Linux Tips, Tricks and Tutorials on Linuxize

Regular Expressions Explained: How Regex Patterns Work

hello@linuxize.com (Linuxize) — Mon, 03 Aug 2026 10:10:00 +0200

Sooner or later every command line session runs into a matching problem that plain text search cannot solve: find lines that start with a number, pull every email address out of a log, or replace dates in one format with another. Regular expressions (regex) are the pattern language that solves these problems, and the same core syntax works in grep, sed, awk, text editors, and most programming languages.

This guide explains the building blocks of regular expressions, anchors, character classes, quantifiers, grouping, and alternation, and shows how the same pattern carries from grep to sed and awk.

What a Regular Expression Is

A regular expression is a pattern that describes a set of strings. Instead of matching one literal word, a pattern like ^error [0-9]+ matches any line that starts with “error” followed by a space and one or more digits.

The examples in this guide use GNU grep -E (extended regular expressions), so every pattern works as written. You can test any of them by piping text into grep :

Terminal
echo "error 404" | grep -E '^error [0-9]+'

output

error 404

The line prints because it matches the pattern. When there is no match, grep prints nothing and returns a non-zero exit status. Always single-quote the pattern so the shell does not interpret characters like $ and * before grep sees them.

Literal Characters and Metacharacters

Most characters in a regex match themselves: the pattern cat matches the string “cat” anywhere in a line, including inside “concatenate”. A handful of characters have special meanings instead of matching literally:

txt
. ^ $ * + ? ( ) [ ] { } | \

These are the metacharacters, and the rest of this guide is about what they do. To match one of them literally, escape it with a backslash: \. matches a real dot, \$ a real dollar sign.

Anchors and Word Boundaries

Anchors and word boundaries do not match characters; they match positions in the line.

^ - Matches the start of the line.
$ - Matches the end of the line.
\b - Matches a word boundary, the position between a word character and a non-word character.

The \b boundary is a GNU grep extension rather than part of POSIX extended regular expression syntax.

The difference is easiest to see on real input. The following input contains three similar lines, but the pattern prints only the line that consists of exactly the word “root”:

Terminal
printf 'root\nroot:x:0:0\nchroot\n' | grep -E '^root$'

output

root

Without anchors, the pattern root would also match “chroot” or a line where “root” appears in the middle. Word boundaries solve the substring problem without pinning the match to the whole line:

Terminal
echo "the cat scattered" | grep -E -o '\bcat\b'

output

cat

The -o flag prints only the matched text. Notice that “scattered” did not produce a match, because “cat” inside it is not surrounded by word boundaries.

Character Classes: Matching Sets

Square brackets match one character from a set:

[abc] - One character: a, b, or c.
[a-z] - One lowercase letter; ranges also work for [0-9] and [A-Z].
[^abc] - Negation: one character that is NOT a, b, or c.

For example, to match “gray” and “grey” with one pattern:

Terminal
printf 'gray\ngrey\ngroy\n' | grep -E 'gr[ae]y'

output

gray
grey

The third line does not match because “o” is not in the set. Inside brackets, most metacharacters lose their special meaning; [.] matches a literal dot.

POSIX character classes are named shortcuts that work inside brackets: [[:digit:]] is equivalent to [0-9], [[:alpha:]] matches letters, [[:space:]] matches whitespace. Many tools also support the Perl-style shorthands \d wherever PCRE is available (grep -P), but the bracket forms are the portable choice for shell work.

The Dot and Quantifiers: Matching Repetition

The dot . matches any single character except a newline. Quantifiers apply to the preceding item and control how many times it may repeat:

* - Zero or more times.
+ - One or more times.
? - Zero or one time (optional).
{n} - Exactly n times.
{n,m} - Between n and m times.

Combining the dot with a quantifier gives .*, which matches anything, including nothing. A more precise example matches an IPv4-looking address by requiring one to three digits in each group:

Terminal
echo "server at 192.168.1.10 is up" | grep -E -o '[0-9]{1,3}(\.[0-9]{1,3}){3}'

output

192.168.1.10

Reading it piece by piece: [0-9]{1,3} matches the first number group, \. matches a literal dot, and the parentheses with {3} repeat the dot-plus-number sequence three times.

A common beginner mistake is reaching for * when + is meant. The pattern [0-9]* happily matches an empty string, so it succeeds on every line; [0-9]+ actually requires a digit.

Grouping and Alternation

Parentheses group parts of a pattern, and the pipe | provides alternation (OR):

Terminal
printf 'error: disk full\nwarning: low memory\ninfo: started\n' | grep -E '^(error|warning):'

output

error: disk full
warning: low memory

The group limits the alternation to the two words before the colon; without parentheses, ^error|warning: would mean “starts with error, OR contains warning: anywhere”, which is rarely what you want.

Groups also capture what they match, and the captured text can be reused. In sed , \1 refers to the first group, which makes reordering text possible:

Terminal
echo "2026-01-15" | sed -E 's/([0-9]{4})-([0-9]{2})-([0-9]{2})/\3.\2.\1/'

output

15.01.2026

The three groups capture the year, month, and day, and the replacement writes them back in reverse order.

Basic vs Extended Regular Expressions

POSIX defines two regex dialects, and the difference trips up almost everyone at some point. In basic regular expressions (BRE), which plain grep and sed use, the characters +, ?, |, {}, and () match literally, and you must escape them (\+, $ … $) to get the special behavior. In extended regular expressions (ERE), they are special by default.

Construct	ERE (`grep -E`, `sed -E`, `awk`)	BRE (plain `grep`, `sed`)
One or more	`+`	`\+`
Optional	`?`	`\?`
Repetition	`{n,m}`	`\{n,m\}`
Grouping	`(...)`	`$...$`
Alternation	`a\|b`	`a\|b`, GNU extension only

That last row is the one to watch. Alternation is not part of POSIX BRE at all, so \| works in GNU grep and GNU sed but fails silently on the BSD sed that ships with macOS.

In practice, the simplest rule is: pass -E to grep and sed and write in the extended dialect, as every example in this guide does. awk uses extended syntax natively:

Terminal
printf 'alice 92\nbob 47\ncarol 78\n' | awk '/^[ab]/ {print $1}'

output

alice
bob

The awk pattern selects lines starting with “a” or “b” and prints the first field. grep -P enables a third dialect, Perl-compatible regular expressions (PCRE), which adds features like \d and lookarounds; reach for it when the POSIX dialects run out.

One Pattern, Three Tools

The syntax is shared, but each tool wraps it differently, which is the part that usually causes confusion when moving a working pattern from one command to another. Create a small log file to follow along:

Terminal
printf 'error: disk full\nwarning: low memory\ninfo: started\n' > app.log

Because grep is a filter, the pattern is the whole job and needs nothing around it:

Terminal
grep -E '^(error|warning):' app.log

sed prints every input line unless you suppress that with -n, so selecting lines takes an address followed by an explicit p command:

Terminal
sed -E -n '/^(error|warning):/p' app.log

awk reads a bare pattern with no action block as “print the matching line”:

Terminal
awk '/^(error|warning):/' app.log

output

error: disk full
warning: low memory

All three print the same two lines and skip the “info” line. Where the tools part company is what happens after the match. grep reports lines and stops there, sed can rewrite the matched text, and awk splits each matching line into fields you can work with:

Terminal
awk -F': ' '/^(error|warning):/ {print $2}' app.log

output

disk full
low memory

Setting the field separator to ': ' makes $2 the message text, so the pattern selects the lines and the action block pulls out the part you actually wanted. This is why it pays to learn regex once as its own subject: the pattern you write today for grep is the same pattern you will paste into sed, awk, a text editor, or a Python script tomorrow.

Quick Reference

Pattern	Matches
`.`	Any single character
`^` / `$`	Start / end of line
`\b`	Word boundary in GNU grep
`[abc]` / `[^abc]`	One of the set / one not in the set
`[0-9]`, `[[:digit:]]`	One digit
`*` / `+` / `?`	Zero or more / one or more / optional
`{n,m}`	Between n and m repetitions
`(foo\|bar)`	foo or bar
`\1`	Text captured by the first group
`\.`	Literal dot (escaped metacharacter)

Conclusion

Anchors, character classes, quantifiers, and groups combine into patterns that handle most day-to-day matching on Linux, and the same vocabulary carries over to editors and programming languages. To put the syntax to work in specific tools, see our guides to regular expressions in grep and find and replace with sed .

git worktree: Work on Multiple Branches at Once

hello@linuxize.com (Linuxize) — Sun, 02 Aug 2026 09:20:00 +0200

A common frustration when working with Git is needing to switch branches while your current working tree has uncommitted changes. You can stash the changes , switch branches, make the fix, switch back, and restore the stash, but that flow interrupts your work and can create conflicts. git worktree lets you check out another branch in a separate directory, so both workspaces remain available at the same time.

This guide explains how to create, list, lock, prune, and remove linked worktrees, with a hotfix workflow you can copy.

How git worktree Works

A Git repository normally has one working tree: the directory where you edit files. With git worktree, you can attach additional working trees to the same repository. Each linked worktree has its own working directory, index, and HEAD, while all worktrees share the same object store and repository history. You do not create another clone; you create another workspace for the same repository.

git worktree Syntax

The most-used forms of the command are:

txt
git worktree add [OPTIONS] <path> [<commit-ish>]
git worktree list [OPTIONS]
git worktree remove [--force] <worktree>
git worktree prune [OPTIONS]
git worktree lock [--reason <string>] <worktree>
git worktree unlock <worktree>

Add a Worktree for an Existing Branch

Suppose you are working on a feature branch and want a separate checkout of main. Add it in a sibling directory without leaving your current branch:

Terminal
git worktree add ../project-main main

output

Preparing worktree (checking out 'main')
HEAD is now at a1b2c3d Fix typo in README

The new directory ../project-main contains main, while your original working tree stays on the feature branch. Git refuses this command if main is already checked out in another worktree.

Add a Worktree with a New Branch

For a hotfix, create a new branch from main and check it out in one step:

Terminal
git worktree add -b hotfix/payment-null ../project-hotfix main

output

Preparing worktree (new branch 'hotfix/payment-null')
HEAD is now at a1b2c3d Fix typo in README

The -b flag creates hotfix/payment-null from main and checks it out in the new directory. After making the fix and running your tests, commit and push from that worktree:

Terminal
cd ../project-hotfix
# Edit the files and run your tests
git add .
git commit -m "Fix payment handler"
git push -u origin hotfix/payment-null

Your original directory remains on the feature branch throughout this workflow.

List All Worktrees

To display the main worktree and every linked worktree, run:

Terminal
git worktree list

output

/home/user/project abc1234 [feature/new-dashboard]
/home/user/project-hotfix def5678 [hotfix/payment-null]
/home/user/project-main a1b2c3d [main]

The first entry is always the main worktree. Each linked worktree shows its path, current commit, and checked-out branch.

Run Tests Across Branches in Parallel

Worktrees are useful for running a test suite against two commits at the same time. For a temporary test directory that does not need its own branch, create a detached worktree:

Terminal
git worktree add --detach ../project-test main
(cd ../project-test && npm ci && npm test) &
npm test &
wait

The first background job installs dependencies and runs the tests against main in ../project-test, while the second runs in your current worktree. Both worktrees share the Git object store but keep their working files and installed dependencies separate.

Remove a Worktree

When you are done with a linked worktree, remove it:

Terminal
git worktree remove ../project-hotfix

This deletes the linked directory and unregisters it from the repository. It does not delete the hotfix/payment-null branch.

Git refuses to remove a worktree with modified or untracked files. Check its status before deciding whether to force removal:

Terminal
git -C ../project-hotfix status

Warning

The --force option deletes the linked directory even when it contains modified or untracked files. Commit or copy anything you need before running it.

If you are certain that the remaining files are disposable, force the removal with:

Terminal
git worktree remove --force ../project-hotfix

Prune Stale Worktree References

If you delete a worktree directory manually, Git retains its administrative entry. Preview the stale entries that qualify for removal with:

Terminal
git worktree prune --dry-run --verbose

After reviewing the output, remove those entries with:

Terminal
git worktree prune --verbose

This command removes stale metadata, not active worktree directories. git gc also prunes missing entries older than the configured gc.worktreePruneExpire period, which defaults to three months.

Lock a Worktree

If a worktree lives on a removable drive or a network path that may be temporarily unavailable, lock it so prune does not remove it:

Terminal
git worktree lock --reason "on external drive" ../project-hotfix

Unlock it when the path is available again:

Terminal
git worktree unlock ../project-hotfix

A lock also protects the worktree from git worktree remove, and a single --force is not enough to override it:

output

fatal: cannot remove a locked working tree, lock reason: on external drive
use 'remove -f -f' to override or unlock first

Unlock the worktree first, or pass the force option twice:

Terminal
git worktree remove --force --force ../project-hotfix

Quick Reference

For a printable quick reference, see the Git cheatsheet .

Command	Description
`git worktree add ../path branch`	Check out an existing branch in a linked worktree
`git worktree add -b new-branch ../path main`	Create a new branch from `main` in a linked worktree
`git worktree add --detach ../path main`	Create a detached worktree for testing
`git worktree list`	List the main and linked worktrees
`git worktree lock --reason "text" ../path`	Protect a temporarily unavailable worktree from pruning
`git worktree remove ../path`	Delete and unregister a clean linked worktree
`git worktree prune --dry-run --verbose`	Preview stale administrative entries
`git worktree repair /new/path`	Repair the link to a manually moved worktree

Troubleshooting

Git reports that a branch is already checked out
A branch can normally be checked out in only one worktree. Create a new branch from it instead:

Terminal
git worktree add -b new-branch ../project-new main

If you only need the files for testing and do not plan to commit, use a detached worktree:

Terminal
git worktree add --detach ../project-test main

Git cannot find a manually moved worktree
If you moved a linked directory without git worktree move, repair its administrative link from another worktree:

Terminal
git worktree repair /new/path

Use the new location as the argument. Git reconnects the linked directory without checking it out again.

Conclusion

git worktree keeps parallel tasks isolated without creating another clone or disturbing your current files. Create a dedicated branch for changes, use detached worktrees for temporary tests, and see the git branch guide when you need to rename, inspect, or delete the branches afterward.

killall Command in Linux: Kill Processes by Name

hello@linuxize.com (Linuxize) — Sat, 01 Aug 2026 08:40:00 +0200

When a program misbehaves, it may leave several processes running. Modern browsers start separate worker processes, and a stuck script may have been launched several times in different terminals. Killing each one with the kill command means looking up every PID first. The killall command skips that step: you give it a process name, and it signals every process running under that name.

This guide explains how to use killall to terminate processes by name, choose the signal to send, and narrow matches by user, age, or pattern.

Installing killall

killall is part of the psmisc package, which is preinstalled on most desktop and server distributions. If the command is missing, install it from the standard repositories.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install psmisc

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install psmisc

Warning

On Linux, the psmisc version of killall affects only processes matching the given name. On some other Unix systems, such as Solaris and AIX, killall signals nearly every process on the machine, which is how those systems tear things down at shutdown. Confirm which implementation is installed before running killall on a remote system, especially as root.

killall Syntax

The general syntax of the killall command is as follows:

txt
killall [OPTIONS] NAME...

NAME is the process name to match. You can pass more than one name, and killall signals every process that matches any of them. Unlike pkill, which matches partial names, killall requires the name to match exactly.

killall exits with status zero when it successfully signals at least one process for every name you supplied. If a name does not match, it prints a message and returns a non-zero status:

Terminal
killall firefox

output

firefox: no process found

Killing a Process by Name

To terminate a process, pass its exact name:

Terminal
killall firefox

By default, killall sends the SIGTERM signal, which asks each matching process to shut down cleanly. The command produces no output when it succeeds. Add -v to confirm what was signalled:

Terminal
killall -v vlc

output

Killed vlc(8143) with signal 15

The output shows the process name, its PID, and the signal number. Signal 15 is SIGTERM.

Before sending a signal, use pgrep to preview exact matches and their full command lines:

Terminal
pgrep -a -x firefox

If this command prints nothing, check ps -e -o pid,comm to find the process name that Linux reports.

Sending a Specific Signal

When a process ignores SIGTERM, you can send a stronger signal. The -s option accepts a signal name or number:

Terminal
killall -s KILL myscript

SIGKILL cannot be caught or ignored, so the process is terminated immediately without a chance to clean up. The same signal can be written in two shorter forms:

Terminal
killall -9 myscript
killall -SIGKILL myscript

Use SIGKILL only after a plain killall has failed. A process killed this way cannot flush buffers or remove its temporary files, which is why trying SIGTERM first is the safer habit. For a longer discussion of signals and when to use each, see our guide on how to kill a process in Linux .

Signals are also useful for more than termination. For example, BIND reloads its configuration when the named process receives SIGHUP:

Terminal
sudo killall -s HUP named

To list all signal names that killall understands, use -l:

Terminal
killall -l

output

HUP INT QUIT ILL TRAP ABRT BUS FPE KILL USR1 SEGV USR2 PIPE ALRM TERM STKFLT
CHLD CONT STOP TSTP TTIN TTOU URG XCPU XFSZ VTALRM PROF WINCH POLL PWR SYS

Matching Names Case-Insensitively

Process name matching is case-sensitive by default. If you are not sure about the capitalization, add -I:

Terminal
killall -I "teamviewer"

This matches TeamViewer, teamviewer, and any other case variant of the name.

Matching with Regular Expressions

The -r option interprets the name as an extended regular expression, so you can signal several related processes at once:

Terminal
killall -r '^chrom.*'

The ^ anchor limits the match to names that begin with chrom, such as chrome and chromium. Quote the pattern so the shell does not interpret special characters before killall sees them.

Killing Processes Owned by a User

The -u option restricts matches to processes owned by a specific user:

Terminal
killall -u sarah node

This terminates only the node processes running under the sarah account, leaving other users’ node processes alone.

