Eight tracks

Each track is a question the kernel already answers and almost nobody reads the answer to. Prose on one side, a running kernel on the other, and every claim a program you can run against it.

• Processes

  lands in M2

  What exactly does the child get?

  fork and what is copied, shared and reset; exec and what survives it; wait and who reaps; zombies and orphans; process groups, sessions and the controlling terminal.

• Descriptors

  lands in M2

  Which of the three levels is this bug in?

  The fd table, the open file description and the inode, drawn apart. dup2 and redirection, the offset two processes share after fork, O_APPEND against lseek and write, pipe capacity and the deadlock that follows from not draining one, and leaks as you can see them.

• Signals

  lands in M2

  When is this delivered, and what does it interrupt?

  Dispositions and masks, what cannot be caught, delivery at syscall boundaries, EINTR and the restart that does not happen, SIGCHLD, SIGPIPE, and why kill -9 is not a solution but an admission.

• PID 1 and lifecycle

  lands in M3

  Why does your container take ten seconds to stop?

  What init owes the system: reaping, forwarding SIGTERM, exec in an entrypoint so the shell gets out of the way, graceful shutdown and the grace period that runs out.

• Identity and permission

  lands in M4

  Who does the kernel think you are?

  Real and effective uid and gid, supplementary groups, the mode bits and the one function that checks them, setuid and the confused deputy, dropping privilege in the right order, and capabilities instead of root.

• /proc and observability

  lands in M3

  What is this process actually doing?

  Reading state rather than guessing it. strace and what it costs, D state and why you cannot kill it, and fd and memory forensics on a process you did not start.

• Namespaces and cgroups

  lands in M5

  What is a container, before any container tooling exists?

  PID, mount, net, user and UTS namespaces as views a process holds, and cgroup v2 as a tree: memory.max and the OOM killer's score, cpu.max and throttling that looks like a slow disk.

• Reading what was generated

  lands in M6

  What will the kernel do with this?

  The track the rest exists for. You are handed the entrypoint script, the systemd unit, the subprocess call or the privilege-dropping helper that a model wrote, and asked what the kernel will do with it. Then you run it and read the trace.

  /audit

No lesson is written yet. The kernel is built first — a lesson whose claims cannot be run against a live kernel is an article, and there are enough of those.