test and connect to that port instead:

Terminal
nc -vz example.com 2222
ssh -p 2222 user@example.com

A hostname can also have separate IPv4 and IPv6 addresses. Test each address family when one DNS record may point to the wrong server:

Terminal
ssh -4 user@example.com
ssh -6 user@example.com

The remaining checks require access to the server through a cloud console, virtual machine console, physical terminal, or another management channel.

Check Whether SSH Is Listening

The listening socket is the quickest way to tell whether the server can accept SSH connections on port 22. Run this command on the server:

Terminal
sudo ss -ltnp 'sport = :22'

A working listener appears as either sshd or systemd, depending on whether the distribution runs the daemon continuously or uses socket activation. If the command returns nothing, no process is accepting connections on port 22.

To see the port and addresses from the effective OpenSSH configuration, run:

Terminal
sudo sshd -T | grep -E '^(port|listenaddress) '

Typical output looks like this:

output

port 22
listenaddress [::]:22
listenaddress 0.0.0.0:22

The output shows that SSH is configured for port 22 on all IPv6 and IPv4 addresses. If it reports another port, connect with the -p option and verify that the firewall allows that port. See our guide on changing the SSH port if you need to correct the configuration.

Check the SSH Service or Socket

Linux distributions use different systemd unit names for OpenSSH. Ubuntu and Debian use ssh.service, while Fedora, RHEL, and their derivatives use sshd.service.

On Ubuntu and Debian, check the service:

Terminal
sudo systemctl status ssh.service

Ubuntu 22.10 and later use ssh.socket by default, so check that unit as well:

Terminal
sudo systemctl status ssh.socket

When ssh.socket is active and owns port 22, ssh.service may remain inactive until a client connects. In that setup, an inactive service alone does not indicate a problem. If the socket is disabled or stopped, enable it and start it:

Terminal
sudo systemctl enable --now ssh.socket

On systems without ssh.socket, enable and start the service instead:

Terminal
sudo systemctl enable --now ssh

On Fedora, RHEL, and derivatives, check and start sshd:

Terminal
sudo systemctl status sshd
sudo systemctl enable --now sshd

If the unit reports failed, validate the SSH server configuration:

Terminal
sudo sshd -t

No output means the configuration passed the test. If OpenSSH prints an error, correct the reported line before restarting the unit. You can also inspect the current boot logs on Ubuntu and Debian:

Terminal
sudo journalctl -u ssh.service -u ssh.socket -b

For Fedora and RHEL, use the sshd unit name:

Terminal
sudo journalctl -u sshd -b

Install the OpenSSH Server

Some minimal installations include the SSH client but not the server. If systemctl reports that the SSH unit does not exist, install the openssh-server package.

Ubuntu, Debian, and Derivatives

Update the package index and install the server package:

Terminal
sudo apt update
sudo apt install openssh-server

The package normally starts the appropriate SSH service or socket during installation. Check port 22 again with ss instead of assuming that the listener started successfully.

Fedora, RHEL, and Derivatives

Install the server package, then enable and start sshd:

Terminal
sudo dnf install openssh-server
sudo systemctl enable --now sshd

Check the Listening Address

SSH can run normally but listen only on the loopback interface or one private address. In that case, a local connection works while connections to other server addresses are refused.

Review the listenaddress lines from sshd -T. A value such as 127.0.0.1:22 accepts only local IPv4 connections. OpenSSH reads its main configuration from /etc/ssh/sshd_config and may also read files under /etc/ssh/sshd_config.d/. A listener on a loopback address is reachable from the server itself and from nowhere else.

Before changing Port or ListenAddress, keep console access open and validate the new configuration with sudo sshd -t. On Ubuntu systems using socket activation, the socket must also reload the generated listening configuration. The port-change guide linked above covers the service and socket steps in order.

Check the Firewall

A firewall is less likely to cause an immediate refusal than a missing listener. Rules that silently drop traffic usually end with Connection timed out, while an explicit REJECT rule can return Connection refused. Check the firewall after confirming the service and port.

If the server uses UFW, list its rules with numbers:

Terminal
sudo ufw status numbered

Allow the standard OpenSSH profile when SSH uses port 22:

Terminal
sudo ufw allow OpenSSH

For a custom port, allow the exact TCP port instead:

Terminal
sudo ufw allow 2222/tcp

On a server using firewalld, first check the services allowed in the active zone:

Terminal
sudo firewall-cmd --list-services

Add SSH to both the runtime and permanent configurations if it is missing:

Terminal
sudo firewall-cmd --add-service=ssh
sudo firewall-cmd --permanent --add-service=ssh

For a custom port, use --add-port=2222/tcp in both commands. Our UFW firewall guide explains how to review and manage rules in more detail.

Check Port Forwarding and External Firewalls

If SSH works from the same machine or local network but fails from the internet, the OpenSSH listener may already be correct. Check that the router or virtualization platform forwards the external port to the server’s current private address and SSH port.

The same issue can occur with a virtual machine, container, load balancer, or cloud firewall. Confirm that public DNS points to the expected system and that each forwarding rule uses the same port you pass to ssh. Cloud firewall rules often drop traffic and cause a timeout, but an edge device that rejects the request or forwards it to the wrong host can produce a refusal.