If you pass -u without a process name, killall signals every process the user owns:

Terminal
sudo killall -u sarah

Be careful with this form. It terminates the user’s entire session, including their shell and any editors with unsaved work. Combine it with -i when you want to review each process first.

Confirming Each Kill Interactively

The -i option asks for confirmation before signalling each matching process:

Terminal
killall -i node

output

Kill node(2211) ? (y/N)
Kill node(2384) ? (y/N)

Answer y to signal a process or press Enter to skip it. Interactive mode is a good safety net when a name is common enough to match processes you did not have in mind.

Filtering by Process Age

The -o (older) and -y (younger) options filter matches by how long a process has been running. The time is a whole number followed by a unit: s for seconds, m for minutes, h for hours, d for days, w for weeks, M for months, and y for years.

To kill myscript processes that have been running for more than an hour:

Terminal
killall -o 1h myscript

To kill only instances started within the last ten minutes:

Terminal
killall -y 10m myscript

The age filters are handy for cleaning up stuck workers or runaway cron jobs while leaving fresh, healthy instances running.

Waiting for Processes to Die

By default, killall sends the signal and returns immediately. The -w option makes it wait until all signalled processes have actually terminated:

Terminal
killall -w myscript && echo "all stopped"

This is useful in scripts that must not continue until a service is fully down. The wait can continue forever if the signal is ignored, has no effect, or leaves the process in a zombie state.

To put a ten-second limit on the wait, run killall through the timeout command :

Terminal
timeout 10s killall -w myscript

If the limit expires, timeout stops the killall command, but the target process may still be running. Inspect it with pgrep before deciding whether to send SIGKILL. A process that remains in a zombie state can also cause killall -w to keep waiting.

killall vs kill vs pkill

All three commands send signals; they differ in how you select the target processes:

kill targets a specific PID. It is the most precise option, but you have to look the PID up first.
killall targets an exact process name and signals every instance of it.
pkill targets a name pattern, so pkill fire matches firefox. It can also match against the full command line with -f.

The exact-name behavior of killall makes it more predictable than pkill for everyday use: killall node cannot accidentally match node_exporter. Linux limits the process name stored in /proc/PID/stat to 15 characters. For longer names, killall may have to fall back to those first 15 characters when the full name is unavailable. Add -e to skip a long-name match that cannot be verified exactly.

Common Options

-s SIGNAL - Send the given signal instead of SIGTERM. Also accepts the -SIGNAL and numeric forms.
-l - List known signal names.
-v - Report each signal that was successfully sent.
-q - Do not complain when no process matched.
-I - Match process names case-insensitively.
-r - Interpret the name as an extended regular expression.
-e - Require an exact match for names longer than 15 characters.
-u USER - Match only processes owned by the given user.
-i - Ask for confirmation before signalling each process.
-o TIME - Match only processes older than the given age.
-y TIME - Match only processes younger than the given age.
-w - Wait until all signalled processes have died.

Quick Reference

For a printable quick reference, see the kill cheatsheet .

Task	Command
Terminate all processes with a name	`killall firefox`
Force kill after a failed terminate	`killall -9 firefox`
Reload BIND’s configuration	`sudo killall -s HUP named`
Ignore name capitalization	`killall -I teamviewer`
Match names by regex	`killall -r '^chrom.*'`
Kill a user’s instances of a program	`killall -u sarah node`
Kill all of a user’s processes	`sudo killall -u sarah`
Confirm each kill	`killall -i node`
Kill instances older than one hour	`killall -o 1h myscript`
Wait until processes exit	`killall -w myscript`
List signal names	`killall -l`

Troubleshooting

killall: no process found
killall requires the process name to match exactly unless you use -r or -I. Run pgrep -a pattern or ps -e -o pid,comm to check the reported name, capitalization, and command line before trying again.

Operation not permitted
You can signal your own processes, but another user’s process normally requires root privileges. Verify the exact target first, then rerun the command with sudo only when needed.

killall -w does not return
The process may have ignored the signal, stayed in a zombie state, or been replaced by a new process with the same PID while killall was checking it. Stop waiting with Ctrl+C, inspect the target with pgrep -a -x NAME, and use SIGKILL only if the process is still running and cannot shut down cleanly.

Conclusion

killall terminates every instance of a program in one command, with filters for user, age, and case when the name alone is too broad. When you need pattern matching instead of exact names, reach for pkill , and when you need to inspect processes before killing them, start with pgrep .

AWS CLI Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 31 Jul 2026 13:35:00 +0200

Installation and Setup

Install AWS CLI version 2 and set the basic configuration. Full walkthrough in installing and configuring the AWS CLI on Linux .

Command	Description
`curl https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip -o awscliv2.zip`	Download the x86_64 installer
`curl https://awscli.amazonaws.com/awscli-exe-linux-aarch64.zip -o awscliv2.zip`	Download the ARM64 installer
`unzip awscliv2.zip`	Extract the installer
`sudo ./aws/install`	Install AWS CLI version 2
`sudo ./aws/install --update`	Update from a freshly extracted installer
`aws --version`	Show the installed version
`aws configure`	Interactive credential and region setup
`aws configure list`	Show active settings and where they come from
`aws configure get region`	Read a single config value
`aws configure set region eu-central-1`	Write a single config value
`complete -C aws_completer aws`	Enable Bash command completion
`aws ec2 help`	Open the reference for a service

Profiles and Authentication

Static access keys configured with aws configure live in ~/.aws/credentials, while other settings live in ~/.aws/config. Prefer temporary credentials from aws login or IAM Identity Center.

Command	Description
`aws login`	Sign in with AWS console credentials
`aws login --profile dev`	Sign in to a named profile
`aws login --remote`	Sign in from a host without a browser
`aws logout --profile dev`	Clear cached login credentials for a profile
`aws configure --profile dev`	Configure a profile with an access key
`aws s3 ls --profile dev`	Run one command as a profile
`export AWS_PROFILE=dev`	Use a profile for the whole shell
`aws configure list-profiles`	List configured profiles
`aws configure sso`	Set up an IAM Identity Center profile
`aws sso login --profile dev`	Start or refresh an SSO session
`aws sso logout`	Clear cached SSO credentials
`aws sts get-caller-identity`	Show the account and identity in use
`aws sts assume-role --role-arn arn --role-session-name cli`	Get temporary role credentials
`export AWS_REGION=eu-west-1`	Override the region for the shell

Common Options

Frequently used options. Availability depends on the service and operation.

Option	Description
`--region eu-west-1`	Target a specific region
`--profile dev`	Use a named profile
`--output json`	Set the response format
`--no-cli-pager`	Print output instead of opening a pager
`--dry-run`	Check permissions without acting on supported EC2 operations
`--cli-auto-prompt`	Prompt for parameters interactively
`--no-paginate`	Return only the first page from a paginated operation
`--page-size 100`	Set the API page size for a paginated operation
`--max-items 20`	Limit output from a paginated operation
`--cli-input-json file://params.json`	Read parameters for a modeled API operation
`--generate-cli-skeleton`	Print a parameter template for a modeled API operation
`--debug`	Print the full request and response trace

Output Formatting and Queries

The --query option uses JMESPath and runs client side. Service-specific options such as --filters run server side, which can reduce response size and improve response time for large data sets. Pipe --output json into jq when a query gets hard to read.

Command	Description
`aws s3api list-buckets --output table`	Human-readable table
`aws s3api list-buckets --output text`	Tab-delimited text
`aws s3api list-buckets --output yaml`	YAML response
`aws s3api list-buckets --query "Buckets[].Name"`	Return one field
`aws ec2 describe-instances --query "Reservations[].Instances[].[InstanceId,State.Name]" --output text`	Return several fields as columns
`aws ec2 describe-instances --query "Reservations[].Instances[?State.Name=='running'].InstanceId"`	Filter results client side
`aws ec2 describe-instances --filters Name=instance-state-name,Values=running`	Filter results server side
`aws ec2 describe-volumes --query "Volumes[0:5]"`	Slice the result list
`aws ec2 wait instance-running --instance-ids i-0abc123`	Block until a state is reached

S3 Buckets and Objects

Everyday transfers with the high-level aws s3 commands. More examples in aws s3 commands .

Command	Description
`aws s3 ls`	List all buckets
`aws s3 ls s3://bucket --recursive --summarize`	List objects with a size total
`aws s3 cp file.txt s3://bucket/`	Upload a file
`aws s3 cp s3://bucket/file.txt .`	Download a file
`aws s3 cp ./dir s3://bucket/dir --recursive`	Upload a directory
`aws s3 sync ./dir s3://bucket/dir`	Copy only new and changed files
`aws s3 sync ./dir s3://bucket/dir --delete --dryrun`	Preview a mirror that removes stale files
`aws s3 rm s3://bucket/dir/ --recursive --dryrun`	Preview a recursive delete
`aws s3 mb s3://bucket`	Create a bucket
`aws s3 rb s3://bucket`	Remove an empty bucket
`aws s3 presign s3://bucket/file.txt --expires-in 3600`	Generate a temporary download link

EC2 Instances

Launch, inspect, and control instances.

Command	Description
`aws ec2 describe-instances`	List instances and their details
`aws ec2 describe-instances --instance-ids i-0abc123`	Details for one instance
`aws ec2 describe-instance-status`	Health and scheduled events
`aws ec2 run-instances --image-id ami-0abc --instance-type t3.micro --key-name mykey`	Launch an instance
`aws ec2 start-instances --instance-ids i-0abc123`	Start a stopped instance
`aws ec2 stop-instances --instance-ids i-0abc123`	Stop an instance
`aws ec2 reboot-instances --instance-ids i-0abc123`	Reboot an instance
`aws ec2 terminate-instances --instance-ids i-0abc123`	Permanently terminate an instance
`aws ec2 create-tags --resources i-0abc123 --tags Key=Name,Value=web`	Tag a resource
`aws ec2 describe-images --owners 099720109477 --filters "Name=name,Values=ubuntu/images/hvm-ssd-gp3/ubuntu-noble-24.04-amd64-server-*"`	Find official Ubuntu 24.04 AMIs
`aws ec2 get-console-output --instance-id i-0abc123`	Read the instance console log

Security Groups and Key Pairs

Network access and SSH keys for EC2. Private key files are unencrypted, so keep them readable only by your user.

Command	Description
`aws ec2 describe-security-groups`	List security groups
`aws ec2 create-security-group --group-name web --description "Web tier"`	Create a security group
`aws ec2 authorize-security-group-ingress --group-id sg-0abc --protocol tcp --port 22 --cidr 203.0.113.10/32`	Allow inbound traffic
`aws ec2 revoke-security-group-ingress --group-id sg-0abc --protocol tcp --port 22 --cidr 203.0.113.10/32`	Remove an inbound rule
`aws ec2 delete-security-group --group-id sg-0abc`	Delete a security group
`aws ec2 create-key-pair --key-name mykey --query KeyMaterial --output text > mykey.pem`	Create a key pair and save the private key
`chmod 400 mykey.pem`	Restrict private key permissions
`aws ec2 describe-key-pairs`	List key pairs
`aws ec2 delete-key-pair --key-name mykey`	Delete a key pair
`aws ec2 describe-vpcs`	List VPCs
`aws ec2 describe-subnets --filters Name=vpc-id,Values=vpc-0abc`	List subnets in a VPC
`aws ec2 allocate-address`	Reserve an elastic IP
`aws ec2 associate-address --instance-id i-0abc123 --allocation-id eipalloc-0abc`	Attach an elastic IP

EBS Volumes and Snapshots

Block storage and backups.

Command	Description
`aws ec2 describe-volumes`	List volumes
`aws ec2 create-volume --size 20 --availability-zone eu-central-1a`	Create a volume
`aws ec2 attach-volume --volume-id vol-0abc --instance-id i-0abc123 --device /dev/sdf`	Attach a volume
`aws ec2 detach-volume --volume-id vol-0abc`	Detach a volume
`aws ec2 delete-volume --volume-id vol-0abc`	Permanently delete a volume
`aws ec2 create-snapshot --volume-id vol-0abc --description "nightly"`	Snapshot a volume
`aws ec2 describe-snapshots --owner-ids self`	List your snapshots
`aws ec2 copy-snapshot --region eu-west-1 --source-region eu-central-1 --source-snapshot-id snap-0abc`	Copy a snapshot from eu-central-1 to eu-west-1
`aws ec2 delete-snapshot --snapshot-id snap-0abc`	Permanently delete a snapshot

IAM Users and Roles

Identities, policies, and access keys. Creating an access key prints its secret once, so store it securely and never commit it to version control.

Command	Description
`aws iam list-users`	List IAM users
`aws iam create-user --user-name dev`	Create a user
`aws iam delete-user --user-name dev`	Permanently delete a user after removing dependencies
`aws iam list-roles`	List roles
`aws iam get-role --role-name deploy`	Show a role and its trust policy
`aws iam attach-user-policy --user-name dev --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess`	Attach a managed policy
`aws iam list-attached-user-policies --user-name dev`	List policies attached to a user
`aws iam create-access-key --user-name dev`	Create an access key
`aws iam list-access-keys --user-name dev`	List access keys and creation dates
`aws iam update-access-key --user-name dev --access-key-id AKIA123 --status Inactive`	Disable a key before deleting it
`aws iam delete-access-key --user-name dev --access-key-id AKIA123`	Permanently delete an access key
`aws iam get-account-summary`	Account-wide IAM counts and limits

Systems Manager and Secrets

Shell access without SSH, plus configuration and secret storage. The start-session command needs the Session Manager plugin installed locally. Pass secret values from protected files so they do not enter shell history, and keep decrypted output out of shared logs.

Command	Description
`aws ssm start-session --target i-0abc123`	Open a shell on an instance
`aws ssm describe-instance-information`	List instances managed by SSM
`aws ssm send-command --instance-ids i-0abc123 --document-name AWS-RunShellScript --parameters commands="uptime"`	Run a command on an instance
`aws ssm get-command-invocation --command-id 1a2b --instance-id i-0abc123`	Read the output of a sent command
`aws ssm put-parameter --name /app/db_url --value file://db-url.txt --type SecureString`	Store an encrypted parameter from a file
`aws ssm get-parameter --name /app/db_url --with-decryption`	Read and decrypt a parameter
`aws ssm get-parameters-by-path --path /app --recursive`	List parameters under a path
`aws secretsmanager list-secrets`	List secrets
`aws secretsmanager get-secret-value --secret-id prod/db --query SecretString --output text`	Print a decrypted secret value
`aws secretsmanager create-secret --name prod/db --secret-string file://secret.json`	Create a secret from a file

CloudWatch Logs and Alarms

Read application and service logs from the terminal.

Command	Description
`aws logs describe-log-groups`	List log groups
`aws logs describe-log-streams --log-group-name /aws/lambda/fn`	List streams in a group
`aws logs tail /aws/lambda/fn --follow`	Stream new log events live
`aws logs tail /aws/lambda/fn --since 1h --format short`	Show the last hour of logs
`aws logs filter-log-events --log-group-name /aws/lambda/fn --filter-pattern ERROR`	Search log events
`aws logs create-log-group --log-group-name /app/web`	Create a log group
`aws logs put-retention-policy --log-group-name /app/web --retention-in-days 30`	Set log retention
`aws logs delete-log-group --log-group-name /app/web`	Permanently delete a log group and its logs
`aws cloudwatch describe-alarms`	List alarms and their state
`aws cloudwatch describe-alarms --state-value ALARM`	Show only firing alarms

Lambda Functions

Deploy and invoke functions. AWS CLI version 2 expects base64 input for blob parameters by default, so literal JSON passed to --payload needs --cli-binary-format raw-in-base64-out.

Command	Description
`aws lambda list-functions`	List functions
`aws lambda get-function --function-name fn`	Show configuration and code location
`aws lambda invoke --function-name fn out.json`	Invoke a function
`aws lambda invoke --function-name fn --cli-binary-format raw-in-base64-out --payload '{"key":"value"}' out.json`	Invoke with a JSON payload
`aws lambda update-function-code --function-name fn --zip-file fileb://fn.zip`	Deploy new code
`aws lambda update-function-configuration --function-name fn --timeout 30`	Change a setting
`aws lambda publish-version --function-name fn`	Publish an immutable version
`aws lambda list-versions-by-function --function-name fn`	List published versions
`aws lambda delete-function --function-name fn`	Permanently delete a function

ECR Container Images

Authenticate Docker against a registry with aws ecr get-login-password --region eu-central-1 piped into docker login --username AWS --password-stdin 123456789012.dkr.ecr.eu-central-1.amazonaws.com. Container commands are in the Docker cheatsheet .

Command	Description
`aws ecr get-login-password --region eu-central-1`	Print a registry password for Docker
`aws ecr describe-repositories`	List repositories
`aws ecr create-repository --repository-name app`	Create a repository
`aws ecr list-images --repository-name app`	List image tags and digests
`aws ecr describe-images --repository-name app`	Show image size and push date
`aws ecr batch-delete-image --repository-name app --image-ids imageTag=old`	Delete an image
`aws ecr delete-repository --repository-name app --force`	Permanently delete a repository and its images

aws s3 Commands: cp, sync, ls, and rm Examples

hello@linuxize.com (Linuxize) — Fri, 31 Jul 2026 10:10:00 +0200

Uploading a file to Amazon S3 through the web console works fine once. The tenth time, or the first time you need to move a whole directory tree, you want it in your shell history instead. The aws s3 command group gives you familiar Unix-style operations for S3: ls to list, cp to copy, sync to mirror directories, and rm to delete.

This guide shows practical examples of the most used aws s3 commands, including recursive copies, include and exclude filters, and safe deletion with --dryrun.

