Skip to main content

How Linux works, without commands

Summary: five notions are enough to understand 90% of Linux: the kernel, the shell, the file tree, the processes and the permissions. This lesson explains them one by one, visually, without asking you to type anything.

1. The kernel — the invisible orchestra​

You already met the kernel in lesson 2. Quick reminder: it is the only program allowed to talk directly to the hardware. Every application (browser, database, game) must go through it to read a file, write to a disk, or send a network packet.

This centralization guarantees two fundamental things:

  • A crashing program does not take the computer down — because it never had the keys to the hardware.
  • Two programs cannot step on each other — the kernel arbitrates memory access.

2. The shell — your privileged interlocutor​

The shell is the program that interprets your orders and passes them to the kernel. On Linux, the most common shell is called Bash (Bourne Again Shell). Others exist (Zsh, Fish, Sh) but Bash remains the reference.

The shell lets you:

  • Run programs (nginx, python, docker…).
  • Manipulate files (cp, mv, rm, ls…).
  • Chain commands with pipes (|) to combine their power.
  • Write scripts — text files containing a series of commands to replay automatically.

The shell is Linux's true signature. Many administration tasks that would take hours of clicking on Windows are done in one line of shell on Linux.

3. The file tree — a single tree for everything​

On Windows, you have several roots: C:\, D:\, E:\. On Linux, there is only one, simply called /. Everything else — external disks, USB sticks, network shares, devices — attaches to it as subfolders.

Two rules to remember:

  • The root / has no drive letter. It is just /.
  • The "everything is a file" principle of the Unix philosophy applies here: a hard drive, a USB port, the RAM, the kernel's state — everything appears as files in this tree. It is this uniformity that makes Linux so programmable.

The most useful locations to know:

FolderContains
/home/aliceThe personal folder of user Alice
/etc/nginx/nginx.confThe configuration of the Nginx web server
/var/log/The system's and applications' logs
/tmp/Temporary files, erased on reboot
/usr/bin/The programs available to all users

4. Processes — the running programs​

A process is a program that is running. Every process has:

  • A unique identifier called PID (Process ID).
  • An owner (the user who started it).
  • An allocated amount of memory.
  • A parent process that created it.

Point to remember: on a typical Linux server, there are permanently a hundred to several thousand processes running in parallel. The kernel orchestrates them by giving each one a slice of processor time in turn, so fast that the user has the illusion they all run simultaneously.

A famous command (top or htop) lets you watch this dance live.

5. Permissions — three questions, three answers​

Every file and folder belongs to a user and a group, and carries three permissions defined for three distinct audiences.

The three audiences​

The three permissions​

For each of the three audiences above, three permissions are defined:

PermissionOn a fileOn a folder
Read (r)Open and read the contentList the files it contains
Write (w)Modify or erase the contentCreate, rename, delete files in the folder
Execute (x)Run the file as a programEnter the folder

Concrete example​

A file /etc/passwd (the list of users) typically has the following permissions:

  • Owner (root): read + write.
  • Group (root): read only.
  • Other users: read only.

In other words, everyone can consult the list of users, but only the administrator can modify it. It is this simple, rigorous system that makes Linux very hard to compromise when properly configured.

6. The root account — the superuser​

On Linux, there is a special account called root (also called superuser or administrator). It has all the rights: it can read, write, erase any file, kill any process, modify the kernel.

Absolute rule in production: you never log in directly as root. You log in as a normal user, and you request root rights temporarily with the sudo command ("substitute user do"). This practice leaves a clear trace of who did what, and minimizes catastrophic mistakes of the "I erased all of production by typing the wrong command" kind.

7. The complete workflow, in a single picture​

Here is everything you have learned, on one vertical diagram.

This sequence repeats billions of times per day on every Linux server in the world. Understanding these five building blocks means understanding 90% of what happens behind every web application, every container, every cloud deployment.

Remember in 30 seconds​

  • Kernel = the only program that talks to the hardware. It arbitrates everything.
  • Shell (Bash) = your interlocutor. It interprets your orders and passes them to the kernel.
  • File tree = a single root /, everything is a file in this tree.
  • Process = a running program, with a PID, an owner, memory.
  • Permissions = read, write, execute, for three audiences (owner, group, others).
  • Root = all the rights. To be used only temporarily through sudo.

Next: Real-world use cases →