Troubleshooting

Connection refused started after an SSH configuration change
Run sudo sshd -t and correct every reported error. On Ubuntu with socket activation, reload systemd and restart ssh.socket after a valid Port or ListenAddress change, then verify the listener with ss before closing console access.

SSH works with localhost but not the server address
Check the effective ListenAddress values and the firewall rules for the external interface. A listener restricted to 127.0.0.1 or ::1 cannot accept remote connections.

IPv4 works but IPv6 is refused
The server may have an AAAA record without an IPv6 listener. Compare ssh -4 and ssh -6, then correct the DNS record or configure SSH to listen on the intended IPv6 address.

Only one client address is refused
A source-specific firewall rule or a tool such as Fail2ban may be rejecting that address. Review the firewall rules and, if Fail2ban is installed, check the SSH jail with sudo fail2ban-client status sshd.

SSH reaches the server but reports Permission denied
The network path and listener are working, and the failure has moved to authentication. Follow the SSH Permission denied (publickey) guide instead.

Conclusion

Once the port test succeeds, SSH should move on to host-key verification or authentication. Before exposing the restored service to the internet, review our SSH hardening best practices and restrict firewall access where possible.

Dockerfile COPY vs ADD: Which to Use

hello@linuxize.com (Linuxize) — Wed, 22 Jul 2026 10:25:00 +0200

When a Docker image needs application code, configuration, or a release archive, both COPY and ADD can place files in the image. For an ordinary local file, COPY app.py /app/ and ADD app.py /app/ produce the same result, but the instructions differ once archives, remote sources, or build stages are involved.

Use COPY for local files and artifacts from other build stages. Use ADD when you want automatic tar extraction or need BuildKit to fetch a remote HTTP or Git source. This guide compares both instructions and explains which one fits each case.

What COPY Does

COPY takes files or directories from the build context and places them at a destination inside the image:

dockerfile
COPY requirements.txt /app/
COPY src/ /app/src/

An archive copied this way stays an archive, and a source path cannot point outside the build context. Two options cover common permission needs by setting ownership and mode as the files are copied:

dockerfile
COPY --chown=appuser:appgroup --chmod=644 config.yml /app/

COPY can also read from a named context, another image, or an earlier stage in a multi-stage build. The --from option is commonly used to move compiled artifacts into a smaller production image:

dockerfile
COPY --from=builder /app/target/server /usr/local/bin/server

What ADD Does

For local files and directories, ADD behaves much like COPY. It also understands local tar archives, remote URLs, and Git repository sources.

When the source is a local tar archive, either uncompressed or compressed with gzip, bzip2, or xz, ADD extracts it into the destination instead of copying the archive file:

dockerfile
ADD rootfs.tar.gz /

Docker detects an archive from its contents, not its filename. A file named rootfs.tar.gz that does not contain a recognized tar archive is copied without an extraction error. When you need the archive itself inside the image, use COPY, or use ADD --unpack=false with Dockerfile syntax 1.17 or later.

For remote sources, ADD can download an HTTP or HTTPS URL. BuildKit supports --checksum so the build fails if the downloaded content does not match the expected SHA-256 digest. Here is a checksum-verified download:

dockerfile
# syntax=docker/dockerfile:1
ADD --checksum=sha256:24454f830cdb571e2c4ad15481119c43b3cafd48dd869a9b2945d1036d1dc68d \
 https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/linux-0.01.tar.gz \
 /tmp/linux-0.01.tar.gz

Remote tar archives are downloaded without extraction by default. Dockerfile syntax 1.17 added --unpack=true for builds that should download and extract a remote tar archive in one instruction.

ADD can also clone a Git repository from an HTTPS or SSH address. A branch, tag, commit, or subdirectory can be selected in the URL, and --checksum can pin a Git source to a commit. These behaviors are covered in the official Dockerfile ADD reference .

Key Differences

Source or behavior	COPY	ADD
Local files and directories	Copies them	Copies them
Local tar archive	Keeps the archive	Extracts it by default
Remote HTTP or HTTPS URL	Not supported	Downloads it
Remote Git repository	Not supported	Clones it
Checksum for a remote source	Not applicable	`--checksum`
Remote tar extraction	Not supported	`--unpack=true`
Build stage, named context, or image	`--from`	Not supported

Choosing Between COPY and ADD

Use COPY for application source code, configuration, static assets, and other ordinary files from the build context. It states the intent directly and ensures that an archive remains intact. COPY --from is also the correct choice for moving artifacts between build stages or importing files from another image.

Use ADD when its source-aware behavior is part of the task. Local tar extraction is useful for assembling a root filesystem or installing a vendored release archive without storing the compressed archive in its own image layer.

For example, this instruction extracts a local application archive directly into /opt/app/:

dockerfile
ADD app-1.4.2-dist.tar.gz /opt/app/

For remote artifacts, current Docker build best practices favor ADD with --checksum because BuildKit can cache the remote source precisely and verify its contents. A RUN instruction with curl or wget is still appropriate when you need custom request handling or additional processing. Keep verification, extraction, and cleanup in the same RUN instruction so temporary files do not remain in a separate layer.

Conclusion

Choose COPY for local content and multi-stage artifacts. Choose ADD when you need automatic tar extraction or a checksum-verified remote source. For the complete image-building workflow, see our guide on building Docker images with a Dockerfile , and keep the Docker cheatsheet nearby for the rest of the instruction set.

head Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 21 Jul 2026 13:20:00 +0200

Basic Syntax

Core head command forms.