Prerequisites

The examples require AWS CLI version 2 and an identity with permission to access the S3 resources you use. If the CLI is not ready yet, follow our guide on installing and configuring the AWS CLI on Linux .

Confirm that the CLI can authenticate to your account with:

Terminal
aws sts get-caller-identity

If the command prints your account ID and IAM identity, authentication is working. Individual S3 commands can still return AccessDenied when that identity lacks the required bucket or object permissions.

The AWS CLI has two command groups for S3. The aws s3 group used in this guide provides high-level file operations. The aws s3api group exposes the raw API, one call per operation, and is only needed for tasks such as managing bucket policies or object versions.

S3 paths use the form s3://bucket-name/key. The general command structure is:

txt
aws s3 <subcommand> [ARGUMENTS] [OPTIONS]

Commands such as cp, mv, and sync take source and destination arguments. The remaining commands operate on one S3 path, except aws s3 ls, which can omit the path to list every bucket.

Listing Buckets and Objects

Run aws s3 ls with no arguments to list all buckets in the account:

Terminal
aws s3 ls

output

2025-11-04 09:12:33 my-bucket
2026-01-15 17:40:21 my-site-backups

To list the contents of a bucket, pass the bucket path:

Terminal
aws s3 ls s3://my-bucket

output

 PRE logs/
2026-02-10 08:30:12 1048576 backup.tar.gz
2026-02-11 09:02:44 4523 notes.txt

Entries marked PRE are prefixes, the S3 equivalent of directories. To look inside one, append it to the path with a trailing slash, for example aws s3 ls s3://my-bucket/logs/.

Add --recursive to walk the whole bucket, and combine it with --human-readable and --summarize to get readable sizes and totals:

Terminal
aws s3 ls s3://my-bucket --recursive --human-readable --summarize

output

2026-02-10 08:30:12 1.0 MiB backup.tar.gz
2026-02-11 09:02:44 4.4 KiB notes.txt
2026-02-12 06:15:09 12.7 MiB logs/app.log
Total Objects: 3
Total Size: 13.7 MiB

The summary at the bottom shows the count and combined size of the current objects listed under the bucket or prefix. It does not include noncurrent versions in a versioned bucket.

Uploading and Downloading Files with cp

The cp subcommand copies files between your machine and S3, in either direction. To upload a file to a bucket:

Terminal
aws s3 cp backup.tar.gz s3://my-bucket/

output

upload: ./backup.tar.gz to s3://my-bucket/backup.tar.gz

The object keeps its original name. To store it under a different key, spell out the full target path:

Terminal
aws s3 cp backup.tar.gz s3://my-bucket/backups/backup-2026-02-10.tar.gz

Downloading works the same way with the arguments reversed. The . target saves the file into the current directory:

Terminal
aws s3 cp s3://my-bucket/backup.tar.gz .

You can also copy directly between two buckets. The transfer happens inside AWS, so the data does not pass through your machine:

Terminal
aws s3 cp s3://my-bucket/backup.tar.gz s3://my-site-backups/backup.tar.gz

Copying Directories

To copy a directory and everything under it, add --recursive:

Terminal
aws s3 cp ./logs s3://my-bucket/logs --recursive

When you only want some of the files, combine --exclude and --include. The filters are evaluated in the order given, and the later filter wins, so the usual pattern is to exclude everything and then include what you want:

Terminal
aws s3 cp ./logs s3://my-bucket/logs --recursive --exclude "*" --include "*.log"

This uploads only the .log files and skips everything else in the directory.

The most useful cp options:

--recursive - Copy all files under a directory or prefix.
--exclude / --include - Filter files by pattern; later filters override earlier ones.
--storage-class - Choose the destination storage class, for example STANDARD_IA for backups accessed infrequently.
--dryrun - Print what would be copied without transferring anything.

Streaming to and from S3

The cp command accepts - as a stand-in for standard input or output, which lets you pipe data straight to a bucket without a temporary file:

Terminal
pg_dump mydb | gzip | aws s3 cp - s3://my-bucket/backups/mydb.sql.gz

Reading works the same way in reverse. This prints an object to standard output where you can pipe it further:

Terminal
aws s3 cp s3://my-bucket/backups/mydb.sql.gz - | gunzip | head

Moving and Renaming Objects with mv

Amazon S3 does not rename an object in place. The mv command copies the source to the new key and then deletes the source, so preview the operation before running it:

Terminal
aws s3 mv s3://my-bucket/report-draft.pdf s3://my-bucket/report-final.pdf --dryrun

Check both paths carefully, then run the command again without --dryrun. The same command can move files between your machine and S3 or between two buckets.

Synchronizing Directories with sync

Where cp --recursive copies everything every time, sync transfers files that are missing, differ in size, or have a newer source modification time. To mirror a local directory to a bucket:

Terminal
aws s3 sync ./website s3://my-bucket/website

Run it again immediately and nothing is transferred, because both sides already match. This makes sync the right tool for repeated jobs such as publishing a static site or shipping nightly backups.

The reverse direction downloads new and changed objects from the bucket:

Terminal
aws s3 sync s3://my-bucket/website ./website

Syncing between two buckets also works: aws s3 sync s3://my-bucket s3://my-site-backups.

By default, sync never deletes anything. Files removed from the source remain on the target. To make the target an exact mirror, add --delete, but preview the result first because deleted objects are gone for good:

Terminal
aws s3 sync ./website s3://my-bucket/website --delete --dryrun

output

(dryrun) upload: website/index.html to s3://my-bucket/website/index.html
(dryrun) delete: s3://my-bucket/website/old-page.html

Every line is prefixed with (dryrun), so nothing has happened yet. Review the delete: lines, and when the plan looks right, run the same command without --dryrun.

The same --exclude and --include filters from cp apply here. A common one keeps repository metadata out of the bucket:

Terminal
aws s3 sync ./website s3://my-bucket/website --exclude ".git/*"

Because sync is idempotent, it pairs well with a scheduled job. See our guide on scheduling cron jobs with crontab if you want to run a sync every night.

Deleting Objects with rm

To delete a single object, pass its full path:

Terminal
aws s3 rm s3://my-bucket/old-backup.tar.gz

output

delete: s3://my-bucket/old-backup.tar.gz

Warning

There is no trash bin in S3. Unless the bucket has versioning enabled, a deleted object cannot be recovered. Always test recursive deletions with --dryrun first.

To delete everything under a prefix, add --recursive and preview the damage before committing:

Terminal
aws s3 rm s3://my-bucket/logs/ --recursive --dryrun

If the listed objects are the ones you expect, run the command again without --dryrun to perform the deletion.

On buckets with versioning enabled, rm only inserts a delete marker; previous versions remain and continue to incur storage costs. Removing versions permanently requires the aws s3api delete-object call with a version ID.

Creating and Removing Buckets

The mb (make bucket) subcommand creates a new bucket. General purpose bucket names must be unique across AWS accounts and Regions within an AWS partition, so pick something difficult to collide with:

Terminal
aws s3 mb s3://my-unique-bucket-name --region eu-central-1

The rb (remove bucket) subcommand deletes a bucket, but only when it is empty:

Terminal
aws s3 rb s3://my-unique-bucket-name

Adding --force deletes the current objects in an unversioned bucket and then removes the bucket. It does not permanently delete object versions or delete markers, so removal fails when a versioned bucket still contains them. Treat --force with the same caution as rm --recursive.

Generating Temporary Download Links

Sometimes you need to hand a file to someone without making the bucket public. The presign subcommand generates a URL that grants temporary access to a single object:

Terminal
aws s3 presign s3://my-bucket/report.pdf --expires-in 3600

The command prints a long URL that anyone can use to download the object for the next hour (3600 seconds). The default lifetime is one hour, and the maximum is seven days. A URL signed with temporary credentials expires when those credentials expire, even when --expires-in requests a later time.

Quick Reference

For a printable quick reference, see the AWS CLI cheatsheet .

Task	Command
List all buckets	`aws s3 ls`
List bucket contents	`aws s3 ls s3://bucket`
List recursively with totals	`aws s3 ls s3://bucket --recursive --summarize`
Upload a file	`aws s3 cp file.txt s3://bucket/`
Download a file	`aws s3 cp s3://bucket/file.txt .`
Upload a directory	`aws s3 cp ./dir s3://bucket/dir --recursive`
Preview renaming an object	`aws s3 mv s3://bucket/old.txt s3://bucket/new.txt --dryrun`
Mirror a directory	`aws s3 sync ./dir s3://bucket/dir`
Preview removing stale files during a mirror	`aws s3 sync ./dir s3://bucket/dir --delete --dryrun`
Delete an object	`aws s3 rm s3://bucket/file.txt`
Preview deleting a prefix	`aws s3 rm s3://bucket/dir/ --recursive --dryrun`
Create a bucket	`aws s3 mb s3://bucket`
Remove an empty bucket	`aws s3 rb s3://bucket`
Temporary download link	`aws s3 presign s3://bucket/file.txt`

FAQ

What is the difference between cp –recursive and sync?
cp --recursive copies every file on every run. sync compares both sides and transfers only new or changed files, which is faster and cheaper for repeated jobs.

Can I use shell wildcards in S3 paths?
No. The AWS CLI does not interpret Unix-style wildcards in an S3 path such as s3://bucket/*.log. Use --recursive together with --exclude and --include filters instead.

How do I delete all files in a bucket?
For an unversioned bucket, preview aws s3 rm s3://bucket --recursive --dryrun, then remove --dryrun to empty it. The aws s3 rb s3://bucket --force command can empty and remove an unversioned bucket in one step, but it fails when object versions or delete markers remain.

Conclusion

Make --dryrun a habit before mv, recursive rm, or sync --delete, then reuse the reviewed commands in your scripts and scheduled jobs.

How to Install and Configure the AWS CLI on Linux

hello@linuxize.com (Linuxize) — Thu, 30 Jul 2026 09:20:00 +0200

Clicking through the AWS console works for a one-off task, but the moment you manage instances, buckets, or DNS records regularly, you want those actions in your shell history and your scripts. The AWS CLI puts every AWS API behind a single aws command, so listing instances, syncing a bucket, or rotating a key becomes a one-liner you can repeat and automate.

This guide explains how to install AWS CLI version 2 on Linux, authenticate with short-term credentials, manage named profiles, and verify that your setup can access your AWS account.

Installing AWS CLI Version 2

AWS maintains an install script that downloads, verifies, and installs the current AWS CLI release. It detects whether your Linux system uses an x86_64 or ARM processor, so the same command works on both architectures:

Terminal
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | bash

The script installs the program for your user under ~/.local/share/aws-cli and creates ~/.local/bin/aws. This avoids requiring root access. Open a new terminal after installation, then verify the version:

Terminal
aws --version

The first part of the output should begin with aws-cli/2.. The remaining version and system details depend on the current release and your Linux distribution.

To install the CLI for every user instead, run the installer in system mode:

Terminal
curl -fsSL https://awscli.amazonaws.com/v2/install.sh | sudo bash -s -- --system

System mode installs the files under /usr/local/aws-cli and creates the command links in /usr/local/bin.

When a newer release is available, update a per-user installation with:

Terminal
aws update

Use sudo aws update if you installed the CLI in system mode.

Configuring AWS CLI Authentication

AWS recommends short-term credentials for people and workloads. The best configuration method depends on how your AWS account manages identities:

Use aws login when you already sign in to the AWS Management Console with an IAM or federated identity.
Use aws configure sso when your organization uses AWS IAM Identity Center.
Use aws configure with an IAM access key only when neither short-term method is available.

Do not configure the CLI with root-user access keys. Use a non-root identity with only the permissions required for your work.

Signing In with AWS Console Credentials

AWS CLI version 2.32.0 and later supports aws login , which exchanges an existing console session for temporary credentials. Your AWS administrator must allow local developer sign-in for the identity. Start the browser-based flow with:

Terminal
aws login

The CLI asks for a default Region if one is not already configured, then opens your browser. Select the console session and identity you want to use. AWS stores the temporary session under ~/.aws/login/cache and refreshes its credentials while the session remains valid.

To create or sign in to a named profile, add --profile:

Terminal
aws login --profile work

On a remote Linux server without a browser, use the cross-device flow:

Terminal
aws login --remote

When the session reaches its maximum duration, run aws login again. You can end it earlier with aws logout.

Configuring IAM Identity Center

If your organization provides an AWS access portal, follow the IAM Identity Center configuration instead of using aws login. Run the setup wizard with a descriptive profile name:

Terminal
aws configure sso --profile work

The wizard asks for the SSO session name, start or issuer URL, SSO Region, account, permission set, default Region, and output format. It opens a browser so you can authorize the session.

Terminal
aws sso login --profile work

IAM Identity Center stores the profile settings in ~/.aws/config and caches its tokens under ~/.aws/sso/cache.

Configuring an IAM Access Key

Some legacy tools and workloads still require a long-term access key. If you cannot use temporary credentials, create the key for a dedicated IAM user with least-privilege permissions, then configure a named profile:

Terminal
aws configure --profile legacy

output

AWS Access Key ID [None]: <your-access-key-id>
AWS Secret Access Key [None]: <your-secret-access-key>
Default region name [None]: eu-central-1
Default output format [None]: json

Choose the Region where most of your resources run. JSON is a practical default output format for scripts, while table is easier to scan interactively.

The CLI writes access keys to ~/.aws/credentials and other settings to ~/.aws/config.

Warning

Never commit access keys, paste them into scripts, or bake them into images. If a key enters Git history or another public location, deactivate it immediately and create a replacement. Prefer temporary credentials whenever the application supports them.

Verifying the Configuration

Ask AWS Security Token Service which identity the CLI resolved:

Terminal
aws sts get-caller-identity

output

{
"UserId": "AROAXAMPLE:dejan",
"Account": "123456789012",
"Arn": "arn:aws:sts::123456789012:assumed-role/Developer/dejan"
}

The response identifies the account, IAM user, or assumed role behind the current credentials. To test a named profile, add it to the command:

Terminal
aws sts get-caller-identity --profile work

If the call succeeds, authentication works. Individual service commands can still fail when the identity lacks permission for that action.

Working with Named Profiles

Profiles keep settings and credentials for separate accounts or roles from interfering with each other. List the profiles currently available:

Terminal
aws configure list-profiles

Select a profile for one command with --profile:

Terminal
aws s3 ls --profile work

To use the same profile for the rest of the shell session, set AWS_PROFILE:

Terminal
export AWS_PROFILE=work

The default profile is used when neither --profile nor AWS_PROFILE is set. A command-line --profile option overrides the environment variable.

On EC2 instances, ECS tasks, and other AWS compute services, attach an IAM role to the workload instead of storing access keys. For CI systems, use the platform’s OpenID Connect integration to assume an IAM role when available.

Running Your First Commands

The CLI follows a aws <service> <operation> pattern. List your S3 buckets:

Terminal
aws s3 ls

output

2025-11-02 14:11:20 backups-prod
2026-01-01 09:48:03 static-assets

List EC2 instances, trimmed down to the fields you care about with --query:

Terminal
aws ec2 describe-instances \
 --query 'Reservations[].Instances[].{ID:InstanceId,Type:InstanceType,State:State.Name}' \
 --output table

output

-------------------------------------------------
| DescribeInstances |
+----------------------+-----------+------------+
| ID | Type | State |
+----------------------+-----------+------------+
| i-0abcd1234ef567890 | t3.small | running |
| i-0fe9876543ba21001 | t3.micro | stopped |
+----------------------+-----------+------------+

The --query option takes a JMESPath expression and works on every command, which saves you from piping JSON into other tools for simple filtering. The --output option switches between json, yaml, text, and table per invocation.

Every service has built-in help, so aws s3 help and aws ec2 describe-instances help open the relevant manual pages without leaving the terminal.

Enabling Command Completion

The installer includes aws_completer, which suggests services, operations, and options when you press Tab. Confirm that your shell can find it:

Terminal
command -v aws_completer

The path is usually ~/.local/bin/aws_completer for a per-user installation or /usr/local/bin/aws_completer for a system installation.

For Bash, add this line to ~/.bashrc:

~/.bashrcsh
complete -C "$(command -v aws_completer)" aws

Reload the file:

Terminal
source ~/.bashrc

For Zsh, add these lines to ~/.zshrc:

~/.zshrcsh
autoload bashcompinit && bashcompinit
complete -C "$(command -v aws_completer)" aws

Then reload the Zsh configuration:

Terminal
source ~/.zshrc

Troubleshooting

aws: command not found
For a per-user installation, ~/.local/bin may be missing from PATH. Add export PATH="$HOME/.local/bin:$PATH" to ~/.bashrc or ~/.zshrc, reload the file, and run aws --version again. For a system installation, check that /usr/local/bin is in PATH.

Unable to locate credentials
No authentication method is configured, or AWS_PROFILE points to a profile that does not exist. Run aws configure list to see where the CLI is looking and what it found.

ExpiredToken after aws login
An older access key in ~/.aws/credentials can take precedence over login credentials for the same profile. Run aws configure list, remove the stale key entries for that profile, and sign in again.

An error occurred (InvalidClientTokenId)
For an access-key profile, the key is inactive, deleted, or mistyped. Replace it in IAM and run aws configure --profile <profile-name> again.

An error occurred (UnauthorizedOperation) or AccessDenied
The credentials are valid, but the current identity lacks permission for that action. Ask your AWS administrator to grant the required permission through the relevant role, permission set, or IAM policy.

Could not connect to the endpoint URL
Check the configured Region with aws configure get region. A value such as eu-central1 is invalid; the correct format is eu-central-1.

Conclusion

With AWS CLI version 2 installed and aws sts get-caller-identity returning the expected account, you can start using service commands without storing long-lived credentials. For day-to-day bucket work, see our guide on the aws s3 commands , and if you want those syncs on a schedule, our guide on using cron to schedule jobs .

