1. UNIX/Linux Architecture: the layered view
The screenshot shows a core UNIX idea: users and applications do not directly control the hardware. They normally move through layers. Applications call libraries, libraries and shells use system calls, the kernel enforces security and resource control, and the hardware executes the actual work.
Click a ring to learn the layer
Hardware
The physical or virtual machine: CPU, RAM, disks, network cards, keyboard, screen, and cloud/VM devices. The kernel hides hardware differences and presents consistent abstractions.
Command journey animation
Example: when a trainee runs ls -l /etc, the request travels through several layers.
What the shell really does
The shell expands wildcards, variables, quotes, aliases, and redirections. Then it usually creates a child process and replaces that child with the requested program using the exec family of system calls.
2. Linux is a multiuser, multitasking operating system
Multiuser means many users can work safely on the same system
Linux was designed for shared systems. Multiple users can log in locally, over SSH, through terminal sessions, or through services. Each user has an identity, usually represented internally by a UID and one or more GIDs.
The kernel enforces who can read, write, execute, signal, or control resources. This is why one trainee can have files under /home/student1 while another has separate files under /home/student2.
| Concept | Meaning | Useful commands |
|---|---|---|
| User identity | Who is running the command | whoami, id |
| Logged-in users | Current user sessions | who, w |
| Permissions | Allowed actions on files/directories | ls -l, chmod, chown |
| Privilege elevation | Run specific commands as another user, commonly root | sudo, su |
Multitasking means many processes share CPU time
A Linux system may run hundreds or thousands of processes. The CPU can execute only a limited number of threads at the same instant, so the kernel scheduler rapidly switches between runnable tasks. This creates the practical effect that many programs run at once.
time slice
Beginner mental model
A person or service identity. Examples: root, jp, nginx, postgres.
A running program with a PID. Example: one terminal shell, one web server worker, one backup script.
The kernel checks whether that user/process can perform the requested operation.
3. UNIX/Linux is case sensitive
In Linux, uppercase and lowercase letters are different characters in file names, directory names, commands, usernames, variables, and many configuration values.
Common mistakes trainees make
| Wrong assumption | Correct Linux behavior |
|---|---|
Documents and documents are the same | They can be two different directories. |
PATH and path are the same variable | PATH is commonly used by the shell. path is a different variable. |
LS should run like ls | Command names are case sensitive. LS usually fails unless such a command exists. |
| Config values are always forgiving | Many Linux tools treat names exactly as written. |
4. IPC: Inter-Process Communication
Processes often need to cooperate. IPC is how one process sends data, events, or control messages to another process. The shell pipeline in ps aux | grep ssh is one of the easiest IPC examples for beginners.
IPC animation: Process A sends data to Process B
Producer, sender, writer, client, parent, or command before the pipe.
echo "error"
pipe/socket/signal/shared memory
Consumer, receiver, reader, server, child, or command after the pipe.
grep error
IPC methods trainees should know
| IPC type | Example |
|---|---|
| Pipes | cat file | grep error |
| Signals | kill -TERM <pid> |
| Sockets | Web server, SSH, database connections |
| Shared memory | High-speed local communication |
| Message queues | Structured messages between processes |
| Files/locks | Simple coordination through filesystem |
5. Linux does not depend on filename extensions
Linux does not require a file to have an extension such as .txt, .sh, .log, or .conf. Extensions are mainly conventions used by humans and applications.
script.txt can still run if it has executable permission and a valid interpreter line, although that naming would confuse humans.How Linux decides what a file is
| Question | Linux/Unix behavior |
|---|---|
| Can a file have no extension? | Yes. Example: /bin/ls, /etc/hosts, Makefile. |
| Can a file have many dots? | Yes. Example: app.prod.backup.2026. |
Does .sh make a script executable? | No. Executable permission and interpreter/format matter. |
| How can I inspect type? | Use file filename, ls -l, head, or application-specific tools. |
6. Everything is a file or a process: the Unix abstraction
Everything is a file: what it really means
UNIX popularized a clean abstraction: many resources can be accessed using file-like operations such as open, read, write, and close. This does not mean every resource is a regular text file. It means many things can be represented by file descriptors or filesystem entries.
| Resource | Where trainees see it | Meaning |
|---|---|---|
| Regular files | /etc/hosts | Stored data |
| Directories | /var/log | Containers of names |
| Devices | /dev/sda, /dev/null | Device interface |
| Pipes | |, named FIFOs | Stream between processes |
| Sockets | Network/service endpoints | Communication channel |
| Process info | /proc/<pid> | Kernel view of running process |
Everything active is a process
A running program is represented as a process. A process has a PID, parent PID, owner, state, memory mappings, open files, environment, and command line.