Command	Description
`head FILE`	Show the first 10 lines of a file
`head -n 20 FILE`	Show the first 20 lines
`head -c 100 FILE`	Show the first 100 bytes
`command \| head -n 10`	Limit piped output to 10 lines
`head -- -notes.txt`	Read a file whose name starts with `-`

Select Lines

Control how many lines are printed.

Command	Description
`head -n 5 /etc/passwd`	Show the first 5 lines
`head -n 1 data.csv`	Print the header row of a CSV file
`head -n 100 app.log`	Preview the first 100 log entries
`head -n -5 FILE`	Show all lines except the last 5 (GNU)
`head -n 2 FILE1 FILE2`	Show the first 2 lines of each file

Select Bytes

Read a fixed number of bytes instead of lines.

Command	Description
`head -c 100 FILE`	Show the first 100 bytes
`head -c 2K FILE`	Show the first 2048 bytes
`head -c 1MB FILE`	Show the first 1,000,000 bytes
`head -c -512 FILE`	Show all bytes except the last 512 (GNU)
`head -c 512 disk.img > header.bin`	Save the first 512 bytes to a file

Multiple Files and Headers

Control the file-name headers shown with multiple inputs.

Command	Description
`head FILE1 FILE2`	Show 10 lines from each file with headers
`head -n 5 *.log`	Show the first 5 lines of every matched log
`head -q FILE1 FILE2`	Suppress file-name headers
`head -v FILE`	Always print a file-name header
`head -n 5 FILE1 - FILE2`	Read files and standard input in sequence

Pipelines

Combine head with other text-processing commands.

Command	Description
`ls -t \| head -n 5`	Show the 5 most recently modified entries
`sort -nr scores.txt \| head -n 10`	Show the 10 highest numeric values
`grep 'ERROR' app.log \| head -n 20`	Show the first 20 matching errors
`tail -n +20 FILE \| head -n 11`	Extract lines 20 through 30
`head -n 20 FILE \| wc -w`	Count words in the first 20 lines

Useful Options

Common GNU head flags and long forms.

Option	Description
`-n NUM`, `--lines=NUM`	Print the first `NUM` lines
`-c NUM`, `--bytes=NUM`	Print the first `NUM` bytes
`-q`, `--quiet`	Never print file-name headers
`-v`, `--verbose`	Always print file-name headers
`-z`, `--zero-terminated`	Read and write NUL-delimited items (GNU)
`--help`	Show command help
`--version`	Show the installed version

Use head -n 5 instead of the obsolete head -5 syntax in scripts.

NUL-Delimited Input

Handle file names containing spaces, newlines, or other special characters.

Command	Description
`find . -type f -print0 \| head -z -n 5`	Select the first 5 NUL-delimited paths
`find . -type f -print0 \| head -z -n 5 \| xargs -0 -r ls -l`	Pass the first 5 paths safely to `ls`
`printf 'one\0two\0' \| head -z -n 1`	Print the first NUL-delimited item

The -z option is specific to GNU head.

Troubleshooting

Quick checks for common head issues.

Issue	Check
Only 10 lines are shown	This is the default; set the count with `-n NUM`
File-name headers appear	Multiple files trigger headers; add `-q` to suppress them
Binary output looks garbled	Redirect byte output to a file or inspect it with `hexdump`
`head -n -5` fails	Negative counts are a GNU feature and are not portable
Upstream command reports a broken pipe	`head` exits after collecting enough input; some producers report the closed pipe

Use these guides and cheatsheets for complete text-processing workflows.

Guide	Description
head Command in Linux	Full guide to lines, bytes, files, and pipelines
tail Cheatsheet	Read the end of files and follow logs
cat Cheatsheet	Display and combine file contents
sort Cheatsheet	Order lines before selecting top results
wc Cheatsheet	Count lines, words, and bytes

lsusb, lspci, and lshw: List Hardware in Linux

hello@linuxize.com (Linuxize) — Tue, 21 Jul 2026 09:40:00 +0200

Sooner or later you need to know exactly what is inside a machine: which Wi-Fi chip refuses to work, whether the system sees a plugged-in USB device at all, or what to put in a purchase order for more RAM. Three commands answer these questions from the terminal, each covering a different part of the hardware inventory: lsusb for USB devices, lspci for PCI devices such as network cards and GPUs, and lshw for a complete inventory of everything.

This guide explains how to use all three, and which one to reach for depending on the question you are asking.

Installing the Tools

The three commands live in three small packages, most of which are preinstalled on desktop distributions.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install usbutils pciutils lshw

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install usbutils pciutils lshw

Listing USB Devices with lsusb

Run lsusb without arguments to list every device on the USB buses:

Terminal
lsusb

output

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 046d:c52b Logitech, Inc. Unifying Receiver
Bus 001 Device 003: ID 13d3:56a6 IMC Networks Integrated Camera
Bus 001 Device 002: ID 8087:0aaa Intel Corp. Bluetooth 9460/9560
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Each line shows the bus and device number, then the ID in vendor:product form, then a human-readable name looked up from the USB ID database. The 1d6b root hubs are the controllers themselves, not devices you plugged in.