How to Install Kubernetes with kubeadm on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Wed, 29 Jul 2026 09:40:00 +0200

When you outgrow a single Docker host and need to run containers across several machines with rolling updates, self-healing, and service discovery built in, Kubernetes is the standard answer. The kubeadm tool provides a minimal upstream method for bootstrapping a self-managed cluster on plain Linux servers.

This guide explains how to set up Kubernetes 1.36 on Ubuntu 26.04 using kubeadm, kubelet, and kubectl from the Kubernetes apt repository, with containerd as the container runtime. By the end you will have a control-plane node, one or more worker nodes, and a test workload running across the cluster.

Quick Reference

Task	Command
Disable swap	`sudo swapoff -a`
Install containerd	`sudo apt install -y containerd`
Add Kubernetes apt key	`curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key \| sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg`
Install kube tools	`sudo apt install -y kubelet kubeadm kubectl`
Hold kube versions	`sudo apt-mark hold kubelet kubeadm kubectl`
Init control plane	`sudo kubeadm init --pod-network-cidr=10.244.0.0/16`
Configure kubectl	`mkdir -p ~/.kube && sudo cp /etc/kubernetes/admin.conf ~/.kube/config && sudo chown $(id -u):$(id -g) ~/.kube/config`
Get nodes	`kubectl get nodes`
Get pods (all namespaces)	`kubectl get pods -A`
Generate join command	`sudo kubeadm token create --print-join-command`

Prerequisites

Before starting, make sure you have:

Two or more servers running Ubuntu 26.04 with at least 2 GB of RAM each. The control-plane node needs at least 2 CPUs.
A user with sudo privileges on each server.
Full network connectivity between the nodes and Internet access for downloading packages and container images.
A stable IP address plus a unique hostname, MAC address, and product UUID on every node.

The same instructions apply to control-plane and worker nodes up to the cluster bootstrap step. Run every command on every node unless the section says otherwise.

If a host or cloud firewall filters traffic between the nodes, allow the required traffic between these sources and destination ports:

Destination	Source	Ports
Control plane API	Cluster nodes and administrators	TCP `6443`
etcd on the control plane	Control-plane nodes only	TCP `2379-2380`
Control-plane kubelet	Control-plane components	TCP `10250`
Scheduler and controller manager	Control-plane node itself	TCP `10257` and `10259`
Worker kubelet	Control-plane nodes	TCP `10250`
kube-proxy health endpoint	Node itself and load balancers that use it	TCP `10256`
NodePort services	Clients that need access	TCP and UDP `30000-32767`
Flannel VXLAN	Other cluster nodes	UDP `8472`

Restrict these rules to trusted cluster and administration networks. Do not expose the etcd or kubelet ports directly to the Internet.

Step 1: Prepare the System

The kubelet refuses to start when swap is active unless you configure it to tolerate swap. This guide uses the default behavior, so turn swap off for the current session and comment out swap entries in /etc/fstab:

Terminal
sudo swapoff -a
sudo sed -i '/[[:space:]]swap[[:space:]]/ s/^[^#]/#&/' /etc/fstab

Check that no active swap devices remain:

Terminal
swapon --show

The command should return no output.

Load the kernel modules required by the container runtime and Kubernetes networking:

Terminal
sudo tee /etc/modules-load.d/k8s.conf <<EOF
overlay
br_netfilter
EOF

sudo modprobe overlay
sudo modprobe br_netfilter

Confirm that both modules are loaded:

Terminal
lsmod | grep -E 'br_netfilter|overlay'

Enable the sysctl settings that allow iptables to see bridged traffic and let IP forwarding work:

Terminal
sudo tee /etc/sysctl.d/k8s.conf <<EOF
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-ip6tables = 1
net.ipv4.ip_forward = 1
EOF

sudo sysctl --system

Verify the two main networking settings:

Terminal
sysctl net.ipv4.ip_forward net.bridge.bridge-nf-call-iptables

Both values should be 1.

Step 2: Install containerd

Kubernetes uses the Container Runtime Interface (CRI) to communicate with a container runtime. Ubuntu 26.04 provides containerd 2.x in its repositories:

Terminal
sudo apt update
sudo apt install -y containerd

If Docker is already installed from the official Docker repository, the containerd.io package provides the same runtime and conflicts with the containerd package. Skip the install above and continue with the configuration below.

Generate a complete containerd configuration, then enable the systemd cgroup driver so it matches the kubelet configuration created by kubeadm:

Terminal
sudo mkdir -p /etc/containerd
containerd config default | sudo tee /etc/containerd/config.toml > /dev/null
sudo sed -i 's/SystemdCgroup = false/SystemdCgroup = true/' /etc/containerd/config.toml
sudo systemctl restart containerd
sudo systemctl enable containerd

Confirm that the service is running and the setting is present:

Terminal
systemctl is-active containerd
sudo grep 'SystemdCgroup = true' /etc/containerd/config.toml

The first command should print active, and the second should show the enabled cgroup setting.

Step 3: Add the Kubernetes apt Repository

Kubernetes publishes a separate package repository for every minor release. This guide follows the supported v1.36 series, and apt installs the newest patch release available in that repository.

Install the prerequisites and download the signing key:

Terminal
sudo apt install -y apt-transport-https ca-certificates curl gpg
sudo mkdir -p -m 755 /etc/apt/keyrings
curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.36/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg

Add the repository:

Terminal
echo "deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.36/deb/ /" | sudo tee /etc/apt/sources.list.d/kubernetes.list

Refresh the package index:

Terminal
sudo apt update

Step 4: Install kubelet, kubeadm, and kubectl

Install the three Kubernetes tools and pin their versions so an apt upgrade does not change them by accident:

Terminal
sudo apt install -y kubelet kubeadm kubectl
sudo apt-mark hold kubelet kubeadm kubectl

Confirm the install:

Terminal
kubeadm version
kubelet --version
kubectl version --client

The apt-mark hold flag is important because Kubernetes upgrades follow a specific procedure (kubeadm upgrade), and a casual apt upgrade could break the cluster.

The kubelet may restart repeatedly at this point because it does not have a cluster configuration yet. This is expected and stops after kubeadm init or kubeadm join configures the node.

Step 5: Initialize the Control Plane

Run the next two steps only on the control-plane node.

Warning

This procedure creates one control-plane node, so the cluster is not highly available. For production workloads that must survive a control-plane failure, design a multi-control-plane cluster with a load balancer and a shared --control-plane-endpoint before initialization.

Pick a CIDR for the pod network that does not overlap with your host network. The example uses 10.244.0.0/16, which is the default for Flannel. Bootstrap the cluster:

Terminal
sudo kubeadm init --pod-network-cidr=10.244.0.0/16

The command pulls the control-plane container images, generates certificates, writes the kubeconfig files under /etc/kubernetes/, and starts the static pods for the API server, controller manager, scheduler, and etcd. When it finishes you will see a block similar to this:

output

Your Kubernetes control-plane has initialized successfully!
To start using your cluster, you need to run the following as a regular user:
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config
Then you can join any number of worker nodes by running the following on each as root:
kubeadm join 192.168.1.10:6443 --token abcdef.0123456789abcdef \
--discovery-token-ca-cert-hash sha256:1234...

Copy the join command somewhere safe. The bootstrap token is a credential that allows a node to authenticate while joining the cluster, so do not publish or share it with untrusted users.

Set up the kubeconfig for your sudo user so kubectl works without root:

Terminal
mkdir -p $HOME/.kube
sudo cp -i /etc/kubernetes/admin.conf $HOME/.kube/config
sudo chown $(id -u):$(id -g) $HOME/.kube/config

The copied admin.conf grants cluster administrator access. Keep ~/.kube/config private and do not distribute it as a general user credential.

Verify that the API server is reachable:

Terminal
kubectl get nodes

The output lists the control-plane node with a status of NotReady. The status changes to Ready after you install a pod network in the next step.

Step 6: Install a Pod Network

Pods cannot communicate until the cluster has a network plugin. Flannel is one of the simplest options that works with the default 10.244.0.0/16 CIDR:

Terminal
kubectl apply -f https://github.com/flannel-io/flannel/releases/latest/download/kube-flannel.yml

Watch the system pods come up:

Terminal
kubectl get pods -n kube-flannel
kubectl get pods -n kube-system
kubectl get nodes

After a minute or so, the Flannel and core system pods should report Running, and the control-plane node should show Ready.

If you prefer Calico, Cilium, or another CNI plugin, install it now instead of Flannel and pass the matching --pod-network-cidr value to kubeadm init.

Step 7: Join Worker Nodes

Run this step on each worker node.

Use the kubeadm join command that was printed at the end of kubeadm init. If you lost it or the token has expired (tokens are valid for 24 hours by default), generate a new one on the control-plane node:

Terminal
sudo kubeadm token create --print-join-command

Then run the printed command on the worker:

Terminal
sudo kubeadm join 192.168.1.10:6443 --token <token> \
 --discovery-token-ca-cert-hash sha256:<hash>

Back on the control-plane node, verify that the new node has joined:

Terminal
kubectl get nodes

The output now lists the worker. It moves from NotReady to Ready once the kubelet finishes its registration and the network plugin reports healthy.

Step 8: Test the Cluster

Deploy a small workload to confirm the cluster schedules pods and that networking is working:

Terminal
kubectl create deployment nginx-test --image=nginx
kubectl expose deployment nginx-test --port=80 --type=NodePort
kubectl rollout status deployment/nginx-test
kubectl get pods,svc

The output shows the nginx-test pod in the Running state and a NodePort service with a port in the 30000-32767 range:

output

NAME READY STATUS RESTARTS AGE
pod/nginx-test-7b7bf6d9b8-8pxnf 1/1 Running 0 25s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/nginx-test NodePort 10.105.10.123 <none> 80:31234/TCP 12s

Open http://<node_ip>:<nodeport> in a browser and you should see the Nginx welcome page. Tear the demo down once you confirm it works:

Terminal
kubectl delete service nginx-test
kubectl delete deployment nginx-test

Troubleshooting

kubeadm init fails with “container runtime is not running”
containerd is not running, or its CRI plugin is disabled. Inspect the service with sudo systemctl status containerd --no-pager and check /etc/containerd/config.toml for a disabled_plugins entry containing cri. Remove cri from that list, confirm that SystemdCgroup = true, and restart the service with sudo systemctl restart containerd.

Nodes stay NotReady after init
The pod network is not installed or the CNI pods are crashing. Run kubectl get pods -n kube-flannel and kubectl logs -n kube-flannel daemonset/kube-flannel-ds --tail=50 to inspect Flannel. Confirm that the --pod-network-cidr passed to kubeadm init matches the CIDR expected by the CNI plugin.

Cgroup driver mismatch warning in kubelet logs
The kubelet uses systemd and the runtime uses cgroupfs, or vice versa. Edit /etc/containerd/config.toml, set SystemdCgroup = true, and restart containerd. Restart the kubelet with sudo systemctl restart kubelet.

The connection to the server localhost:8080 was refused
kubectl is reading the wrong kubeconfig. Run kubectl config view to confirm the current context, and make sure ~/.kube/config exists for the user running the command. On the control-plane node, copy /etc/kubernetes/admin.conf to ~/.kube/config and fix ownership.

Worker join times out
The control-plane host is not reachable from the worker on TCP port 6443, or the token has expired. Confirm the route and firewall rules, then run sudo kubeadm token create --print-join-command on the control plane to generate a fresh join command.

The Nginx NodePort does not respond
The workload can be healthy while a host or cloud firewall blocks the assigned NodePort. Read the port from kubectl get service nginx-test, then allow that TCP port only from the client network that needs access.

FAQ

Do I still need Docker?
No. Kubernetes communicates with container runtimes through the CRI, and containerd is enough for this cluster. Kubernetes 1.24 removed the built-in Docker integration known as dockershim. If you also want to build images on the same host, install Docker as a separate tool. See How to Install Docker on Ubuntu 26.04 for the build environment.

Why is swap disabled?
The kubelet refuses to start by default when it detects active swap. Kubernetes can use swap with an explicit kubelet configuration, but disabling it keeps this installation aligned with the default behavior.

Can I run a single-node cluster on the control plane?
Yes. Remove the control-plane taint with kubectl taint nodes --all node-role.kubernetes.io/control-plane-. After that, the scheduler places workload pods on the control-plane node.

How do I upgrade Kubernetes later?
Follow the kubeadm node upgrade procedure and move through one minor version at a time. The process includes upgrading kubeadm, running kubeadm upgrade plan and kubeadm upgrade apply, then upgrading the kubelet and kubectl. The package holds prevent these components from changing during a routine apt upgrade.

Next Steps

You now have a working Kubernetes cluster on Ubuntu 26.04. From here you can deploy applications with manifests or Helm charts, set up an ingress controller, and add storage classes that match your environment. For a single-node lab on the same host, an alternative is to start with k3s or minikube and migrate to a kubeadm cluster as your needs grow.

update-alternatives Command on Ubuntu and Debian

hello@linuxize.com (Linuxize) — Mon, 27 Jul 2026 09:10:00 +0200

When several installed programs provide the same command, you need a reliable way to choose which one runs by default. Hard-coding paths in scripts or rebuilding symbolic links by hand makes that choice difficult to maintain.

On Ubuntu, Debian, and their derivatives, the update-alternatives command manages these selections through symbolic links in /etc/alternatives. This guide explains how to inspect alternative groups, switch programs interactively or from a script, register new choices, and return a group to automatic mode.

How It Works

update-alternatives maintains link groups. Each group has a generic command name and one or more registered program paths. For example, the java group controls which installed Java runtime /usr/bin/java starts.

The generic command is not linked directly to the selected program. Instead, /usr/bin/java points to /etc/alternatives/java, which points to the active Java binary. You can read our symbolic links guide for more about this two-step link structure.

Each group operates in one of two modes:

Automatic mode selects the registered alternative with the highest priority.
Manual mode keeps the administrator’s selection until it is changed explicitly or becomes invalid.

The command stores its administrative state under /var/lib/dpkg/alternatives.

Syntax

The general command syntax is:

txt
update-alternatives [OPTIONS] COMMAND

Commands that change an alternative group require sudo. Listing and displaying alternatives does not.

List Alternative Groups

To see every master alternative group registered on the system, run:

Terminal
update-alternatives --get-selections

output

awk auto /usr/bin/mawk
editor auto /bin/nano
pager auto /bin/more
vi auto /usr/bin/vim.basic

The second column shows whether the group is in auto or manual mode. The final column contains the selected program path. Your groups and paths will differ according to the packages installed on your system.

To list only the registered paths for one group, pass its name to --list:

Terminal
update-alternatives --list java

output

/usr/lib/jvm/java-17-openjdk-amd64/bin/java
/usr/lib/jvm/java-21-openjdk-amd64/bin/java

This example has Java 17 and Java 21 registered. If the named group does not exist, the command reports that no alternatives are registered for it.

Display an Alternative

To see all registered options for a specific alternative and which one is currently active:

Terminal
update-alternatives --display java

output

java - auto mode
link best version is /usr/lib/jvm/java-21-openjdk-amd64/bin/java
link currently points to /usr/lib/jvm/java-21-openjdk-amd64/bin/java
link java is /usr/bin/java
slave java.1.gz is /usr/share/man/man1/java.1.gz
/usr/lib/jvm/java-17-openjdk-amd64/bin/java - priority 1711
slave java.1.gz: /usr/lib/jvm/java-17-openjdk-amd64/man/man1/java.1.gz
/usr/lib/jvm/java-21-openjdk-amd64/bin/java - priority 2111
slave java.1.gz: /usr/lib/jvm/java-21-openjdk-amd64/man/man1/java.1.gz

The output lists each registered path with its priority. In auto mode, the highest priority wins. The slave lines show related files that follow the same selection, in this case the java manual page.

Switch Between Alternatives

To choose interactively from the registered options, run:

Terminal
sudo update-alternatives --config java

output

There are 2 choices for the alternative java (providing /usr/bin/java).
Selection Path Priority Status
------------------------------------------------------------
* 0 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 auto mode
1 /usr/lib/jvm/java-17-openjdk-amd64/bin/java 1711 manual mode
2 /usr/lib/jvm/java-21-openjdk-amd64/bin/java 2111 manual mode
Press <enter> to keep the current choice[*], or type selection number: 1

Type the number of a manual choice and press Enter to pin that version. Selecting 0 keeps or restores automatic mode, while pressing Enter without a number keeps the current choice.

When a group is in manual mode, a package installation can register another choice but will not replace your valid selection.

Set an Alternative Noninteractively

The --set command changes an alternative without displaying a menu, which makes it useful in provisioning scripts. Use --list as shown above to copy the exact path, then pass it to --set:

Terminal
sudo update-alternatives --set java /usr/lib/jvm/java-17-openjdk-amd64/bin/java

The selected group enters manual mode. The path must already be registered in that group.

Alternative groups are independent unless their provider registered related files as slave links. For example, switching the java group does not necessarily switch javac. Use --display to check which links belong to a group.

Register a New Alternative

When you install a program outside the package manager, you can register it with --install. Assume two releases of a program are installed at /opt/acme-tool-1.0/bin/acme-tool and /opt/acme-tool-2.0/bin/acme-tool. Confirm that both executable paths exist before registering them:

Terminal
ls -l /opt/acme-tool-1.0/bin/acme-tool /opt/acme-tool-2.0/bin/acme-tool

Terminal
sudo update-alternatives --install /usr/local/bin/acme-tool acme-tool /opt/acme-tool-1.0/bin/acme-tool 100
sudo update-alternatives --install /usr/local/bin/acme-tool acme-tool /opt/acme-tool-2.0/bin/acme-tool 200

The arguments are:

txt
--install LINK NAME PATH PRIORITY

LINK is the path where the generic command link will be created (/usr/local/bin/acme-tool).
NAME is the alternative group name (acme-tool).
PATH is the actual binary (/opt/acme-tool-1.0/bin/acme-tool).
PRIORITY is the numeric weight used in auto mode (higher wins).

