Prelude-The Philosophy Behind the Syllabus¶

Sit with this document for an evening before week 1.

1. Linux Is a Kernel + a Contract¶

Linus Torvalds writes the kernel. The GNU project, glibc, BusyBox, systemd, and countless others build a userspace around it. What people call "Linux" is the interface between these layers-and that interface is what a Linux engineer must master.

The contract has three surfaces:

The system call ABI-man 2 syscalls. Stable across kernel versions for 25+ years. The kernel's most binding promise.
The procfs / sysfs / netlink interfaces-semi-stable, documented in Documentation/ABI/ in the kernel tree. The control surface for nearly every tunable.
The character/block device file interface-/dev. Hardware abstracted as files; the most Unix idea in Linux.

If you internalize "everything is a file or a syscall," the kernel/userspace boundary becomes legible.

2. The Five-Axis Cost Model¶

A working Linux engineer reasons about every system change along five axes:

Axis	Question to ask
Boundary cost	Does this cross a syscall? A context switch? A copy from userspace?
Memory	Where is this allocated-slab, page, anon, file-backed, hugepage?
Scheduler	What runqueue does this run on? Will it preempt? Is it RT-class?
Isolation	Which namespace, cgroup, capability, MAC label?
Failure	What does the OOM killer do? What does the audit log show?

Beginner courses teach axis 1 only. This curriculum forces all five into your hands by week 12.

3. The Reading List¶

Primary - Linux Kernel Development, Robert Love (3e). The canonical introductory text. - Understanding the Linux Kernel, Bovet & Cesati. Older but unmatched depth on memory management and process control. - The Linux Programming Interface, Michael Kerrisk. The stdlib/syscall reference. Treat as a pinned tab. - Systems Performance, Brendan Gregg (2e). The performance bible. - BPF Performance Tools, Brendan Gregg. Required for Month 3.

Documentation - Documentation/ in the kernel tree. Particularly Documentation/admin-guide/, Documentation/networking/, Documentation/cgroup-v2.rst, Documentation/scheduler/, Documentation/vm/. - `man-pages - Kerrisk's project. Read sections 2 (syscalls), 3 (libc), 5 (file formats), 7 (overviews).

Adjacent - TCP/IP Illustrated, Vol. 1, Stevens. For the networking month. - Operating Systems: Three Easy Pieces, Arpaci-Dusseau. Free, excellent, foundational.

4. Curriculum Philosophy: "Read the Source, Trace the Syscall"¶

Three rules:

Source first, blog second. When the curriculum says "study the page-fault handler," it means open mm/memory.c::handle_mm_fault and read it. Blogs go stale; commits are dated.
strace and perf are the teachers. When you do not understand why a program behaves as it does, the first response is strace -fc, the second is perf trace, and only the third is to ask another human.
One lab per concept, one upstream interaction per phase. By the end of each month: an lkml.org reply, a documentation typo fix, a bpftrace recipe shared, or a kernel-module experiment posted publicly.

5. What Linux Is Not For¶

A graduate of this curriculum should be able to argue these points:

Hard real-time. Stock Linux is preemptible but not hard-RT. PREEMPT_RT is in tree but still not microseconds-deterministic. Use Xenomai, RTEMS, or QNX.
Storage with strict tail-latency requirements. Linux block layer adds tens-of-microseconds variance. SPDK or DPDK-on-userspace bypasses the kernel entirely.
Code where the team has no C, no syscall, no signal-handling intuition. A team that has not debugged a signalfd, a vfork() race, or a misconfigured ulimit will struggle.

6. A Note on AI-Assisted Workflows¶

Never run AI-suggested dd, mkfs, cryptsetup, iptables -F, or systemctl mask without reading the man page first. The blast radius of a bad command at this layer is the entire system.
Verify privileged commands on a VM before any production host. qemu-system-x86_64 with a Debian cloud image and 30 seconds of cloud-init is a reasonable scratch environment.

You are now ready for Week 1. Open 01_MONTH_KERNEL_FOUNDATIONS.md.