The classic use is answering “does the system see this thing at all”: run lsusb, plug the device in, run it again, and compare. If a new line appears, the system has enumerated the device, so drivers, firmware, and application support are the next places to check. Enumeration does not prove that the device or cable is fully healthy, but it confirms that the USB host received a response. If nothing appears, try another port or cable before blaming the OS. Recent kernel messages from dmesg show the same plug events with more detail.

The tree view adds the piece the flat list lacks, which drivers claimed each device and at what speed it connected:

Terminal
lsusb -t

output

/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 10000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/12p, 480M
|__ Port 4: Dev 2, If 0, Class=Wireless, Driver=btusb, 12M
|__ Port 5: Dev 3, If 0, Class=Video, Driver=uvcvideo, 480M
|__ Port 9: Dev 4, If 2, Class=Human Interface Device, Driver=usbhid, 12M

A device present in lsusb but showing no Driver= entry here has been enumerated but has no kernel driver bound to that interface. That can indicate a missing kernel module or firmware package, although some devices are intentionally controlled by a userspace driver such as libusb. A USB 3 drive showing 480M instead of 5000M is connected through a USB 2 port or cable, a common reason external disks underperform.

For full descriptors of a single device, filter by its ID and add -v:

Terminal
sudo lsusb -v -d 046d:c52b

The verbose output is long; without root, parts of it are hidden.

Listing PCI Devices with lspci

PCI is where the built-in hardware lives: network controllers, graphics cards, storage controllers, and sound chips. The bare command lists them all:

Terminal
lspci

output

00:00.0 Host bridge: Intel Corporation Device a706
00:02.0 VGA compatible controller: Intel Corporation Raptor Lake-P [Iris Xe Graphics]
00:14.3 Network controller: Intel Corporation Raptor Lake PCH CNVi WiFi
00:1f.3 Audio device: Intel Corporation Raptor Lake-P/U/H cAVS
01:00.0 Non-Volatile memory controller: Samsung Electronics Co Ltd NVMe SSD Controller PM9A1

The leading 00:14.3 style address identifies the device’s slot and function, and the text after the class name identifies the chip. This is the fastest way to find out exactly which Wi-Fi or Ethernet chip a machine has, which is the first thing any driver search needs.

The single most useful option is -k, which shows the kernel driver bound to each device:

Terminal
lspci -k

output

00:14.3 Network controller: Intel Corporation Raptor Lake PCH CNVi WiFi
Subsystem: Intel Corporation Device 0094
Kernel driver in use: iwlwifi
Kernel modules: iwlwifi

Kernel modules lists what could drive the device, and Kernel driver in use shows what actually is. For a device that normally needs a kernel driver, modules listed but no driver in use can indicate missing firmware, a blacklisted module, or a binding problem. Some PCI functions do not need their own driver, so confirm the expected behavior before treating the missing line as an error. On systems with two GPUs, lspci -k is also the quick way to see which one is bound to which driver.

Two more options come up regularly. -nn appends the numeric [vendor:device] IDs, which are what you paste into a search engine or a driver compatibility list when the text name is ambiguous:

Terminal
lspci -nn | grep -i network

output

00:14.3 Network controller [0280]: Intel Corporation Raptor Lake PCH CNVi WiFi [8086:51f1]

And -s narrows the output to one slot, combined with -v or -vv for details like memory ranges, capabilities, and the current link speed of the slot:

Terminal
sudo lspci -vv -s 01:00.0

Getting a Full Inventory with lshw

Where lsusb and lspci each cover one bus, lshw walks everything the kernel knows: CPU, memory, firmware, disks, controllers, and the buses in between. Run it as root or the output will be incomplete. The full report is pages long, so start with the summary table:

Terminal
sudo lshw -short

output

H/W path Device Class Description
===========================================================
system ThinkPad T14 Gen 4
/0/0 memory 64KiB BIOS
/0/4 processor 13th Gen Intel Core i7-1355U
/0/13 memory 32GiB System Memory
/0/13/0 memory 16GiB SODIMM DDR5 5600 MHz
/0/13/1 memory 16GiB SODIMM DDR5 5600 MHz
/0/100/2 display Raptor Lake-P [Iris Xe Graphics]
/0/100/14.3 wlp0s20f3 network Raptor Lake PCH CNVi WiFi
/0/100/1d/0 /dev/nvme0 storage SAMSUNG MZVL21T0HCLR-00B00

This one screen answers most inventory questions: what model the machine is, which memory modules lshw detected, and what storage and network hardware is present. The two 16 GiB entries show how the detected memory is populated, but they do not confirm whether the machine has another empty slot. Check the vendor’s service manual before planning an upgrade.

To dig into one category, filter by class:

Terminal
sudo lshw -C memory
sudo lshw -C network

The class view for memory may include per-slot details such as speed and part numbers when the system firmware exposes them. For reports, lshw exports machine-readable and browsable formats:

Terminal
sudo lshw -json > hardware.json
sudo lshw -sanitize -html > hardware.html

The JSON output preserves detailed fields for local inventory tooling. Use the sanitized HTML file when sharing a report because -sanitize removes potentially sensitive values such as serial numbers and IP addresses.

For completeness: CPU details have their own dedicated tools, covered in our guide on getting CPU information on Linux , and sudo dmidecode reads the firmware’s DMI tables directly when you need BIOS versions or serial numbers that lshw summarizes.