In this example, automatic mode selects version 2.0 because it has the higher priority.

Warning

Do not use update-alternatives to replace /usr/bin/python3 on Ubuntu or Debian. System tools depend on the distribution’s default Python interpreter. Use versioned commands, virtual environments, pyenv, or a separate command under /usr/local/bin instead.

Remove an Alternative

Before removing a registered path, display the group and confirm the exact path:

Terminal
update-alternatives --display acme-tool

Then deregister the path:

Terminal
sudo update-alternatives --remove acme-tool /opt/acme-tool-1.0/bin/acme-tool

The command removes the path from the alternatives database but does not delete the program itself. If you remove the active path, the group returns to automatic mode and selects the best remaining alternative.

Reset to Auto Mode

If you manually pinned an alternative and want to go back to automatic selection by priority:

Terminal
sudo update-alternatives --auto java

The system returns to the highest-priority option.

Switch the Editor Alternative

The editor alternative provides the system-wide /usr/bin/editor command. Programs that invoke this path follow the selected alternative, while tools such as sensible-editor may honor user-specific settings and environment variables first. To switch the system editor choice:

Terminal
sudo update-alternatives --config editor

Select an installed editor such as vim.basic from the list. Applications with their own editor setting do not necessarily follow this choice. Git, for example, checks GIT_EDITOR, core.editor, VISUAL, and EDITOR before using its compiled default.

Quick Reference

Task	Command
List all alternative groups	`update-alternatives --get-selections`
List paths in one group	`update-alternatives --list NAME`
Display group details	`update-alternatives --display NAME`
Choose interactively	`sudo update-alternatives --config NAME`
Select a path noninteractively	`sudo update-alternatives --set NAME PATH`
Return to automatic mode	`sudo update-alternatives --auto NAME`
Register a path	`sudo update-alternatives --install LINK NAME PATH PRIORITY`
Deregister a path	`sudo update-alternatives --remove NAME PATH`

Troubleshooting

no alternatives for NAME The group is not registered. Check the available names with update-alternatives --get-selections. Install a package that provides the group or register an existing executable with --install.

alternative path ... does not exist The path passed to --install must already exist. Check it with ls -l PATH, then correct the path or install the program before trying again.

A regular file blocks the alternatives link Do not immediately add --force. Check which package owns the path with dpkg -S /path/to/command, and back up locally installed files before replacing them with an alternatives-managed link.

Conclusion

Use --config for interactive changes, --set for scripts, and --auto when you want priority-based selection again. For a practical example with multiple JDKs, see How to Check Java Version .

How to Convert MP4 to MP3 with ffmpeg

hello@linuxize.com (Linuxize) — Sun, 26 Jul 2026 08:20:00 +0200

A recorded lecture, a podcast published as video, a concert clip you only ever listen to: sometimes all you want from an MP4 is its audio track. ffmpeg does this in one command, with full control over the output quality.

This guide shows how to convert MP4 to MP3 with ffmpeg, pick sensible quality settings, extract audio without any quality loss, and convert files in bulk.

Prerequisites

You need ffmpeg installed. On Ubuntu, Debian, and derivatives:

Terminal
sudo apt update
sudo apt install ffmpeg

These commands install both ffmpeg and ffprobe. For version-specific instructions, see our guides on installing ffmpeg on Ubuntu and Debian .

Converting MP4 to MP3

The simplest form gives ffmpeg an input, selects the LAME MP3 encoder, and names the output file:

Terminal
ffmpeg -i video.mp4 -c:a libmp3lame audio.mp3

This decodes the audio track from video.mp4, encodes it as MP3 with default settings, and writes audio.mp3. The video stream is dropped automatically, since an MP3 file cannot contain one.

For better control, the recommended form adds two options:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3

The -vn flag explicitly discards the video stream, -c:a libmp3lame selects the LAME MP3 encoder, and -q:a 2 selects variable bitrate (VBR) quality level 2. This level typically averages around 190 kb/s, although the actual bitrate depends on the audio.

Choosing the Quality

The MP3 encoder accepts a VBR quality scale from 0 (best) to 9 (smallest). These approximate bitrates vary with the source:

-q:a 0 - Around 245 kb/s; highest quality VBR, for music you care about.
-q:a 2 - Around 190 kb/s; the common sweet spot.
-q:a 5 - Around 130 kb/s; fine for speech and podcasts.
-q:a 7 - Around 100 kb/s; small files, audible compression on music.

If you need a constant bitrate instead, for example for a device that struggles with VBR, use -b:a:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -b:a 192k audio.mp3

Keep in mind that encoding cannot add quality back: if the source audio is a 96 kb/s stream, encoding it at 320 kb/s only produces a larger file, not a better-sounding one.

Extracting Audio Without Quality Loss

Converting to MP3 always re-encodes, which costs a small amount of quality. If you only need the original audio track, check its codec before deciding whether to convert it:

Terminal
ffprobe -v error -select_streams a:0 -show_entries stream=codec_name -of default=noprint_wrappers=1:nokey=1 video.mp4

output

aac

AAC audio is common in MP4 files and can be copied into an .m4a container without re-encoding:

Terminal
ffmpeg -i video.mp4 -map 0:a:0 -c:a copy audio.m4a

The -map 0:a:0 option selects the first audio stream, and -c:a copy moves the compressed audio without decoding or encoding it. The audio data remains unchanged, and the operation usually finishes much faster than an MP3 conversion. If ffprobe reports another codec, use a compatible container or convert the audio instead.

Converting Part of a File

To convert only a section, combine the conversion with a start time and a duration:

Terminal
ffmpeg -ss 00:05:30 -i video.mp4 -t 00:06:30 -vn -c:a libmp3lame -q:a 2 clip.mp3

The -ss option starts at 5:30, and -t 00:06:30 converts the next six minutes and thirty seconds, ending at 12:00. This is handy for pulling one song out of a concert recording or one answer out of a long interview.

Batch Converting Multiple Files

ffmpeg takes one input at a time, so converting a directory of MP4 files uses a small bash for loop :

Terminal
shopt -s nullglob
for f in *.mp4; do
 ffmpeg -n -i "$f" -vn -c:a libmp3lame -q:a 2 "${f%.mp4}.mp3"
done

The nullglob setting skips the loop when the directory contains no MP4 files. The ${f%.mp4} expansion strips the .mp4 extension so each MP3 keeps the original filename, while -n prevents existing files from being overwritten. The quotes around the variables keep filenames with spaces intact.

Troubleshooting

Unknown encoder ’libmp3lame’
Your ffmpeg build lacks the LAME MP3 encoder, which happens with some minimal or codec-restricted packages. Check for it with ffmpeg -hide_banner -encoders | grep -w libmp3lame, then install an FFmpeg package that includes the encoder.

Output file has no sound
The source may carry multiple audio tracks and the wrong one was picked. Inspect the file with ffprobe -hide_banner video.mp4, then select the track explicitly with -map, for example -map 0:a:1 for the second audio stream.

Could not write the M4A output header
The source audio codec is not compatible with the M4A container. Use a container that supports the original codec, or replace -c:a copy with -c:a aac -b:a 192k to create a compatible M4A file.

The output file already exists
FFmpeg asks before replacing an existing file. Use a different output name, add -n to keep the existing file, or add -y only when you intend to overwrite it.

Conclusion

One command covers the everyday case: ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3, with -q:a trading size against quality. For more conversion, compression, and inspection examples, see our ffmpeg command guide .

How to Find Which Process Is Using a Port in Linux

hello@linuxize.com (Linuxize) — Sat, 25 Jul 2026 07:30:00 +0200

You start a service, and it refuses to launch with an error like “bind: address already in use”. Something is already holding the port, but the message does not tell you what. Before you can fix it, you need to map the port back to a process, find its PID, and decide whether to stop it. Linux gives you several tools for this, and each one answers the question in a slightly different way.

This guide shows how to find the process using a port with ss, lsof, fuser, and netstat, and how to stop it once you have the PID.

If you need an inventory of every service accepting connections instead of one specific port, see the guide on checking listening ports in Linux .

Quick Reference

For printable quick references, see the ss cheatsheet , lsof cheatsheet , and netstat cheatsheet .

Task	Command
Find a TCP listener with ss	`sudo ss -ltnp 'sport = :80'`
Find a UDP socket with ss	`sudo ss -lunp 'sport = :53'`
Find a TCP listener with lsof	`sudo lsof -nP -iTCP:80 -sTCP:LISTEN`
Find processes with fuser	`sudo fuser -v 80/tcp`
Find a TCP listener with netstat	`sudo netstat -ltnp \| grep ':80 '`
Inspect a process	`ps -fp PID`
Stop an unmanaged process	`sudo kill PID`
Send SIGTERM with fuser	`sudo fuser -k -TERM 80/tcp`

Finding the Process with ss

The ss command is the standard choice on current Linux distributions. It comes from the iproute2 package and supports filters that match an exact port without piping the output through another command.

Terminal
sudo ss -ltnp 'sport = :80'

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1433,fd=6),("nginx",pid=1432,fd=6))
LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=1433,fd=6),("nginx",pid=1432,fd=6))

Run the command with sudo so ss can show process details for sockets owned by other users. The options provide the following information:

-l - Show only listening sockets.
-t - Show TCP sockets.
-n - Print numeric port numbers instead of resolving service names.
-p - Show the process that owns each socket.

The sport = :80 expression matches local port 80 exactly, so it does not also return ports such as 8080. In the output above, nginx holds the port. The Process column lists two process IDs because the master process, 1432, opened the socket and passed it to its worker, 1433. Either PID leads you back to the same service. The two rows show that nginx listens on both IPv4 and IPv6.

UDP sockets do not use the TCP LISTEN state. To check a UDP port, replace -t with -u. For example, the following command identifies the process bound to UDP port 53:

Terminal
sudo ss -lunp 'sport = :53'

output

State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
UNCONN 0 0 0.0.0.0:53 0.0.0.0:* users:(("dnsmasq",pid=902,fd=4))

The UNCONN state is normal for a UDP server because UDP does not establish connections before exchanging data.

Finding the Process with lsof

The lsof command lists open files, including network sockets. Use numeric output and restrict the result to TCP listeners on the port:

Terminal
sudo lsof -nP -iTCP:80 -sTCP:LISTEN

output

COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
nginx 1432 root 6u IPv4 28319 0t0 TCP *:80 (LISTEN)
nginx 1433 www-data 6u IPv4 28319 0t0 TCP *:80 (LISTEN)

The -nP options prevent hostname and service-name lookups, while -iTCP:80 selects TCP port 80 and -sTCP:LISTEN excludes established connections. The output reports the command, PID, user, and file descriptor. Here lsof gives you the same two nginx processes that ss reported, but it also shows the user each one runs as, which is useful when a master process drops privileges for its workers.

For UDP port 53, use this form:

Terminal
sudo lsof -nP -iUDP:53

The pattern is the same, except that -iUDP:53 selects the UDP port and there is no state filter, because UDP sockets never enter the LISTEN state.

Finding the Process with fuser

When you want a PID without the full socket table, fuser provides a short command. Pass the port number followed by the protocol:

Terminal
sudo fuser 80/tcp

output

80/tcp: 1432 1433

You get the PID list and nothing else, which makes the plain form easy to pass to another command. To include the user, access type, and command name, add the -v option:

Terminal
sudo fuser -v 80/tcp

output

 USER PID ACCESS COMMAND
80/tcp: root 1432 F.... nginx
www-data 1433 F.... nginx

The port appears once on the first row, and every process below it belongs to that same port. The ACCESS column describes how each process uses the socket, where F marks it as open for writing.

You must specify tcp or udp because the same numeric port can be used by both protocols.

Finding the Process with netstat

On older systems you may still find netstat , part of the net-tools package. Use it as a fallback when ss is not available:

Terminal
sudo netstat -ltnp | grep ':80 '

output

tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 1432/nginx: master

The last column ties PID 1432 to the nginx master process, and netstat truncates that name if it grows too long. Unlike ss and lsof, it reports a single process per socket rather than the whole group. The space after :80 in the filter prevents it from matching a longer port number such as 8080. For a UDP port, use -lunp instead of -ltnp.

Inspecting and Stopping the Process

Once you have the PID, confirm what started the process before stopping it. The following ps command shows the full command and its parent PID:

Terminal
ps -fp 1432

output

UID PID PPID C STIME TTY TIME CMD
root 1432 1 0 07:10 ? 00:00:00 nginx: master process /usr/sbin/nginx

A service manager or container runtime may own the process. In that case, stop it through its manager so it does not immediately start again. For example, stop an Nginx systemd service with:

Terminal
sudo systemctl stop nginx

Warning

Make sure you understand what the process does before stopping it. Terminating a database or another production service to free a port can interrupt active work or cause data loss.

For an unmanaged process, send SIGTERM with kill:

Terminal
sudo kill 1432

SIGTERM asks the process to shut down cleanly. If the process ignores it, you can use sudo kill -KILL 1432 as a last resort, but SIGKILL gives it no opportunity to save state or remove temporary files. For more detail about signals, see the guide on how to kill a process in Linux .

After inspecting the verbose fuser output, you can send SIGTERM to every process using the TCP port:

Terminal
sudo fuser -k -TERM 80/tcp

The explicit -TERM matters because fuser -k sends SIGKILL by default.

Confirming the Port Is Free

Run the same ss query after stopping the process:

Terminal
sudo ss -ltnp 'sport = :80'

If no socket row appears below the header, nothing is listening on TCP port 80 in the current network namespace. If you changed a service configuration instead of stopping it, start the service again and check the new port with the same command.

Troubleshooting

The port appears but the process name is missing
Run the command with sudo. Without root privileges, these tools may not be able to read details for sockets owned by another user.

ss returns nothing but the application still reports a conflict
Check that you are using the correct protocol. Use -lunp for UDP instead of -ltnp for TCP. The listener may also be inside another network namespace or container, so run the check in the same environment as the application.

The process starts again after you stop it
A service manager or container runtime is restarting it. Stop or reconfigure the systemd service, Docker container, or other supervisor instead of repeatedly killing its PID.

Several PIDs appear for the same port
Some servers use a master process with several workers that share one socket. Other applications can use the SO_REUSEPORT option. Identify the parent service and manage the group instead of stopping one worker at a time.

netstat: command not found
The net-tools package is not installed on many current distributions. Use ss instead.

Conclusion

Use ss first when you need the process behind a specific port, then turn to lsof or fuser when you need a different view. Inspect the PID and its manager before stopping anything, especially on a production system.

CIDR Notation and Subnetting Explained

hello@linuxize.com (Linuxize) — Fri, 24 Jul 2026 10:50:00 +0200

When you assign a static address, configure a firewall rule, or divide a private network, you will encounter values such as 192.168.10.0/24. The address identifies the network, while the number after the slash tells you how much of the address is fixed and how much remains available for hosts.

This guide explains how CIDR prefixes map to subnet masks, how to find network and broadcast addresses, and how to divide an IPv4 block into smaller subnets.

For instant calculations and a visual binary split, use the subnet calculator .

What CIDR Notation Means

CIDR stands for Classless Inter-Domain Routing. It replaced the older class-based system with variable-length prefixes, allowing networks to be sized and routed more precisely.

An IPv4 CIDR block contains an address followed by a slash and a prefix length:

txt
192.168.10.0/24

An IPv4 address contains 32 bits. The /24 prefix means the first 24 bits identify the network, leaving 8 bits for addresses inside that network. A longer prefix fixes more network bits and creates a smaller block. A shorter prefix leaves more host bits and creates a larger block.

The prefix can range from /0, which covers the entire IPv4 address space, to /32, which identifies one address. CIDR notation is used for both network allocation and routing, so the same format can describe a LAN subnet, a firewall source range, or a single host route.

Network Bits and Host Bits

To see the /24 boundary, write the address and mask in binary:

txt
Address: 11000000.10101000.00001010.00000000
Mask: 11111111.11111111.11111111.00000000
 <------ network ------><-- host -->

Every 1 in the mask belongs to the network prefix. Every 0 leaves a bit that can vary within the block. Because /24 leaves 8 host bits, the block contains 2^8, or 256, addresses.

The network portion stays constant for every address in the block. Only the last 8 bits change, producing the range 192.168.10.0 through 192.168.10.255.

Convert a CIDR Prefix to a Subnet Mask

A subnet mask expresses the same boundary as a CIDR prefix, but in dotted-decimal form. A /24 has 24 one bits followed by 8 zero bits:

txt
11111111.11111111.11111111.00000000
255.255.255.0

Prefixes that end on an octet boundary are easy to recognize: /8 is 255.0.0.0, /16 is 255.255.0.0, and /24 is 255.255.255.0.

For a prefix such as /26, the first two bits of the final octet also belong to the network:

txt
11111111.11111111.11111111.11000000
255.255.255.192

The binary value 11000000 equals 192, so /26 maps to 255.255.255.192. The remaining six host bits provide 2^6, or 64, total addresses per subnet.

Calculate the Number of Addresses and Hosts

For a normal IPv4 subnet, calculate the total number of addresses with this formula:

txt
Total addresses = 2^(32 - prefix length)

A /27 leaves five host bits, so it contains 2^5 = 32 addresses. The first address is normally reserved as the network address, and the last is the broadcast address, leaving 30 addresses for host interfaces.

Two prefixes need separate treatment:

A /31 contains two addresses. On a point-to-point link, RFC 3021 treats both as host addresses because that link has no need for a separate network or broadcast address.
A /32 contains one address and represents a host route, not a conventional multi-host subnet.

The familiar total minus 2 rule therefore applies to conventional IPv4 subnets from /0 through /30, not blindly to every prefix.

