Linux guides
94 guides · advanced.
Run a Self-Hosted Jitsi Meet for Video Calls
Deploy a private Jitsi Meet server with docker-jitsi-meet, configure TURN/STUN for NAT traversal, set up systemd auto-start, and scale with multiple Videobridges.
Self-Host a Matrix Server (Synapse)
Deploy a production Matrix Synapse homeserver with PostgreSQL, Nginx TLS reverse proxy, federation, and optional bridges on your own Linux VPS.
Self-Host CryptPad (Encrypted Office Suite)
Deploy CryptPad, the zero-knowledge encrypted office suite, with Docker Compose, nginx TLS, a custom domain pair, and configurable registration policies.
Self-Host a Browser-Based Dev Env (Coder/code-server)
Install code-server or Coder OSS on a Linux server, configure workspaces, harden authentication, and expose the browser IDE securely via nginx and Let's Encrypt.
Build a Stratum-1 NTP Server on a Pi
Build a GPS-disciplined Stratum-1 NTP server on a Raspberry Pi using a PPS-capable GPS module, chrony refclock directives, and the pps-gpio kernel driver.
Linux for Video Editors
Set up GPU drivers, DaVinci Resolve workarounds, Kdenlive, OBS with PipeWire capture, and OpenTimelineIO on Linux for a professional video editing workflow.
Linux for Security Researchers (Lab Setup)
Build a KVM-based security research lab with isolated networks, Kali tools on mainstream distros, snapshot discipline, INetSim decoy networks, and safe malware capture workflows.
Linux for Music Producers
Set up a Linux pro-audio DAW: real-time kernel, PipeWire JACK bridge, Ardour, Carla plugin host, and Windows VSTs via yabridge on Debian, Fedora, and Arch.
Linux Color Management for Professionals
Set up a professional Linux color management pipeline using colord, ArgyllCMS, and DisplayCAL to calibrate your display and ensure consistent ICC color across GIMP, Darktable, and Scribus.
Flash Tasmota onto an ESP8266/ESP32 Device
Flash Tasmota firmware onto ESP8266/ESP32 devices from Linux using esptool.py, configure GPIO templates, connect to MQTT, and enable OTA updates.
Install and Customise Hyprland
Install Hyprland on Arch and Fedora, configure monitors, animations, blur, and status bars, then script your compositor with the IPC event socket.
ZFS on Root on Debian (deep dive)
Install Debian 12 with ZFS on root: partition layout, boot pool vs root pool, dataset hierarchy, GRUB configuration, and first-boot verification.
Set Up an Encrypted ZFS Pool
Configure native ZFS encryption with aes-256-gcm, manage keys and boot unlock, rotate keys safely, and replicate datasets encrypted with zfs send -w.
Write Your First Kernel Module
Build, load, and debug a Linux kernel module from scratch: hello-world source, kbuild Makefile, insmod/modprobe workflow, and dmesg debugging on modern distros.
The Linux Page Cache Explained
Deep dive into Linux page cache mechanics: how reads and writes flow through cache, dirty page writeback, fsync durability guarantees, and vm.dirty_* sysctl tuning.
Terraform State Management
Migrate Terraform from local to S3+DynamoDB remote state, enable locking, and master state surgery commands to handle drift and refactors safely.
Seccomp-BPF Syscall Filtering
Apply seccomp-BPF syscall filtering with libseccomp and systemd SystemCallFilter to harden Linux services using allowlists, denylists, and argument-level rules.
Rootless Podman for Server Workloads
Run production containers without root using Podman's user namespaces, systemd Quadlets, subuid/subgid mapping, and rootless networking on Linux servers.
PostgreSQL Performance Tuning
Tune PostgreSQL 15/16 with pg_stat_statements for query visibility, smarter autovacuum thresholds, targeted indexing, and parallel query execution.
PostgreSQL Streaming Replication
Set up PostgreSQL 16 streaming replication with a primary and hot standby, covering WAL configuration, pg_basebackup, sync vs async modes, and manual failover.
PostgreSQL Backup and Point-in-Time Recovery
Learn PostgreSQL PITR: configure WAL archiving, take base backups with pg_basebackup, manage production backups with pgBackRest, and restore to a specific timestamp.
Set Up a MariaDB Galera Cluster
Set up a synchronous three-node MariaDB Galera Cluster: gcomm addressing, bootstrap sequence, SST with mariabackup, garbd arbitrator, and split-brain prevention.
Linux Memory: Anonymous, File-backed, zswap
Deep dive into Linux anonymous vs file-backed pages, reclaim mechanics, vm.swappiness, zswap compression tuning, and zram setup for maximum memory efficiency.