Quick Reference

Task	Command
List USB devices	`lsusb`
USB tree with drivers and speeds	`lsusb -t`
Full descriptors for one USB device	`sudo lsusb -v -d 046d:c52b`
List PCI devices	`lspci`
PCI devices with kernel drivers	`lspci -k`
PCI devices with numeric IDs	`lspci -nn`
Details for one PCI slot	`sudo lspci -vv -s 01:00.0`
Hardware summary table	`sudo lshw -short`
One hardware class in detail	`sudo lshw -C network`
Machine-readable inventory	`sudo lshw -json`
Sanitized HTML report	`sudo lshw -sanitize -html`

Conclusion

lsusb confirms detection, lspci -k connects chips to drivers, and lshw turns a closed case into a readable inventory; between the three, “what hardware is this and is it working” stops requiring a screwdriver. When a device shows up in these listings but misbehaves, the kernel log usually explains why, so dmesg is the natural next stop.

How to Comment Out Multiple Lines in Vim

hello@linuxize.com (Linuxize) — Mon, 20 Jul 2026 11:20:00 +0200

Commenting out a block of lines is one of those edits you make constantly: disabling a section of a config file, switching off a function while debugging, or keeping an old approach around while testing a new one. In most editors that is select plus a single shortcut. Classic Vim has no comment shortcut out of the box, but it has three techniques that are just as fast once you know them, and recent versions ship a toggle plugin as well.

This guide shows how to comment out multiple lines in Vim with visual block mode, the substitute command, and the built-in comment plugin, and how to remove the comments again with each method.

Commenting with Visual Block Mode

The classic answer uses visual block mode to insert a comment character at the start of every selected line:

Move the cursor to the first column of the first line you want to comment.
Press Ctrl+V to enter visual block mode.
Press j (or the down arrow) until every target line is selected.
Press Shift+I to insert at the left edge of the block.
Type the comment character, # for shell scripts and config files.
Press Esc.

On Windows, Ctrl+V may be mapped to paste. If it does not start visual block mode, use Ctrl+Q instead.

The # appears on the first line while you type, which looks like the operation failed. It did not: the moment you press Esc, Vim repeats the insert on every line of the block.

For languages with two-character comments, type the whole prefix in step 5, for example // for C, JavaScript, and Go, or -- for SQL and Lua. The entire string is inserted on each line.

Because this selection starts in the first column, I prefixes every selected line, including empty lines. If you start the block farther to the right, Vim skips lines that end before the block’s left edge. Use the substitute method below when you want to prefix a line range regardless of line length.

Uncommenting with Visual Block Mode

The reverse uses the same block selection to delete a column of characters:

Place the cursor on the first comment character of the first line.
Press Ctrl+V, then j down to the last commented line.
If the comment prefix is longer than one character, press l once for each additional character to widen the block over the whole prefix.
Press x or d to delete the selected block on every line.

The highlighted column disappears from all lines at once. If you also inserted a space after the comment character, include it in the block before deleting.

Commenting with the Substitute Command

The substitute command edits a range of lines in one pass, which makes it the better tool when you already know the line numbers or when the block is large. To comment lines 10 through 20:

:10,20s/^/#/

The range 10,20 limits the substitution to those lines, ^ matches the empty start of each line, and the replacement inserts # there. Unlike block insert, this prefixes every line in the range, including blank ones.

You can also select the lines first with V and a movement, then press :. Vim inserts the '<,'> range for you, and you complete the command:

:'<,'>s/^/#/

Other ranges work the same way: % for the whole file and .,+4 for the current line and the four below it. If you use these often, turning on line numbers makes ranges much quicker to read off the screen; see How to Show Line Numbers in Vim .

To uncomment, delete the leading character instead of inserting it:

:10,20s/^#//

This removes the first # of each line in the range and leaves lines without one untouched. For a two-character prefix such as //, escaping the slashes gets noisy, so switch the delimiter to another punctuation character:

:'<,'>s#^//##

The substitute command accepts almost any punctuation as its separator, and using # here keeps the // readable. The full syntax, including flags and confirmation mode, is covered in Vim Find and Replace .

Keeping Indentation with :normal

Both methods above put the comment character in column one. To insert it in front of the first non-blank character instead, preserving the code’s indentation profile, run a normal mode command over the range:

:'<,'>norm I#

The :norm command replays its argument as keystrokes on every line in the range, and I in normal mode enters insert mode at the first non-blank character, so each line gets # right before its content rather than at the margin. Undo treats the whole operation as a single change, so u reverts every line at once.

Toggling Comments with gc

Modern Vim and Neovim can toggle comments with a mapping that knows each filetype’s comment syntax. Neovim 0.10 and later has it built in with no setup: select lines with V and press gc, or use gcc for the current line and gc followed by a motion, such as gcip for a paragraph. Pressing gc on commented lines uncomments them.

Vim 9.1.0375 and later bundles a similar optional comment package. Enable it for the current session with :packadd comment, or add this line to your vimrc to load it on startup:

~/.vimrcvim
packadd comment

After loading the package, the gc mappings work as described above and pick the right comment string automatically: # in a shell script, // in C, and " in a vimrc. On older Vim versions, the widely used commentary.vim plugin provides the same familiar mappings.

If you comment code many times a day, this is the method worth adopting, since toggling with gc replaces both the comment and uncomment workflows in one mapping.