Find the Network and Broadcast Addresses

Consider the address 192.168.10.34/27. A /27 mask is 255.255.255.224, which creates blocks of 32 addresses in the final octet:

txt
0-31, 32-63, 64-95, 96-127, 128-159, 160-191, 192-223, 224-255

The address .34 falls in the 32-63 block. That gives us:

Network address: 192.168.10.32
First usable address: 192.168.10.33
Last usable address: 192.168.10.62
Broadcast address: 192.168.10.63

You can find the block size by subtracting the changing mask octet from 256. For /27, 256 - 224 = 32. Starting at zero, count in increments of 32 until you find the range that contains the address.

On Linux, the ip command displays each interface address together with its CIDR prefix:

Terminal
ip -brief address

output

lo UNKNOWN 127.0.0.1/8 ::1/128
eth0 UP 192.168.10.34/27

The output shows that eth0 uses the /27 network calculated above.

Subnet a /24 Network into /26 Blocks

Suppose you have 192.168.10.0/24 and need four equal networks. Moving from /24 to /26 borrows two host bits for subnetting. Two borrowed bits produce 2^2 = 4 subnets.

Each /26 contains 64 total addresses and 62 conventional host addresses:

Subnet	Usable host range	Broadcast
`192.168.10.0/26`	`192.168.10.1` to `192.168.10.62`	`192.168.10.63`
`192.168.10.64/26`	`192.168.10.65` to `192.168.10.126`	`192.168.10.127`
`192.168.10.128/26`	`192.168.10.129` to `192.168.10.190`	`192.168.10.191`
`192.168.10.192/26`	`192.168.10.193` to `192.168.10.254`	`192.168.10.255`

The subnet boundaries increase by 64 because /26 leaves six host bits and 2^6 = 64. A network address must start on one of these boundaries. For example, 192.168.10.64/26 is valid, but 192.168.10.70/26 is an address inside that network rather than the network identifier.

Combine Networks with Route Aggregation

CIDR also lets routers summarize adjacent networks into one larger route. For example, these four /24 networks are contiguous:

txt
168.0.0/24
168.1.0/24
168.2.0/24
168.3.0/24

They can be advertised as the single route 192.168.0.0/22. A /22 contains 1024 addresses, exactly the same total as four /24 blocks.

Aggregation works only when the networks are contiguous and aligned on the larger prefix boundary. The four networks from 192.168.1.0/24 through 192.168.4.0/24 cannot form one /22, even though their total size is the same, because the range does not start on a /22 boundary.

CIDR Notation in IPv6

IPv6 uses CIDR prefixes over a 128-bit address. For example:

txt
2001:db8:1234:5600::/64

The /64 prefix fixes the first 64 bits and leaves the remaining 64 bits for the interface identifier. A /64 is the common size for an IPv6 LAN, especially when Stateless Address Autoconfiguration (SLAAC) is used, although routing prefixes can have other lengths.

IPv6 has no broadcast address. Multicast replaces broadcast behavior, and all-zero or all-one values are legal within address fields unless a specific rule says otherwise. See the IPv4 vs IPv6 comparison for the broader differences between the protocols.

Quick Reference

Prefix	Subnet mask	Total addresses	Conventional usable hosts
`/8`	`255.0.0.0`	16,777,216	16,777,214
`/16`	`255.255.0.0`	65,536	65,534
`/20`	`255.255.240.0`	4,096	4,094
`/22`	`255.255.252.0`	1,024	1,022
`/24`	`255.255.255.0`	256	254
`/25`	`255.255.255.128`	128	126
`/26`	`255.255.255.192`	64	62
`/27`	`255.255.255.224`	32	30
`/28`	`255.255.255.240`	16	14
`/29`	`255.255.255.248`	8	6
`/30`	`255.255.255.252`	4	2
`/31`	`255.255.255.254`	2	2 on point-to-point links
`/32`	`255.255.255.255`	1	1 host route

Conclusion

The CIDR prefix tells you exactly where the network bits end and the host bits begin. Once you can convert that boundary to a mask and block size, you can calculate ranges, divide networks, and check firewall rules without relying on the old address classes.

mount Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 24 Jul 2026 07:45:00 +0200

Basic Syntax

Core mount and umount command forms.

Command	Description
`mount DEVICE DIR`	Attach a device to a mount point
`mount -t TYPE DEVICE DIR`	Mount with an explicit filesystem type
`mount -o OPTIONS DEVICE DIR`	Mount with a comma-separated option list
`mount DIR`	Mount an entry already defined in `/etc/fstab`
`mount -a`	Mount `/etc/fstab` filesystems except `noauto` entries
`umount DIR`	Detach the filesystem mounted at `DIR`

Most mount operations require root privileges, so prefix them with sudo.

List Mounted Filesystems

Inspect what is currently mounted and where.

Command	Description
`mount`	List all mounts using the legacy display; prefer `findmnt`
`findmnt`	Show mounts as a readable tree
`findmnt /dev/sdb1`	Show where a specific device is mounted
`findmnt -t ext4,xfs`	List only the given filesystem types
`findmnt --fstab --verify`	Check `/etc/fstab` for errors before rebooting
`cat /proc/mounts`	Read active mounts in the current mount namespace
`lsblk -f`	List block devices with type, label, and UUID
`df -hT`	Show mounted filesystems with type and free space

Common Mount Options

Values passed to -o or listed in the fourth /etc/fstab field.

Option	Description
`defaults`	Common defaults are `rw,suid,dev,exec,auto,nouser,async`; exact defaults vary
`ro` / `rw`	Mount read-only or read-write
`noexec`	Block execution of binaries on the filesystem
`nosuid`	Ignore setuid and setgid bits
`nodev`	Ignore device files on the filesystem
`noatime`	Skip access-time updates, which reduces disk writes
`sync` / `async`	Write synchronously or let the kernel buffer writes
`noauto`	Skip this entry during `mount -a` and at boot
`user`	Allow a non-root user to mount; implies `noexec,nosuid,nodev` unless overridden
`nofail`	Continue booting when the device is missing
`uid=1000,gid=1000`	Set owner and group on filesystems without Unix permissions
`remount`	Change options on an already mounted filesystem

Example: sudo mount -o remount,rw / remounts the root filesystem read-write.

Mount by UUID or Label

Device names such as /dev/sdb1 can change between boots, so identify the filesystem instead.

Command	Description
`lsblk -f`	Show the UUID and label of every filesystem
`sudo blkid`	Print device type, label, and UUID
`sudo blkid /dev/sdb1`	Print the attributes of one device
`sudo mount UUID=1a2b3c4d-... /mnt/data`	Mount by filesystem UUID
`sudo mount LABEL=backup /mnt/backup`	Mount by filesystem label
`sudo mount -U 1a2b3c4d-... /mnt/data`	Short form of the UUID lookup
`sudo mount -L backup /mnt/backup`	Short form of the label lookup
`sudo e2label /dev/sdb1 backup`	Set a label on an ext2, ext3, or ext4 filesystem

Prefer UUID= or LABEL= for persistent local mounts in /etc/fstab because device names can change.

Filesystem Types

Values for -t and for the third /etc/fstab field.

Type	Description
`ext4`	Widely used general-purpose Linux filesystem
`xfs`	High-performance journaling filesystem, default on RHEL
`btrfs`	Copy-on-write filesystem with snapshots and subvolumes
`vfat`	FAT32, used by USB drives and EFI system partitions
`exfat`	Large-file FAT variant for USB drives and SD cards
`ntfs3`	In-kernel NTFS driver available on supported kernels
`iso9660`	Optical disc and ISO image filesystem
`tmpfs`	In-memory filesystem backed by RAM and swap
`nfs`	Network File System share
`cifs`	SMB or Windows network share
`auto`	Let `mount` detect the type

Network and Special Mounts

Mount forms beyond a plain local partition.

Command	Description
`sudo mount -t nfs server:/srv/data /mnt/data`	Mount an NFS export
`sudo mount -t cifs //server/share /mnt/share -o username=user`	Mount a Windows or Samba share
`sudo mount -t cifs //server/share /mnt/share -o credentials=/etc/smb-credentials`	Mount CIFS with a credentials file
`sshfs user@host:/remote/dir /mnt/remote`	Mount a remote directory over SSH
`sudo mount -o loop image.iso /mnt/iso`	Mount an ISO image through a loop device
`sudo mount --bind /src /dst`	Expose an existing directory at a second path
`sudo mount --rbind /src /dst`	Bind a directory together with its submounts
`sudo mount -t tmpfs -o size=512M tmpfs /mnt/ram`	Create a 512 MB RAM-backed filesystem

Keep CIFS credentials outside project directories and version control. Protect the file with sudo chmod 600 /etc/smb-credentials.

Unmounting

Detach a filesystem and deal with a busy mount point.

Command	Description
`sudo umount /mnt/data`	Unmount by mount point
`sudo umount /dev/sdb1`	Unmount by device (obsolete; use the mount point)
`sudo umount -R /mnt/data`	Unmount a mount point and everything below it
`sudo umount -l /mnt/data`	Lazy unmount: detach now, release when no longer in use
`sudo umount -f /mnt/share`	Force an unmount, mainly for unreachable network shares
`sudo umount -a -t nfs`	Unmount every NFS filesystem
`lsof +f -- /mnt/data`	List open files under the mount point
`fuser -mv /mnt/data`	Show processes and users holding the mount point
`sudo fuser -km /mnt/data`	Kill every process using the mount point; destructive

Review fuser -mv output before using fuser -km. Use lazy or forced unmounts only when a normal unmount cannot work: -f can lose unwritten data, while -l hides the path before all references are released.

Persistent Mounts in /etc/fstab

Each line has six space-separated fields.

Field	Description
1. Device	`UUID=`, `LABEL=`, a device path, or a remote share
2. Mount point	Existing directory, or `none` for swap
3. Type	Filesystem type, such as `ext4`, `nfs`, or `cifs`
4. Options	Comma-separated mount options, or `defaults`
5. Dump	`0` in nearly all cases; `1` marks the filesystem for `dump`
6. Pass	Order of `fsck` at boot: `1` for root, `2` for others, `0` to skip

Example: UUID=1a2b3c4d-... /mnt/data ext4 defaults,nofail 0 2

Command	Description
`sudo findmnt --fstab --verify`	Validate the file before rebooting
`sudo mount -a`	Apply mountable entries after validating `/etc/fstab`
`sudo systemctl daemon-reload`	Regenerate the systemd mount units after an edit
`sudo mount /mnt/data`	Mount one entry using only its mount point

Use nofail only for optional mounts. Add _netdev when a network-backed filesystem is not recognized as network-dependent from its type.

Troubleshooting

Common mount errors and what to check.

Error	Check
`target is busy`	Find the holder with `fuser -mv DIR` or `lsof +f -- DIR`, then close it
`unknown filesystem type`	Install the required helper or driver, such as `ntfs-3g`, `nfs-common` or `nfs-utils`, or `cifs-utils`; confirm kernel support for exFAT
`wrong fs type, bad option, bad superblock`	Confirm the type with `lsblk -f` and check `dmesg`. If repair is needed, unmount it and use the correct filesystem checker
`mount point does not exist`	Create the directory first with `sudo mkdir -p DIR`
`permission denied` on CIFS	Verify credentials and server share permissions; `uid=` and `gid=` only control local ownership
`special device does not exist`	Recheck the UUID with `blkid`; the device name may have changed
Files are hidden after mounting	The mounted filesystem covers existing directory contents; unmount it and inspect the underlying path
Boot drops to emergency mode	Remount root with `mount -o remount,rw /`, fix the bad `/etc/fstab` line, and validate it; add `nofail` only if the mount is optional

Use these guides and cheatsheets for complete storage workflows.

Guide	Description
How to Mount and Unmount File Systems in Linux	Full guide to `mount` and `umount` with practical examples
Understanding the /etc/fstab File in Linux	Field-by-field breakdown of persistent mount entries
How to Mount an NFS Share in Linux	Install the client, mount a share, and troubleshoot errors
How to Mount a Windows Share on Linux Using CIFS	Credentials files, ownership, and permissions for SMB shares
How to Mount ISO File on Linux	Loop devices and the graphical mounting method
How to Use SSHFS to Mount Remote Directories over SSH	Mount a remote directory and browse it like a local one
df Cheatsheet	Check free space on mounted filesystems
fdisk Cheatsheet	Partition a disk before creating a filesystem

SSH Connection Refused: Causes and Fixes

hello@linuxize.com (Linuxize) — Thu, 23 Jul 2026 14:20:00 +0200

You try to log in and SSH stops immediately with connect to host example.com port 22: Connection refused. The failure happens before SSH checks your key or password, so changing authentication settings will not fix it.

An immediate refusal means the target address has no process listening on that port, or a firewall or network device actively rejected the request. The usual causes are a stopped SSH server, the wrong host or port, a listener bound to another address, a firewall reject rule, or port forwarding to the wrong machine. A connection that hangs and then times out is different because no response came back.

This guide starts with checks you can run from the client, then moves to the SSH service, listening port, firewall, and network path on the server.

Quick Reference

For a printable quick reference, see the SSH cheatsheet .

Check	Command
Confirm the destination address	`getent ahosts example.com`
Show SSH connection details	`ssh -vvv user@example.com`
Test the default SSH port	`nc -vz example.com 22`
Check for a listener on port 22	`sudo ss -ltnp 'sport = :22'`
Show the effective SSH port and addresses	`sudo sshd -T \| grep -E '^(port\|listenaddress) '`
Check SSH on Ubuntu or Debian	`sudo systemctl status ssh.service ssh.socket`
Check SSH on Fedora or RHEL	`sudo systemctl status sshd`
Check UFW rules	`sudo ufw status numbered`
Check firewalld services	`sudo firewall-cmd --list-services`

Confirm the Host and Port from the Client

Before changing the server, confirm that the hostname resolves to the address you expect:

Terminal
getent ahosts example.com

If the result points to an old server or the wrong public address, correct the DNS record or connect to the intended IP address directly. Reaching the wrong host can produce a refusal even when SSH is working on the real server.

Next, run SSH with verbose output:

Terminal
ssh -vvv user@example.com

The relevant lines look like this:

output

debug1: Connecting to example.com [203.0.113.10] port 22.
ssh: connect to host example.com port 22: Connection refused

The client resolved example.com to 203.0.113.10 and received an immediate refusal from port 22. You can test the TCP port without starting an SSH login:

Terminal
nc -vz example.com 22

If the server uses a custom port, test and connect to that port instead:

Terminal
nc -vz example.com 2222
ssh -p 2222 user@example.com

A hostname can also have separate IPv4 and IPv6 addresses. Test each address family when one DNS record may point to the wrong server:

Terminal
ssh -4 user@example.com
ssh -6 user@example.com

The remaining checks require access to the server through a cloud console, virtual machine console, physical terminal, or another management channel.

Check Whether SSH Is Listening

The listening socket is the quickest way to tell whether the server can accept SSH connections on port 22. Run this command on the server:

Terminal
sudo ss -ltnp 'sport = :22'

A working listener appears as either sshd or systemd, depending on whether the distribution runs the daemon continuously or uses socket activation. If the command returns nothing, no process is accepting connections on port 22.

To see the port and addresses from the effective OpenSSH configuration, run:

Terminal
sudo sshd -T | grep -E '^(port|listenaddress) '

Typical output looks like this:

output

port 22
listenaddress [::]:22
listenaddress 0.0.0.0:22

The output shows that SSH is configured for port 22 on all IPv6 and IPv4 addresses. If it reports another port, connect with the -p option and verify that the firewall allows that port. See our guide on changing the SSH port if you need to correct the configuration.

Check the SSH Service or Socket

Linux distributions use different systemd unit names for OpenSSH. Ubuntu and Debian use ssh.service, while Fedora, RHEL, and their derivatives use sshd.service.

On Ubuntu and Debian, check the service:

Terminal
sudo systemctl status ssh.service

Ubuntu 22.10 and later use ssh.socket by default, so check that unit as well:

Terminal
sudo systemctl status ssh.socket

When ssh.socket is active and owns port 22, ssh.service may remain inactive until a client connects. In that setup, an inactive service alone does not indicate a problem. If the socket is disabled or stopped, enable it and start it:

Terminal
sudo systemctl enable --now ssh.socket

On systems without ssh.socket, enable and start the service instead:

Terminal
sudo systemctl enable --now ssh

On Fedora, RHEL, and derivatives, check and start sshd:

Terminal
sudo systemctl status sshd
sudo systemctl enable --now sshd

If the unit reports failed, validate the SSH server configuration:

Terminal
sudo sshd -t

No output means the configuration passed the test. If OpenSSH prints an error, correct the reported line before restarting the unit. You can also inspect the current boot logs on Ubuntu and Debian:

Terminal
sudo journalctl -u ssh.service -u ssh.socket -b

For Fedora and RHEL, use the sshd unit name:

Terminal
sudo journalctl -u sshd -b

Install the OpenSSH Server

Some minimal installations include the SSH client but not the server. If systemctl reports that the SSH unit does not exist, install the openssh-server package.

Ubuntu, Debian, and Derivatives

Update the package index and install the server package:

Terminal
sudo apt update
sudo apt install openssh-server

The package normally starts the appropriate SSH service or socket during installation. Check port 22 again with ss instead of assuming that the listener started successfully.

Fedora, RHEL, and Derivatives

Install the server package, then enable and start sshd:

Terminal
sudo dnf install openssh-server
sudo systemctl enable --now sshd

Check the Listening Address

SSH can run normally but listen only on the loopback interface or one private address. In that case, a local connection works while connections to other server addresses are refused.

Review the listenaddress lines from sshd -T. A value such as 127.0.0.1:22 accepts only local IPv4 connections. OpenSSH reads its main configuration from /etc/ssh/sshd_config and may also read files under /etc/ssh/sshd_config.d/.