Linux Virtual Memory Tuning
Tune Linux virtual memory for production: control overcommit_memory, swappiness, min_free_kbytes, and use drop_caches safely to reduce OOM kills and swap pressure.
Bufferbloat-Free Networking with CAKE
Fix bufferbloat on Linux using CAKE qdisc with tc, including autorate-ingress for variable links, persistent systemd configuration, and latency verification.
Linux Namespaces Deep Dive
A hands-on guide to all seven Linux namespace types — mnt, pid, net, user, uts, ipc, cgroup — plus unshare and nsenter with concrete shell examples.
The Linux CPU Scheduler Explained
Deep dive into the Linux CPU scheduler: how CFS, nice values, real-time policies, multi-queue SMP, and the new sched_ext BPF framework work and how to tune them.
Linux Capabilities Explained
Learn how Linux capability bits work, how to audit and replace setuid binaries with setcap/getcap, and how to use ambient capabilities in systemd services.
Hands-on Linux Auditing with auditd
Learn to configure auditd rules, watch critical files and syscalls, and extract actionable security intelligence with ausearch and aureport on modern Linux.
Distributed Tracing with Tempo or Jaeger
Set up OpenTelemetry Collector with Grafana Tempo or Jaeger, instrument a Python service with OTLP exporters, and verify end-to-end distributed traces.
Try Stalwart, a Modern Rust Mail Server
Install Stalwart, a single-binary Rust mail server, with SMTP, IMAP4, JMAP, DKIM, SPF, and DMARC configured end-to-end on a Linux VPS.
Install ROCm for AMD GPUs on Linux
Install AMD's ROCm compute platform on Ubuntu, Fedora, and Arch Linux: add repos, install packages, configure groups, and verify with rocminfo.
Configure PipeWire for Pro Audio
Configure PipeWire as a full JACK replacement for pro audio: low-latency buffer tuning, realtime scheduling privileges, MIDI bridging, and DAW integration.
Install the NVIDIA CUDA Toolkit on Linux
Install NVIDIA CUDA on Linux the right way: understand driver vs toolkit, choose distro packages or the runfile, and verify with deviceQuery. Covers Ubuntu, Fedora, and Arch.
Self-Host Mail with Mailcow Dockerized
Deploy a full self-hosted mail server with Mailcow Dockerized: DNS setup, DKIM, SOGo groupware, Let's Encrypt TLS, automated backups, and monitoring.
Build a Kubernetes Cluster with kubeadm
Bootstrap a production Kubernetes cluster with kubeadm: control-plane init, Calico or Cilium CNI, worker joins, kubelet hardening, and safe minor-version upgrades.
Set Up a Multi-Node k3s Cluster
Deploy a production-ready k3s cluster with embedded etcd HA across server and agent nodes — covering installation, joining, kubeconfig, and safe rolling upgrades.
Install Flux on k3s
Bootstrap Flux CD on a k3s cluster, set up GitRepository and Kustomization reconciliation, and deploy applications via HelmRelease — step by step.
Runtime Security with Falco
Install Falco with the modern eBPF probe, write custom detection rules, and route real-time runtime security alerts to Grafana Loki and Slack.
Install DaVinci Resolve on Linux
Install DaVinci Resolve on Ubuntu, Fedora, and Arch Linux with correct GPU drivers, codec workarounds, and audio fixes for a working professional setup.
Install ComfyUI for Stable Diffusion
Install ComfyUI for Stable Diffusion on Linux: set up a Python venv, install PyTorch for CUDA or ROCm, place models, tune GPU memory flags, and add custom nodes.
Install BunkerWeb for nginx-based WAF
Deploy BunkerWeb as an nginx-based WAF using Docker Compose, configure ModSecurity with OWASP CRS, enable bot blocking, and verify malicious traffic is blocked.
Install Argo CD on k3s
Install Argo CD on a k3s single-node cluster using Helm, then create and auto-sync your first GitOps Application from a Git repository.
Self-Host the Tailscale Control Plane with Headscale
Run your own Tailscale control plane with Headscale: install, configure TLS, register nodes with pre-auth keys, and enforce ACL policies on your infrastructure.
Build a Custom Kernel the Debian Way
Build a custom Linux kernel on Debian or Ubuntu using make deb-pkg, producing clean .deb packages for easy install, update, and rollback.
Apply CIS Benchmarks with OpenSCAP
Use OpenSCAP and scap-security-guide to evaluate, report on, and remediate Linux systems against CIS Benchmarks — covering install, eval, and automation.