Quick Reference

For a printable quick reference, see the Vim cheatsheet .

Action	Keys or command
Comment a block	`Ctrl+V`, select lines, `Shift+I`, type `#`, `Esc`
Uncomment a block	`Ctrl+V`, select the comment column, `x`
Comment lines 10-20	`:10,20s/^/#/`
Comment a visual selection	`:'<,'>s/^/#/`
Uncomment lines 10-20	`:10,20s/^#//`
Comment after indentation	`:'<,'>norm I#`
Toggle comments (Neovim 0.10+, Vim 9.1.0375+)	select with `V`, press `gc`
Toggle the current line	`gcc`
Undo the whole operation	`u`

Conclusion

For an occasional block, Ctrl+V, Shift+I, Esc is the fastest habit to build, and :s/^/#/ handles precise ranges and blank lines. If commenting is part of your daily editing, enable the gc mappings and get toggling in both directions. For selecting larger regions to operate on, see How to Select All in Vim .

What Is an Inode in Linux

hello@linuxize.com (Linuxize) — Sun, 19 Jul 2026 09:35:00 +0200

Running out of disk space normally means that a filesystem has no free bytes left. Sometimes, however, a command fails with “No space left on device” while df -h still shows available space. One possible cause is inode exhaustion: the filesystem can store more data, but it has no free metadata records for new files. Our guide on fixing “No space left on device” when df shows free space walks through that check and the other causes of the same error.

To understand why this happens, and why filenames and file contents are stored separately, you need to know what an inode is. This guide explains what an inode stores, how it relates to filenames and hard links, and how to check inode usage.

What an Inode Is

An inode (short for “index node”) is a data structure that a Unix-style filesystem uses to store metadata about a file or directory. Each file has an inode number that identifies it within that filesystem. The same number can appear on another filesystem, so an inode number is not unique across the entire system.

The inode holds almost everything the system needs to know about the file, except for its name and, in the usual case, the data itself. It records:

The file type, such as a regular file, directory, or symbolic link
The permissions and owner and group IDs
The file size and allocated blocks
The access, data modification, and status change timestamps
The hard-link count, which is the number of directory entries pointing to the file
The block map or extents that locate the file’s data

The exact on-disk format depends on the filesystem, but these fields are the ones you see through tools such as ls and stat.

Filenames Are Separate from Inodes

The detail that surprises many users is that the filename is not stored in the inode. A directory contains entries that map names to inode numbers. When you open report.txt, the system looks up that name in the directory, finds the inode number, reads the inode, and locates the file’s data.

This separation is what makes hard links possible. A hard link is another directory entry that points to the same inode. Both names are equal, and removing one name only decreases the inode’s link count. The filesystem releases the file’s storage after the last link is removed and no process still has the file open.

For a practical comparison of the two link types, see hard links vs symbolic links .

Viewing Inode Numbers

To see the inode number of a file, use the -i option with ls:

Terminal
ls -i report.txt

output

1310720 report.txt

The first column, 1310720, is the inode number. To list inode numbers for everything in a directory, run ls -li, which adds the inode number as the leftmost column of the long listing.

To display the metadata associated with the inode, use the stat command:

Terminal
stat report.txt

output

 File: report.txt
Size: 482 Blocks: 8 IO Block: 4096 regular file
Device: 8,1 Inode: 1310720 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ linuxize) Gid: ( 1000/ linuxize)
Access: 2026-01-01 14:02:11.000000000 +0100
Modify: 2026-01-01 13:55:40.000000000 +0100
Change: 2026-01-01 13:55:40.000000000 +0100
Birth: 2026-01-01 13:55:40.000000000 +0100

The Inode field shows the inode number, and Links shows the hard-link count. Change is the status change time, commonly called ctime. It changes when inode metadata such as permissions, ownership, or the link count changes. It is not the file creation time. The separate Birth field shows creation time when the filesystem supports it.

The filename appears at the top because you passed it to stat; it is not part of the inode.

How Filesystems Allocate Inodes

Inode allocation depends on the filesystem. Ext2, ext3, and ext4 create inode tables when the filesystem is formatted. This gives the filesystem a fixed inode density, so a workload that creates millions of small files can use every inode before it uses every data block.

You cannot change the inode density of an existing ext4 filesystem in place. Growing the filesystem can add block groups and more inodes, but if the filesystem cannot be expanded, the practical options are to remove unneeded files, move the workload, or recreate the filesystem with a higher inode count.

XFS and Btrfs allocate inodes dynamically from available filesystem space instead of creating one fixed inode table at format time. They can still reject new files when the filesystem runs out of usable data or metadata space, but they do not have the same fixed inode-count limit as ext4.

Checking Inode Usage

To see how many inodes the filesystem containing /var has and how many are free, pass the path to df with the -i option:

Terminal
df -i /var

output

Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sdb1 655360 655360 0 100% /var

The IUse% column is the one to watch. Here, inode usage on /var is at 100 percent even though the byte-based df -h /var might still report free space. The filesystem cannot create another file until an inode becomes available.

A large cache, session directory, mail queue, or temporary directory is a common source of inode exhaustion. GNU du can count inodes instead of bytes. The following command stays on the /var filesystem, checks two directory levels, and displays the largest totals at the bottom:

Terminal
sudo du --inodes -x -d 2 /var 2>/dev/null |
 sort -n |
 tail -20

Repeat the command on the directory with the highest count and increase the depth if needed. For other counting methods, see the guide on counting files in a directory .