Before changing Port or ListenAddress, keep console access open and validate the new configuration with sudo sshd -t. On Ubuntu systems using socket activation, the socket must also reload the generated listening configuration. The port-change guide linked above covers the service and socket steps in order.

Check the Firewall

A firewall is less likely to cause an immediate refusal than a missing listener. Rules that silently drop traffic usually end with Connection timed out, while an explicit REJECT rule can return Connection refused. Check the firewall after confirming the service and port.

If the server uses UFW, list its rules with numbers:

Terminal
sudo ufw status numbered

Allow the standard OpenSSH profile when SSH uses port 22:

Terminal
sudo ufw allow OpenSSH

For a custom port, allow the exact TCP port instead:

Terminal
sudo ufw allow 2222/tcp

On a server using firewalld, first check the services allowed in the active zone:

Terminal
sudo firewall-cmd --list-services

Add SSH to both the runtime and permanent configurations if it is missing:

Terminal
sudo firewall-cmd --add-service=ssh
sudo firewall-cmd --permanent --add-service=ssh

For a custom port, use --add-port=2222/tcp in both commands. Our UFW firewall guide explains how to review and manage rules in more detail.

Check Port Forwarding and External Firewalls

If SSH works from the same machine or local network but fails from the internet, the OpenSSH listener may already be correct. Check that the router or virtualization platform forwards the external port to the server’s current private address and SSH port.

The same issue can occur with a virtual machine, container, load balancer, or cloud firewall. Confirm that public DNS points to the expected system and that each forwarding rule uses the same port you pass to ssh. Cloud firewall rules often drop traffic and cause a timeout, but an edge device that rejects the request or forwards it to the wrong host can produce a refusal.

Troubleshooting

Connection refused started after an SSH configuration change
Run sudo sshd -t and correct every reported error. On Ubuntu with socket activation, reload systemd and restart ssh.socket after a valid Port or ListenAddress change, then verify the listener with ss before closing console access.

SSH works with localhost but not the server address
Check the effective ListenAddress values and the firewall rules for the external interface. A listener restricted to 127.0.0.1 or ::1 cannot accept remote connections.

IPv4 works but IPv6 is refused
The server may have an AAAA record without an IPv6 listener. Compare ssh -4 and ssh -6, then correct the DNS record or configure SSH to listen on the intended IPv6 address.

Only one client address is refused
A source-specific firewall rule or a tool such as Fail2ban may be rejecting that address. Review the firewall rules and, if Fail2ban is installed, check the SSH jail with sudo fail2ban-client status sshd.

SSH reaches the server but reports Permission denied
The network path and listener are working, and the failure has moved to authentication. Follow the SSH Permission denied (publickey) guide instead.

Conclusion

Once the port test succeeds, SSH should move on to host-key verification or authentication. Before exposing the restored service to the internet, review our SSH hardening best practices and restrict firewall access where possible.

Dockerfile COPY vs ADD: Which to Use

hello@linuxize.com (Linuxize) — Wed, 22 Jul 2026 10:25:00 +0200

When a Docker image needs application code, configuration, or a release archive, both COPY and ADD can place files in the image. For an ordinary local file, COPY app.py /app/ and ADD app.py /app/ produce the same result, but the instructions differ once archives, remote sources, or build stages are involved.

Use COPY for local files and artifacts from other build stages. Use ADD when you want automatic tar extraction or need BuildKit to fetch a remote HTTP or Git source. This guide compares both instructions and explains which one fits each case.

What COPY Does

COPY takes files or directories from the build context and places them at a destination inside the image:

dockerfile
COPY requirements.txt /app/
COPY src/ /app/src/

An archive copied this way stays an archive, and a source path cannot point outside the build context. Two options cover common permission needs by setting ownership and mode as the files are copied:

dockerfile
COPY --chown=appuser:appgroup --chmod=644 config.yml /app/

COPY can also read from a named context, another image, or an earlier stage in a multi-stage build. The --from option is commonly used to move compiled artifacts into a smaller production image:

dockerfile
COPY --from=builder /app/target/server /usr/local/bin/server

What ADD Does

For local files and directories, ADD behaves much like COPY. It also understands local tar archives, remote URLs, and Git repository sources.

When the source is a local tar archive, either uncompressed or compressed with gzip, bzip2, or xz, ADD extracts it into the destination instead of copying the archive file:

dockerfile
ADD rootfs.tar.gz /

Docker detects an archive from its contents, not its filename. A file named rootfs.tar.gz that does not contain a recognized tar archive is copied without an extraction error. When you need the archive itself inside the image, use COPY, or use ADD --unpack=false with Dockerfile syntax 1.17 or later.

For remote sources, ADD can download an HTTP or HTTPS URL. BuildKit supports --checksum so the build fails if the downloaded content does not match the expected SHA-256 digest. Here is a checksum-verified download:

dockerfile
# syntax=docker/dockerfile:1
ADD --checksum=sha256:24454f830cdb571e2c4ad15481119c43b3cafd48dd869a9b2945d1036d1dc68d \
 https://mirrors.edge.kernel.org/pub/linux/kernel/Historic/linux-0.01.tar.gz \
 /tmp/linux-0.01.tar.gz

Remote tar archives are downloaded without extraction by default. Dockerfile syntax 1.17 added --unpack=true for builds that should download and extract a remote tar archive in one instruction.

ADD can also clone a Git repository from an HTTPS or SSH address. A branch, tag, commit, or subdirectory can be selected in the URL, and --checksum can pin a Git source to a commit. These behaviors are covered in the official Dockerfile ADD reference .

Key Differences

Source or behavior	COPY	ADD
Local files and directories	Copies them	Copies them
Local tar archive	Keeps the archive	Extracts it by default
Remote HTTP or HTTPS URL	Not supported	Downloads it
Remote Git repository	Not supported	Clones it
Checksum for a remote source	Not applicable	`--checksum`
Remote tar extraction	Not supported	`--unpack=true`
Build stage, named context, or image	`--from`	Not supported

Choosing Between COPY and ADD

Use COPY for application source code, configuration, static assets, and other ordinary files from the build context. It states the intent directly and ensures that an archive remains intact. COPY --from is also the correct choice for moving artifacts between build stages or importing files from another image.

Use ADD when its source-aware behavior is part of the task. Local tar extraction is useful for assembling a root filesystem or installing a vendored release archive without storing the compressed archive in its own image layer.

For example, this instruction extracts a local application archive directly into /opt/app/:

dockerfile
ADD app-1.4.2-dist.tar.gz /opt/app/

For remote artifacts, current Docker build best practices favor ADD with --checksum because BuildKit can cache the remote source precisely and verify its contents. A RUN instruction with curl or wget is still appropriate when you need custom request handling or additional processing. Keep verification, extraction, and cleanup in the same RUN instruction so temporary files do not remain in a separate layer.

Conclusion

Choose COPY for local content and multi-stage artifacts. Choose ADD when you need automatic tar extraction or a checksum-verified remote source. For the complete image-building workflow, see our guide on building Docker images with a Dockerfile , and keep the Docker cheatsheet nearby for the rest of the instruction set.

head Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 21 Jul 2026 13:20:00 +0200

Basic Syntax

Core head command forms.

Command	Description
`head FILE`	Show the first 10 lines of a file
`head -n 20 FILE`	Show the first 20 lines
`head -c 100 FILE`	Show the first 100 bytes
`command \| head -n 10`	Limit piped output to 10 lines
`head -- -notes.txt`	Read a file whose name starts with `-`

Select Lines

Control how many lines are printed.

Command	Description
`head -n 5 /etc/passwd`	Show the first 5 lines
`head -n 1 data.csv`	Print the header row of a CSV file
`head -n 100 app.log`	Preview the first 100 log entries
`head -n -5 FILE`	Show all lines except the last 5 (GNU)
`head -n 2 FILE1 FILE2`	Show the first 2 lines of each file

Select Bytes

Read a fixed number of bytes instead of lines.

Command	Description
`head -c 100 FILE`	Show the first 100 bytes
`head -c 2K FILE`	Show the first 2048 bytes
`head -c 1MB FILE`	Show the first 1,000,000 bytes
`head -c -512 FILE`	Show all bytes except the last 512 (GNU)
`head -c 512 disk.img > header.bin`	Save the first 512 bytes to a file

Multiple Files and Headers

Control the file-name headers shown with multiple inputs.

Command	Description
`head FILE1 FILE2`	Show 10 lines from each file with headers
`head -n 5 *.log`	Show the first 5 lines of every matched log
`head -q FILE1 FILE2`	Suppress file-name headers
`head -v FILE`	Always print a file-name header
`head -n 5 FILE1 - FILE2`	Read files and standard input in sequence

Pipelines

Combine head with other text-processing commands.

Command	Description
`ls -t \| head -n 5`	Show the 5 most recently modified entries
`sort -nr scores.txt \| head -n 10`	Show the 10 highest numeric values
`grep 'ERROR' app.log \| head -n 20`	Show the first 20 matching errors
`tail -n +20 FILE \| head -n 11`	Extract lines 20 through 30
`head -n 20 FILE \| wc -w`	Count words in the first 20 lines

Useful Options

Common GNU head flags and long forms.

Option	Description
`-n NUM`, `--lines=NUM`	Print the first `NUM` lines
`-c NUM`, `--bytes=NUM`	Print the first `NUM` bytes
`-q`, `--quiet`	Never print file-name headers
`-v`, `--verbose`	Always print file-name headers
`-z`, `--zero-terminated`	Read and write NUL-delimited items (GNU)
`--help`	Show command help
`--version`	Show the installed version

Use head -n 5 instead of the obsolete head -5 syntax in scripts.

NUL-Delimited Input

Handle file names containing spaces, newlines, or other special characters.

Command	Description
`find . -type f -print0 \| head -z -n 5`	Select the first 5 NUL-delimited paths
`find . -type f -print0 \| head -z -n 5 \| xargs -0 -r ls -l`	Pass the first 5 paths safely to `ls`
`printf 'one\0two\0' \| head -z -n 1`	Print the first NUL-delimited item

The -z option is specific to GNU head.

Troubleshooting

Quick checks for common head issues.

Issue	Check
Only 10 lines are shown	This is the default; set the count with `-n NUM`
File-name headers appear	Multiple files trigger headers; add `-q` to suppress them
Binary output looks garbled	Redirect byte output to a file or inspect it with `hexdump`
`head -n -5` fails	Negative counts are a GNU feature and are not portable
Upstream command reports a broken pipe	`head` exits after collecting enough input; some producers report the closed pipe

Use these guides and cheatsheets for complete text-processing workflows.

Guide	Description
head Command in Linux	Full guide to lines, bytes, files, and pipelines
tail Cheatsheet	Read the end of files and follow logs
cat Cheatsheet	Display and combine file contents
sort Cheatsheet	Order lines before selecting top results
wc Cheatsheet	Count lines, words, and bytes

lsusb, lspci, and lshw: List Hardware in Linux

hello@linuxize.com (Linuxize) — Tue, 21 Jul 2026 09:40:00 +0200

Sooner or later you need to know exactly what is inside a machine: which Wi-Fi chip refuses to work, whether the system sees a plugged-in USB device at all, or what to put in a purchase order for more RAM. Three commands answer these questions from the terminal, each covering a different part of the hardware inventory: lsusb for USB devices, lspci for PCI devices such as network cards and GPUs, and lshw for a complete inventory of everything.

This guide explains how to use all three, and which one to reach for depending on the question you are asking.

Installing the Tools

The three commands live in three small packages, most of which are preinstalled on desktop distributions.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install usbutils pciutils lshw

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install usbutils pciutils lshw

Listing USB Devices with lsusb

Run lsusb without arguments to list every device on the USB buses:

Terminal
lsusb

output

Bus 002 Device 001: ID 1d6b:0003 Linux Foundation 3.0 root hub
Bus 001 Device 004: ID 046d:c52b Logitech, Inc. Unifying Receiver
Bus 001 Device 003: ID 13d3:56a6 IMC Networks Integrated Camera
Bus 001 Device 002: ID 8087:0aaa Intel Corp. Bluetooth 9460/9560
Bus 001 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub

Each line shows the bus and device number, then the ID in vendor:product form, then a human-readable name looked up from the USB ID database. The 1d6b root hubs are the controllers themselves, not devices you plugged in.

The classic use is answering “does the system see this thing at all”: run lsusb, plug the device in, run it again, and compare. If a new line appears, the system has enumerated the device, so drivers, firmware, and application support are the next places to check. Enumeration does not prove that the device or cable is fully healthy, but it confirms that the USB host received a response. If nothing appears, try another port or cable before blaming the OS. Recent kernel messages from dmesg show the same plug events with more detail.

The tree view adds the piece the flat list lacks, which drivers claimed each device and at what speed it connected:

Terminal
lsusb -t

output

/: Bus 02.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/6p, 10000M
/: Bus 01.Port 1: Dev 1, Class=root_hub, Driver=xhci_hcd/12p, 480M
|__ Port 4: Dev 2, If 0, Class=Wireless, Driver=btusb, 12M
|__ Port 5: Dev 3, If 0, Class=Video, Driver=uvcvideo, 480M
|__ Port 9: Dev 4, If 2, Class=Human Interface Device, Driver=usbhid, 12M

A device present in lsusb but showing no Driver= entry here has been enumerated but has no kernel driver bound to that interface. That can indicate a missing kernel module or firmware package, although some devices are intentionally controlled by a userspace driver such as libusb. A USB 3 drive showing 480M instead of 5000M is connected through a USB 2 port or cable, a common reason external disks underperform.

For full descriptors of a single device, filter by its ID and add -v:

Terminal
sudo lsusb -v -d 046d:c52b

The verbose output is long; without root, parts of it are hidden.

Listing PCI Devices with lspci

PCI is where the built-in hardware lives: network controllers, graphics cards, storage controllers, and sound chips. The bare command lists them all:

Terminal
lspci

output

00:00.0 Host bridge: Intel Corporation Device a706
00:02.0 VGA compatible controller: Intel Corporation Raptor Lake-P [Iris Xe Graphics]
00:14.3 Network controller: Intel Corporation Raptor Lake PCH CNVi WiFi
00:1f.3 Audio device: Intel Corporation Raptor Lake-P/U/H cAVS
01:00.0 Non-Volatile memory controller: Samsung Electronics Co Ltd NVMe SSD Controller PM9A1

The leading 00:14.3 style address identifies the device’s slot and function, and the text after the class name identifies the chip. This is the fastest way to find out exactly which Wi-Fi or Ethernet chip a machine has, which is the first thing any driver search needs.

The single most useful option is -k, which shows the kernel driver bound to each device:

Terminal
lspci -k

output

00:14.3 Network controller: Intel Corporation Raptor Lake PCH CNVi WiFi
Subsystem: Intel Corporation Device 0094
Kernel driver in use: iwlwifi
Kernel modules: iwlwifi

Kernel modules lists what could drive the device, and Kernel driver in use shows what actually is. For a device that normally needs a kernel driver, modules listed but no driver in use can indicate missing firmware, a blacklisted module, or a binding problem. Some PCI functions do not need their own driver, so confirm the expected behavior before treating the missing line as an error. On systems with two GPUs, lspci -k is also the quick way to see which one is bound to which driver.

Two more options come up regularly. -nn appends the numeric [vendor:device] IDs, which are what you paste into a search engine or a driver compatibility list when the text name is ambiguous:

Terminal
lspci -nn | grep -i network

output

00:14.3 Network controller [0280]: Intel Corporation Raptor Lake PCH CNVi WiFi [8086:51f1]

And -s narrows the output to one slot, combined with -v or -vv for details like memory ranges, capabilities, and the current link speed of the slot:

Terminal
sudo lspci -vv -s 01:00.0

Getting a Full Inventory with lshw

Where lsusb and lspci each cover one bus, lshw walks everything the kernel knows: CPU, memory, firmware, disks, controllers, and the buses in between. Run it as root or the output will be incomplete. The full report is pages long, so start with the summary table:

Terminal
sudo lshw -short

output

H/W path Device Class Description
===========================================================
system ThinkPad T14 Gen 4
/0/0 memory 64KiB BIOS
/0/4 processor 13th Gen Intel Core i7-1355U
/0/13 memory 32GiB System Memory
/0/13/0 memory 16GiB SODIMM DDR5 5600 MHz
/0/13/1 memory 16GiB SODIMM DDR5 5600 MHz
/0/100/2 display Raptor Lake-P [Iris Xe Graphics]
/0/100/14.3 wlp0s20f3 network Raptor Lake PCH CNVi WiFi
/0/100/1d/0 /dev/nvme0 storage SAMSUNG MZVL21T0HCLR-00B00

This one screen answers most inventory questions: what model the machine is, which memory modules lshw detected, and what storage and network hardware is present. The two 16 GiB entries show how the detected memory is populated, but they do not confirm whether the machine has another empty slot. Check the vendor’s service manual before planning an upgrade.

To dig into one category, filter by class:

Terminal
sudo lshw -C memory
sudo lshw -C network

The class view for memory may include per-slot details such as speed and part numbers when the system firmware exposes them. For reports, lshw exports machine-readable and browsable formats:

Terminal
sudo lshw -json > hardware.json
sudo lshw -sanitize -html > hardware.html

The JSON output preserves detailed fields for local inventory tooling. Use the sanitized HTML file when sharing a report because -sanitize removes potentially sensitive values such as serial numbers and IP addresses.

For completeness: CPU details have their own dedicated tools, covered in our guide on getting CPU information on Linux , and sudo dmidecode reads the firmware’s DMI tables directly when you need BIOS versions or serial numbers that lshw summarizes.