Configure Prometheus Alertmanager
Configure Prometheus Alertmanager with routing trees, receivers, inhibition rules, grouping, Go templates, and PagerDuty/Slack on-call integrations.
ZFS Snapshots and Send/Receive
Create atomic ZFS snapshots, replicate datasets incrementally over SSH with zfs send/receive, and automate retention policies using zfs-auto-snapshot.
Virtualisation with QEMU/KVM (deep dive)
Full guide to QEMU/KVM with libvirt: storage pools, virtual networks, virsh management, CPU pinning, and VFIO GPU passthrough on Linux.
Use a YubiKey for SSH and GPG
Move SSH and GPG private keys onto a YubiKey using the OpenPGP applet with gpg-agent and FIDO2 resident keys, with touch policies and offline backups.
Use cgroup v2 for Resource Limits
Learn to use cgroup v2 with systemd slices, scopes, MemoryMax, CPUWeight, and IOWeight to enforce precise resource limits on Linux services and processes.
Use bpftrace for Live Kernel Tracing
Learn to use bpftrace for live Linux kernel tracing: one-liners, tracepoints, kprobes, and syscall latency histograms with real eBPF scripts.
Use osquery for Linux Host Visibility
Install osquery on Linux, write SQL queries against processes, files, and sockets, configure FIM packs, and enroll hosts into a Fleet manager for full fleet visibility.
NUMA and CPU Pinning on Linux
Pin processes to specific CPUs and NUMA nodes using taskset, numactl, and systemd cgroup cpusets to cut memory latency and boost throughput on multi-socket Linux servers.
An Introduction to NixOS
NixOS uses declarative configuration and atomic generations to make Linux systems reproducible and rollback-capable. Learn installation, flakes, and when it fits.
Mail Server Deliverability Checklist
A step-by-step advanced checklist covering PTR records, HELO identity, SPF, DKIM, DMARC, TLS, blocklist remediation, and IP warm-up for a deliverable mail server.
Lock Down systemd Services (Sandboxing)
Harden Linux daemons using systemd sandboxing directives: ProtectSystem, PrivateTmp, NoNewPrivileges, CapabilityBoundingSet, and SystemCallFilter explained step by step.
Linux Network Bonding (LACP and active-backup)
Configure Linux network bonding in LACP (802.3ad) and active-backup modes, including switch setup, systemd-networkd, NetworkManager, and fault-injection testing.
An Introduction to io_uring
Learn how io_uring's shared ring buffers work, benchmark it against libaio with fio, and harden multi-tenant Linux servers against its known attack surface.
Turn a Linux Box into a Router
Configure a Linux machine as a full router: static interfaces, kernel IP forwarding, nftables NAT, dnsmasq DHCP, and DNS forwarding — step by step.
Hugepages and Transparent Huge Pages
Learn when Transparent Huge Pages hurt database performance, how to disable THP persistently with systemd, and how to configure static hugepages for PostgreSQL and other databases.
GPU Passthrough for a Gaming VM
Pass a GPU directly to a KVM/QEMU Windows VM using IOMMU, vfio-pci, and Looking Glass — with honest notes on anti-cheat compatibility.
Auto-unlock LUKS at Boot with TPM2 and Clevis
Bind a LUKS2 volume to your TPM2 chip with Clevis so encrypted disks unlock automatically at boot—without sacrificing your recovery passphrase.
nftables from Scratch
Build a complete nftables firewall from scratch: tables, chains, hooks, sets, maps, NAT, and atomic transactional updates explained with real rules.
Set Up a Mail Server with Postfix
Build a complete self-hosted mail server with Postfix, Dovecot IMAP, OpenDKIM signing, SPF, and DMARC—step by step for Debian, Fedora, and Arch.
How to Tune PostgreSQL for Performance
Tune PostgreSQL for production by configuring shared_buffers, work_mem, autovacuum, index hygiene, and pg_stat_statements query profiling — with per-distro commands.
How to Build a WireGuard Mesh Between Servers
Build a WireGuard mesh VPN across multiple servers: key generation, per-node configs, AllowedIPs routing logic, NAT traversal, firewall rules, and full verification.
How to Set Up Kubernetes with k3s
Set up a lightweight Kubernetes cluster with k3s on Linux: single-node or multi-node, kubectl config, and your first real deployment in under 30 minutes.
How to Observe a Linux System with eBPF
Use bpftrace one-liners and BCC tools to trace syscalls, I/O latency, CPU flame graphs, and TCP sessions on a live Linux system with minimal overhead.