Warning

Do not remove files only because a directory has a high inode count. First identify which application owns the files and use its cleanup or retention policy when one is available.

After cleanup, run df -i /var again to confirm that free inodes are available.

Conclusion

An inode connects a file’s metadata to its stored data while the directory keeps the filename separately. When a filesystem reports “No space left on device” despite having free bytes, check the affected path with df -i before deciding what to remove.

How to Select All in Vim: Copy, Delete, or Yank Every Line

hello@linuxize.com (Linuxize) — Sat, 18 Jul 2026 09:15:00 +0200

Sooner or later you will need to grab the entire contents of a file open in Vim, whether to paste a config file into a support ticket, move a script into another editor, or wipe everything and start over. In most editors that is Ctrl+A followed by Ctrl+C. Vim does not work that way, and pressing Ctrl+A increments the next number at or after the cursor instead of selecting text.

The quickest way to select all text in Vim is the ggVG command sequence in normal mode. This guide explains how it works and how to copy, delete, or run other commands on every line in the file, including copying the whole file to the system clipboard.

Selecting All Text with ggVG

To select all text in Vim, make sure you are in normal mode (press Esc if you are not), then type ggVG. The sequence is three separate commands executed one after another:

gg - Move the cursor to the first line of the file
V - Start line-wise visual mode
G - Jump to the last line, extending the selection over the whole file

Every line in the file is now highlighted. From here, Vim waits for an operator: press y to yank (copy) the selection, d to delete it, or any other visual mode command. To cancel the selection without doing anything, press Esc.

Copying (Yanking) All Lines

With the whole file selected, press y to yank it into Vim’s default register. The full sequence is ggVGy. You can then paste the text elsewhere in the same Vim session with p.

Visual mode is not required, though. If you already know you want to copy everything, the ex command :%y does the same thing without touching the selection:

:%y

The % range means “all lines”, so :%y yanks the entire file into the default register in one step. The normal mode equivalent is ggyG, which yanks from the first line to the last without entering visual mode.

To duplicate the whole file below itself, run :%y followed by G and p: yank all lines, jump to the end, and paste.

Copying All Lines to the System Clipboard

Yanked text normally stays inside Vim. To paste the file into a browser, email, or another application, copy it to the system clipboard using the "+ register:

ggVG"+y - Select all, then yank the selection to the system clipboard
gg"+yG - Yank all lines to the system clipboard without visual mode
:%y+ - Yank all lines to the system clipboard with an ex command

After any of these, paste into the other application with the regular paste shortcut for your desktop environment.

Info

The "+ register requires Vim compiled with the +clipboard feature. Check with vim --version | grep clipboard. If the output shows -clipboard, install a build with clipboard support, such as vim-gtk3 on Debian and Ubuntu systems.

If installing another Vim build is not an option, you can pipe the buffer to a clipboard utility instead. On X11 systems with xclip installed:

:%w !xclip -selection clipboard

This writes the whole buffer to the xclip command, which places it on the clipboard. On Wayland, use wl-copy from the wl-clipboard package the same way:

:%w !wl-copy

For more on registers and clipboard integration, see How to Copy, Cut and Paste in Vim .

Deleting All Lines

To select everything and delete it, use ggVGd, or skip visual mode with ggdG (move to the first line, then delete to the last line). The fastest option is again the ex command with the % range:

:%d

All lines are removed and the file is left with a single empty line. The deleted text lands in the default register, so an accidental :%d is easy to reverse: press u to undo , or paste the text back with p.

To delete every line without replacing the current contents of the unnamed register, send the deleted text to the black hole register:

:%d _

This preserves whatever was already available for pasting with p.

For ranges, patterns, and more deletion commands, see How to Delete Lines in Vim .

Running Other Commands on the Whole File

Selecting all text is not limited to copy and delete. With ggVG active, any visual mode operator applies to the entire file:

ggVG= - Re-indent every line (same as gg=G)
ggVGu - Convert the whole file to lowercase
ggVGU - Convert the whole file to uppercase
ggVG> - Shift every line one indent level to the right

For find and replace across the whole file, you do not need a selection at all: the substitute command takes the same % range, as in :%s/old/new/g. See Vim Find and Replace for the full syntax.

Quick Reference

For a printable quick reference, see the Vim cheatsheet .

Command	Description
`ggVG`	Select all lines
`ggVGy`	Select all and yank (copy)
`ggVGd`	Select all and delete
`ggVG"+y`	Select all and copy to the system clipboard
`ggyG`	Yank all lines without visual mode
`ggdG`	Delete all lines without visual mode
`:%y`	Yank all lines (ex command)
`:%y+`	Yank all lines to the system clipboard
`:%d`	Delete all lines
`:%d _`	Delete all lines without replacing the unnamed register
`gg=G`	Re-indent the whole file
`:%s/old/new/g`	Replace across the whole file
`u`	Undo the last change

Conclusion

Use ggVG when you want to see the whole-file selection before choosing an operator. When the action is already clear, the % range is shorter, as in :%y, :%d, or :%s/old/new/g. For selecting a smaller block to comment out, see How to Comment Out Multiple Lines in Vim .