/bin/bashPID 245/proc/245Important distinction
A file is stored data or an interface. A process is a running instance of a program. One program file can be used to create many processes. Example: many users can each run their own bash process from the same /bin/bash file.
7. Hands-on labs
These labs are safe for a training VM. Run as a normal user unless a command explicitly says otherwise. Avoid running destructive commands on production systems.
Lab 1 — Multiuser and identity
whoami id who w ps -u "$USER" -o pid,ppid,user,stat,comm | head # Optional on a lab VM with sudo access: sudo useradd trainee1 sudo passwd trainee1 su - trainee1 whoami exit
Expected learning
Trainees should see their username, UID/GID, login sessions, and processes owned by their user.
Lab 2 — Multitasking and jobs
sleep 300 & jobs ps -o pid,ppid,stat,comm -p $! kill $! jobs
Expected learning
The shell can start a background process. The kernel tracks it using a PID. A signal can request that it terminates.
Lab 3 — Case sensitivity
mkdir case-lab cd case-lab touch Report.txt report.txt REPORT.txt ls -l cat > Demo <<'EOF' This is Demo EOF cat > demo <<'EOF' This is demo EOF cat Demo cat demo cd ..
Expected learning
Linux treats differently cased names as different names.
Lab 4 — Filename extensions are conventions
mkdir extension-lab cd extension-lab cat > runme <<'EOF' #!/bin/bash echo "I have no .sh extension, but I can run." EOF chmod +x runme ./runme cat > script.txt <<'EOF' #!/bin/bash echo "My extension says .txt, but I am still a shell script." EOF chmod +x script.txt ./script.txt file runme script.txt cd ..
Expected learning
The extension does not grant execution. Permissions and content format are what matter.
Lab 5 — IPC using a pipe
printf "ok\nerror\nwarning\nerror\n" | grep error ps aux | grep ssh journalctl -n 20 2>/dev/null | grep -i error || true
Expected learning
The output of one process becomes the input of another process.
Lab 6 — Named pipe / FIFO
mkdir ipc-lab cd ipc-lab mkfifo trainee_pipe # Terminal 1: cat trainee_pipe # Terminal 2: echo "hello from another process" > trainee_pipe # Cleanup: rm trainee_pipe cd ..
Expected learning
A named pipe appears as a filesystem entry, but it behaves like a communication channel.
Lab 7 — Everything is file-like
ls -l /dev/null printf "discard this" > /dev/null ls -l /proc/$$ cat /proc/$$/cmdline | tr '\0' ' '; echo ls -l /proc/$$/fd
Expected learning
/dev/null is a device file. /proc/$$ exposes information about the current shell process. fd shows open file descriptors.
8. Quick command reference
| Objective | Command | Explanation |
|---|---|---|
| See current user | whoami | Prints the effective user name. |
| See UID/GID | id | Shows user ID, primary group, and supplementary groups. |
| See users logged in | who, w | Shows sessions and activity. |
| See processes | ps aux, top | Lists running work on the system. |
| Send a signal | kill -TERM PID | Requests a process to terminate cleanly. |
| Inspect file type | file filename | Reads content clues rather than only the name extension. |
| Show permissions | ls -l | Displays type, permissions, owner, group, size, and timestamp. |
| Use IPC pipe | cmd1 | cmd2 | Sends stdout of one process to stdin of another. |
| See process pseudo-files | ls /proc/$$ | Shows kernel information about the current shell. |
9. Assessment quiz
Use this at the end of the session or as a revision check.
Report.txt and report.txt always the same file?.sh alone make a file executable?10. Trainer notes and teaching sequence
Recommended 60–90 minute flow
- Show the original architecture image and ask trainees to identify the center and outer layers.
- Explain hardware → kernel → system call → libraries/shell → apps.
- Run the multiuser and process commands.
- Demonstrate case sensitivity live.
- Run pipe and FIFO IPC labs.
- Show filename extension examples.
- Close with
/proc,/dev/null, and quiz.
Common correction points
- Linux is not “only command line”; it has GUI layers too, but the CLI makes architecture visible.
- “Everything is a file” is an abstraction, not a claim that everything is a plain text file.
- Extensions help people and applications, but permissions and content matter more to Linux.
- Multiuser does not mean everyone has admin rights. Root privilege is exceptional.
- IPC is everywhere: pipes, terminals, web services, databases, logging, service managers.