How to Install NixOS
Install NixOS from scratch: partition disks, write configuration.nix, pick a channel, run nixos-install, and master the nixos-rebuild workflow for atomic system changes.
How to Configure ModSecurity as a Web Application Firewall
Install ModSecurity with OWASP CRS on Apache or Nginx, run it in detection mode to catch false positives, tune exclusions, then enforce blocking.
ZFS on Linux: The Basics
Set up OpenZFS on Linux: create pools with mirroring or RAID-Z, manage datasets with compression and quotas, and use snapshots for instant backups.
X11 Programming with the Athena Widgets
Build a working X11 GUI application using Xlib, the Xt Intrinsics, and the Athena widget set — covering the full stack from wire protocol to compiled binary.
X11 Pixmaps and Bitmaps
Learn X11 XPM and XBM image formats: file structure, creation with ImageMagick, loading via Xlib/libxpm in C, viewing tools, and when to migrate to PNG or SVG.
How to Tune Kernel Parameters with sysctl
Learn how to tune Linux kernel parameters at runtime and permanently using sysctl and /etc/sysctl.d, with practical network and VM tunables explained.
The Linux Framebuffer Console
Understand Linux framebuffer internals, the fbdev-to-DRM/KMS evolution, and how to set a crisp high-resolution console with the right kernel parameters.
Software RAID on Linux with mdadm
Build and manage Linux software RAID arrays with mdadm: choose the right RAID level, create and persist the array, monitor health, replace a failed disk, and handle boot safely.
How to Set Up KVM Virtualization
Set up KVM/QEMU virtualization on Linux with libvirt and virt-manager. Covers hardware checks, installation on Ubuntu, Fedora, and Arch, networking, and creating VMs.
How to Set Up a DNS Server with BIND
Install and configure BIND 9 as a caching resolver and authoritative nameserver, with forward/reverse zones, common resource records, and firewall rules.
SELinux Explained (and How to Live With It)
Learn SELinux modes, file contexts, booleans, and how to fix denials with restorecon, setsebool, and audit2allow — without ever disabling it.
Remote X Sessions with XDMCP (and modern alternatives)
Learn how XDMCP works, why it is insecure, and how to replace it with X2Go, VNC-over-SSH, xrdp, or native Wayland remoting on modern Linux systems.
How to Profile Linux Performance
Learn to profile Linux performance using the USE method, perf stat, perf record, flame graphs, and scheduler tracing to systematically find CPU, memory, and I/O bottlenecks.
Multicast Networking on Linux
Configure IPv4/IPv6 multicast on Linux: addressing, IGMP group membership, interface flags, and live testing with iperf3 and socat.
Building Linux Thin Clients
Deploy Linux thin clients using modern LTSP, PXE boot, and NFS root setups. Covers server config, squashfs images, UEFI/BIOS PXE, and Wayland caveats.
Limit Bandwidth on Linux with tc
Shape Linux network traffic with tc, HTB qdiscs, and fq_codel. Enforce per-interface and per-host bandwidth limits that survive reboots via systemd.
An Introduction to eBPF
Learn what eBPF is, how the kernel verifier keeps it safe, and how to use bpftrace to trace syscalls, disk I/O, and CPU scheduling with working examples.
An Introduction to cgroups
Learn how cgroups v2 work, how systemd maps services onto the cgroup tree, and how to set CPU, memory, and I/O limits for processes and services.
How to Install Arch Linux
Install Arch Linux using the guided archinstall script or the full manual method — covering partitioning, base system, bootloader, and first-boot setup.
GTK GUI Programming on Linux
Build, run, and package GTK4 applications on Linux using C and Python. Covers the GObject model, signals, Meson builds, .desktop files, and Flatpak.
How to Compile the Linux Kernel
Step-by-step guide to downloading, configuring, compiling, and booting a custom Linux kernel from kernel.org on Debian, Fedora, and Arch Linux.
C Serial Port Programming on Linux
Learn to open /dev/ttyS* and /dev/ttyUSB* in C, configure raw mode with termios, handle blocking reads, and debug serial link problems on Linux.
How to Audit a Linux System with auditd
Set up auditd on Linux to track file access, syscalls, and privilege use. Covers persistent rules, file watches, ausearch, and aureport across major distros.
Assembly Language on Linux: A Starter Guide
Write x86-64 assembly on Linux from scratch: install NASM and GAS, learn syscalls, assemble and link a working program, then inspect and debug it.
AI and Artificial-Life Tools on Linux
Set up open-source AI/ML and artificial-life toolkits on Linux: PyTorch, JAX, DEAP, Avida, NetLogo, and RL environments with GPU driver guidance.