Pattern	Description
`(ab)+`	ERE group repeated one or more times
`\(ab\)\+`	The same group in BRE
`cat\|dog`	ERE alternation, either side matches
`cat\\|dog`	The same alternation in GNU BRE
`^(a\|b)c$`	Alternation limited to the group
`\1`	Whatever group 1 matched
`\(.\)\1`	Any character repeated twice

Feature	Syntax by Flavor
Grouping	BRE `\(ab\)`; ERE and PCRE `(ab)`
Alternation	GNU BRE `a\\|b`; ERE and PCRE `a\|b`
One or more	GNU BRE `a\+`; ERE and PCRE `a+`
Optional	GNU BRE `a\?`; ERE and PCRE `a?`
Interval	BRE `a\{2,4\}`; ERE and PCRE `a{2,4}`
Backreference	BRE and PCRE `\1`; GNU grep and GNU sed also accept `\1` in ERE, but POSIX ERE and awk do not
`\d` and lookaround	PCRE supports both; BRE and ERE do not
Default in	BRE: `grep`, `sed`; ERE: `grep -E`, `sed -E`, awk; PCRE: `grep -P`

Linux Tips, Tricks and Tutorials on Linuxize

Bash Pattern Matching: =~ Operator and Regular Expressions

Glob Patterns vs Regex #

Glob Matching with [[ ]] #

Character Classes #

Extended Globs #

The =~ Regex Operator #

Capture Groups with BASH_REMATCH #

The case Statement #

Match File Extensions #

Anchoring and Whole-String Matches #

Quick Reference #

Troubleshooting #

Conclusion #

SSH Config Cheatsheet

File Locations #

Inspect the Effective Config #

Host Patterns #

Match Blocks #

Connection Basics #

Keys and Authentication #

Jump Hosts #

Keepalives #

Multiplexing #

Port Forwarding #

Host Key Checking #

Session and Environment #

Tokens #

Troubleshooting #

Related Guides #

How to Resize and Extend a Linux Partition and Filesystem

Quick Reference #

Disk, Partition, and Filesystem Layers #

Step 1: Identify the Layout #

Step 2: Grow the Partition #

Alternative: Growing the Partition with parted #

Step 3: Grow the Filesystem #

ext4 #

XFS #

Btrfs #

Extending LVM Volumes #

Verifying the New Size #

Shrinking a Partition #

Troubleshooting #

Conclusion #

SQLite Cheatsheet

Open and Inspect #

Run SQL #

Output Formats #

CSV Import and Export #

Transactions and Locks #

Backup and Restore #

sqlite3 Command Line: Create and Query SQLite Databases

Installing sqlite3 #

Opening and Creating a Database #

Creating Tables and Inserting Data #

Querying Data #

Updating and Deleting Rows #

Running Queries from the Shell #

Importing and Exporting CSV #

Backing Up and Restoring #

Quick Reference #

Troubleshooting #

Conclusion #

Fix npm Error: unable to get local issuer certificate

What the Error Means #

Check the npm Configuration #

Find the Missing Certificate #

Method 1: Trust the CA Certificate #

Set a CA Bundle for npm Only #

Method 2: Use the System CA Store #

Ubuntu, Debian, and Derivatives #

Fedora, RHEL, and Derivatives #

Enable System Certificates in Node.js #

Keep TLS Verification Enabled #

Troubleshooting #

Conclusion #

How to Diagnose OOM Killer Events in Linux

Quick Reference #

What the OOM Killer Does #

Glob Patterns vs Regex

Glob Matching with [[ ]]

Character Classes

Extended Globs

The =~ Regex Operator

Capture Groups with BASH_REMATCH

The case Statement

Match File Extensions

Anchoring and Whole-String Matches

Quick Reference

Troubleshooting

Conclusion

File Locations

Inspect the Effective Config

Host Patterns

Match Blocks

Connection Basics

Keys and Authentication

Jump Hosts

Keepalives

Multiplexing

Port Forwarding

Host Key Checking

Session and Environment

Tokens

Troubleshooting

Related Guides

Quick Reference

Disk, Partition, and Filesystem Layers

Step 1: Identify the Layout

Step 2: Grow the Partition

Alternative: Growing the Partition with parted

Step 3: Grow the Filesystem

ext4

XFS

Btrfs

Extending LVM Volumes

Verifying the New Size

Shrinking a Partition

Troubleshooting

Conclusion

Open and Inspect

Run SQL

Output Formats

CSV Import and Export

Transactions and Locks

Backup and Restore

Installing sqlite3

Opening and Creating a Database

Creating Tables and Inserting Data

Querying Data

Updating and Deleting Rows

Running Queries from the Shell

Importing and Exporting CSV

Backing Up and Restoring

Quick Reference

Troubleshooting

Conclusion

What the Error Means

Check the npm Configuration

Find the Missing Certificate

Method 1: Trust the CA Certificate

Set a CA Bundle for npm Only

Method 2: Use the System CA Store

Ubuntu, Debian, and Derivatives

Fedora, RHEL, and Derivatives

Enable System Certificates in Node.js

Keep TLS Verification Enabled

Troubleshooting

Conclusion

Quick Reference

What the OOM Killer Does

Confirm an OOM Event

Read the Process Table in the Log

Check Service and Container Memory Limits

Check systemd-oomd

Inspect and Adjust OOM Scores

Prevent the Next OOM Event

Troubleshooting

Conclusion