Quick Reference

Task	Command
List USB devices	`lsusb`
USB tree with drivers and speeds	`lsusb -t`
Full descriptors for one USB device	`sudo lsusb -v -d 046d:c52b`
List PCI devices	`lspci`
PCI devices with kernel drivers	`lspci -k`
PCI devices with numeric IDs	`lspci -nn`
Details for one PCI slot	`sudo lspci -vv -s 01:00.0`
Hardware summary table	`sudo lshw -short`
One hardware class in detail	`sudo lshw -C network`
Machine-readable inventory	`sudo lshw -json`
Sanitized HTML report	`sudo lshw -sanitize -html`

Conclusion

lsusb confirms detection, lspci -k connects chips to drivers, and lshw turns a closed case into a readable inventory; between the three, “what hardware is this and is it working” stops requiring a screwdriver. When a device shows up in these listings but misbehaves, the kernel log usually explains why, so dmesg is the natural next stop.

How to Comment Out Multiple Lines in Vim

hello@linuxize.com (Linuxize) — Mon, 20 Jul 2026 11:20:00 +0200

Commenting out a block of lines is one of those edits you make constantly: disabling a section of a config file, switching off a function while debugging, or keeping an old approach around while testing a new one. In most editors that is select plus a single shortcut. Classic Vim has no comment shortcut out of the box, but it has three techniques that are just as fast once you know them, and recent versions ship a toggle plugin as well.

This guide shows how to comment out multiple lines in Vim with visual block mode, the substitute command, and the built-in comment plugin, and how to remove the comments again with each method.

Commenting with Visual Block Mode

The classic answer uses visual block mode to insert a comment character at the start of every selected line:

Move the cursor to the first column of the first line you want to comment.
Press Ctrl+V to enter visual block mode.
Press j (or the down arrow) until every target line is selected.
Press Shift+I to insert at the left edge of the block.
Type the comment character, # for shell scripts and config files.
Press Esc.

On Windows, Ctrl+V may be mapped to paste. If it does not start visual block mode, use Ctrl+Q instead.

The # appears on the first line while you type, which looks like the operation failed. It did not: the moment you press Esc, Vim repeats the insert on every line of the block.

For languages with two-character comments, type the whole prefix in step 5, for example // for C, JavaScript, and Go, or -- for SQL and Lua. The entire string is inserted on each line.

Because this selection starts in the first column, I prefixes every selected line, including empty lines. If you start the block farther to the right, Vim skips lines that end before the block’s left edge. Use the substitute method below when you want to prefix a line range regardless of line length.

Uncommenting with Visual Block Mode

The reverse uses the same block selection to delete a column of characters:

Place the cursor on the first comment character of the first line.
Press Ctrl+V, then j down to the last commented line.
If the comment prefix is longer than one character, press l once for each additional character to widen the block over the whole prefix.
Press x or d to delete the selected block on every line.

The highlighted column disappears from all lines at once. If you also inserted a space after the comment character, include it in the block before deleting.

Commenting with the Substitute Command

The substitute command edits a range of lines in one pass, which makes it the better tool when you already know the line numbers or when the block is large. To comment lines 10 through 20:

:10,20s/^/#/

The range 10,20 limits the substitution to those lines, ^ matches the empty start of each line, and the replacement inserts # there. Unlike block insert, this prefixes every line in the range, including blank ones.

You can also select the lines first with V and a movement, then press :. Vim inserts the '<,'> range for you, and you complete the command:

:'<,'>s/^/#/

Other ranges work the same way: % for the whole file and .,+4 for the current line and the four below it. If you use these often, turning on line numbers makes ranges much quicker to read off the screen; see How to Show Line Numbers in Vim .

To uncomment, delete the leading character instead of inserting it:

:10,20s/^#//

This removes the first # of each line in the range and leaves lines without one untouched. For a two-character prefix such as //, escaping the slashes gets noisy, so switch the delimiter to another punctuation character:

:'<,'>s#^//##

The substitute command accepts almost any punctuation as its separator, and using # here keeps the // readable. The full syntax, including flags and confirmation mode, is covered in Vim Find and Replace .

Keeping Indentation with :normal

Both methods above put the comment character in column one. To insert it in front of the first non-blank character instead, preserving the code’s indentation profile, run a normal mode command over the range:

:'<,'>norm I#

The :norm command replays its argument as keystrokes on every line in the range, and I in normal mode enters insert mode at the first non-blank character, so each line gets # right before its content rather than at the margin. Undo treats the whole operation as a single change, so u reverts every line at once.

Toggling Comments with gc

Modern Vim and Neovim can toggle comments with a mapping that knows each filetype’s comment syntax. Neovim 0.10 and later has it built in with no setup: select lines with V and press gc, or use gcc for the current line and gc followed by a motion, such as gcip for a paragraph. Pressing gc on commented lines uncomments them.

Vim 9.1.0375 and later bundles a similar optional comment package. Enable it for the current session with :packadd comment, or add this line to your vimrc to load it on startup:

~/.vimrcvim
packadd comment

After loading the package, the gc mappings work as described above and pick the right comment string automatically: # in a shell script, // in C, and " in a vimrc. On older Vim versions, the widely used commentary.vim plugin provides the same familiar mappings.

If you comment code many times a day, this is the method worth adopting, since toggling with gc replaces both the comment and uncomment workflows in one mapping.

Quick Reference

For a printable quick reference, see the Vim cheatsheet .

Action	Keys or command
Comment a block	`Ctrl+V`, select lines, `Shift+I`, type `#`, `Esc`
Uncomment a block	`Ctrl+V`, select the comment column, `x`
Comment lines 10-20	`:10,20s/^/#/`
Comment a visual selection	`:'<,'>s/^/#/`
Uncomment lines 10-20	`:10,20s/^#//`
Comment after indentation	`:'<,'>norm I#`
Toggle comments (Neovim 0.10+, Vim 9.1.0375+)	select with `V`, press `gc`
Toggle the current line	`gcc`
Undo the whole operation	`u`

Conclusion

For an occasional block, Ctrl+V, Shift+I, Esc is the fastest habit to build, and :s/^/#/ handles precise ranges and blank lines. If commenting is part of your daily editing, enable the gc mappings and get toggling in both directions. For selecting larger regions to operate on, see How to Select All in Vim .

What Is an Inode in Linux

hello@linuxize.com (Linuxize) — Sun, 19 Jul 2026 09:35:00 +0200

Running out of disk space normally means that a filesystem has no free bytes left. Sometimes, however, a command fails with “No space left on device” while df -h still shows available space. One possible cause is inode exhaustion: the filesystem can store more data, but it has no free metadata records for new files.

To understand why this happens, and why filenames and file contents are stored separately, you need to know what an inode is. This guide explains what an inode stores, how it relates to filenames and hard links, and how to check inode usage.

What an Inode Is

An inode (short for “index node”) is a data structure that a Unix-style filesystem uses to store metadata about a file or directory. Each file has an inode number that identifies it within that filesystem. The same number can appear on another filesystem, so an inode number is not unique across the entire system.

The inode holds almost everything the system needs to know about the file, except for its name and, in the usual case, the data itself. It records:

The file type, such as a regular file, directory, or symbolic link
The permissions and owner and group IDs
The file size and allocated blocks
The access, data modification, and status change timestamps
The hard-link count, which is the number of directory entries pointing to the file
The block map or extents that locate the file’s data

The exact on-disk format depends on the filesystem, but these fields are the ones you see through tools such as ls and stat.

Filenames Are Separate from Inodes

The detail that surprises many users is that the filename is not stored in the inode. A directory contains entries that map names to inode numbers. When you open report.txt, the system looks up that name in the directory, finds the inode number, reads the inode, and locates the file’s data.

This separation is what makes hard links possible. A hard link is another directory entry that points to the same inode. Both names are equal, and removing one name only decreases the inode’s link count. The filesystem releases the file’s storage after the last link is removed and no process still has the file open.

For a practical comparison of the two link types, see hard links vs symbolic links .

Viewing Inode Numbers

To see the inode number of a file, use the -i option with ls:

Terminal
ls -i report.txt

output

1310720 report.txt

The first column, 1310720, is the inode number. To list inode numbers for everything in a directory, run ls -li, which adds the inode number as the leftmost column of the long listing.

To display the metadata associated with the inode, use the stat command:

Terminal
stat report.txt

output

 File: report.txt
Size: 482 Blocks: 8 IO Block: 4096 regular file
Device: 8,1 Inode: 1310720 Links: 1
Access: (0644/-rw-r--r--) Uid: ( 1000/ linuxize) Gid: ( 1000/ linuxize)
Access: 2026-01-01 14:02:11.000000000 +0100
Modify: 2026-01-01 13:55:40.000000000 +0100
Change: 2026-01-01 13:55:40.000000000 +0100
Birth: 2026-01-01 13:55:40.000000000 +0100

The Inode field shows the inode number, and Links shows the hard-link count. Change is the status change time, commonly called ctime. It changes when inode metadata such as permissions, ownership, or the link count changes. It is not the file creation time. The separate Birth field shows creation time when the filesystem supports it.

The filename appears at the top because you passed it to stat; it is not part of the inode.

How Filesystems Allocate Inodes

Inode allocation depends on the filesystem. Ext2, ext3, and ext4 create inode tables when the filesystem is formatted. This gives the filesystem a fixed inode density, so a workload that creates millions of small files can use every inode before it uses every data block.

You cannot change the inode density of an existing ext4 filesystem in place. Growing the filesystem can add block groups and more inodes, but if the filesystem cannot be expanded, the practical options are to remove unneeded files, move the workload, or recreate the filesystem with a higher inode count.

XFS and Btrfs allocate inodes dynamically from available filesystem space instead of creating one fixed inode table at format time. They can still reject new files when the filesystem runs out of usable data or metadata space, but they do not have the same fixed inode-count limit as ext4.

Checking Inode Usage

To see how many inodes the filesystem containing /var has and how many are free, pass the path to df with the -i option:

Terminal
df -i /var

output

Filesystem Inodes IUsed IFree IUse% Mounted on
/dev/sdb1 655360 655360 0 100% /var

The IUse% column is the one to watch. Here, inode usage on /var is at 100 percent even though the byte-based df -h /var might still report free space. The filesystem cannot create another file until an inode becomes available.

A large cache, session directory, mail queue, or temporary directory is a common source of inode exhaustion. GNU du can count inodes instead of bytes. The following command stays on the /var filesystem, checks two directory levels, and displays the largest totals at the bottom:

Terminal
sudo du --inodes -x -d 2 /var 2>/dev/null |
 sort -n |
 tail -20

Repeat the command on the directory with the highest count and increase the depth if needed. For other counting methods, see the guide on counting files in a directory .

Warning

Do not remove files only because a directory has a high inode count. First identify which application owns the files and use its cleanup or retention policy when one is available.

After cleanup, run df -i /var again to confirm that free inodes are available.

Conclusion

An inode connects a file’s metadata to its stored data while the directory keeps the filename separately. When a filesystem reports “No space left on device” despite having free bytes, check the affected path with df -i before deciding what to remove.

How to Select All in Vim: Copy, Delete, or Yank Every Line

hello@linuxize.com (Linuxize) — Sat, 18 Jul 2026 09:15:00 +0200

Sooner or later you will need to grab the entire contents of a file open in Vim, whether to paste a config file into a support ticket, move a script into another editor, or wipe everything and start over. In most editors that is Ctrl+A followed by Ctrl+C. Vim does not work that way, and pressing Ctrl+A increments the next number at or after the cursor instead of selecting text.

The quickest way to select all text in Vim is the ggVG command sequence in normal mode. This guide explains how it works and how to copy, delete, or run other commands on every line in the file, including copying the whole file to the system clipboard.

Selecting All Text with ggVG

To select all text in Vim, make sure you are in normal mode (press Esc if you are not), then type ggVG. The sequence is three separate commands executed one after another:

gg - Move the cursor to the first line of the file
V - Start line-wise visual mode
G - Jump to the last line, extending the selection over the whole file

Every line in the file is now highlighted. From here, Vim waits for an operator: press y to yank (copy) the selection, d to delete it, or any other visual mode command. To cancel the selection without doing anything, press Esc.

Copying (Yanking) All Lines

With the whole file selected, press y to yank it into Vim’s default register. The full sequence is ggVGy. You can then paste the text elsewhere in the same Vim session with p.

Visual mode is not required, though. If you already know you want to copy everything, the ex command :%y does the same thing without touching the selection:

:%y

The % range means “all lines”, so :%y yanks the entire file into the default register in one step. The normal mode equivalent is ggyG, which yanks from the first line to the last without entering visual mode.

To duplicate the whole file below itself, run :%y followed by G and p: yank all lines, jump to the end, and paste.

Copying All Lines to the System Clipboard

Yanked text normally stays inside Vim. To paste the file into a browser, email, or another application, copy it to the system clipboard using the "+ register:

ggVG"+y - Select all, then yank the selection to the system clipboard
gg"+yG - Yank all lines to the system clipboard without visual mode
:%y+ - Yank all lines to the system clipboard with an ex command

After any of these, paste into the other application with the regular paste shortcut for your desktop environment.

Info

The "+ register requires Vim compiled with the +clipboard feature. Check with vim --version | grep clipboard. If the output shows -clipboard, install a build with clipboard support, such as vim-gtk3 on Debian and Ubuntu systems.

If installing another Vim build is not an option, you can pipe the buffer to a clipboard utility instead. On X11 systems with xclip installed:

:%w !xclip -selection clipboard

This writes the whole buffer to the xclip command, which places it on the clipboard. On Wayland, use wl-copy from the wl-clipboard package the same way:

:%w !wl-copy

For more on registers and clipboard integration, see How to Copy, Cut and Paste in Vim .

Deleting All Lines

To select everything and delete it, use ggVGd, or skip visual mode with ggdG (move to the first line, then delete to the last line). The fastest option is again the ex command with the % range:

:%d

All lines are removed and the file is left with a single empty line. The deleted text lands in the default register, so an accidental :%d is easy to reverse: press u to undo , or paste the text back with p.

To delete every line without replacing the current contents of the unnamed register, send the deleted text to the black hole register:

:%d _

This preserves whatever was already available for pasting with p.

For ranges, patterns, and more deletion commands, see How to Delete Lines in Vim .

Running Other Commands on the Whole File

Selecting all text is not limited to copy and delete. With ggVG active, any visual mode operator applies to the entire file:

ggVG= - Re-indent every line (same as gg=G)
ggVGu - Convert the whole file to lowercase
ggVGU - Convert the whole file to uppercase
ggVG> - Shift every line one indent level to the right

For find and replace across the whole file, you do not need a selection at all: the substitute command takes the same % range, as in :%s/old/new/g. See Vim Find and Replace for the full syntax.

Quick Reference

For a printable quick reference, see the Vim cheatsheet .

Command	Description
`ggVG`	Select all lines
`ggVGy`	Select all and yank (copy)
`ggVGd`	Select all and delete
`ggVG"+y`	Select all and copy to the system clipboard
`ggyG`	Yank all lines without visual mode
`ggdG`	Delete all lines without visual mode
`:%y`	Yank all lines (ex command)
`:%y+`	Yank all lines to the system clipboard
`:%d`	Delete all lines
`:%d _`	Delete all lines without replacing the unnamed register
`gg=G`	Re-indent the whole file
`:%s/old/new/g`	Replace across the whole file
`u`	Undo the last change

Conclusion

Use ggVG when you want to see the whole-file selection before choosing an operator. When the action is already clear, the % range is shorter, as in :%y, :%d, or :%s/old/new/g. For selecting a smaller block to comment out, see How to Comment Out Multiple Lines in Vim .

Email Authentication Explained: SPF, DKIM, and DMARC

hello@linuxize.com (Linuxize) — Fri, 17 Jul 2026 18:20:00 +0200

When mail from your domain lands in spam or is rejected, authentication is one of the first things to check. Google and Yahoo require all senders to use at least SPF or DKIM, while bulk senders must use SPF, DKIM, and DMARC. These mechanisms associate mail with your domain, but they do not guarantee inbox placement on their own.

This guide explains what each mechanism does, how the three work together, what the records look like, and how to verify your setup from the command line.

Why Email Needs Authentication

SMTP, the protocol that moves mail between servers, was designed without sender verification. Any server can connect to any other server and claim to send mail from example.com; nothing in the protocol stops it. That is why spammers and phishers can forge the From address of any domain.

Authentication closes this gap with DNS and message signing. SPF tells a receiver whether the connecting server is authorized for the envelope sender domain. DKIM associates a cryptographic signature with a signing domain. DMARC checks whether a passing SPF or DKIM identity aligns with the domain in the visible From address, then publishes the domain owner’s handling preference for failures.

How the Three Work Together

Each mechanism covers a different part of the delivery:

SPF publishes which servers may send mail for your domain. Receivers check the connecting server’s IP against the list.
DKIM adds a cryptographic signature to each message. Receivers verify it against a public key in DNS to confirm that the holder of the private key signed the message and that the signed content has not changed.
DMARC ties the result to the visible From address, publishes a handling preference for failures, and can request reports from participating receivers.

Using all three gives you better spoofing protection and diagnostic data even when your sending volume is below provider bulk-sender thresholds.

SPF: Authorizing Sending Servers

SPF (Sender Policy Framework) is a TXT record on the domain itself listing authorized senders:

txt
example.com. 3600 IN TXT "v=spf1 mx ip4:203.0.113.10 include:_spf.google.com -all"

Reading the record left to right: v=spf1 identifies it as SPF, mx authorizes the servers named in the domain’s MX records, ip4:203.0.113.10 authorizes a specific address, and include:_spf.google.com pulls in another domain’s SPF list, which is how you authorize a provider such as Google Workspace to send for you.

The final mechanism sets the SPF result for everything not listed:

-all - Returns fail, a clear statement that unlisted servers are not authorized.
~all - Returns softfail, a weaker statement that the server is probably not authorized.
+all - Returns pass for every server, which defeats the purpose of SPF.

The receiving system decides how each result affects delivery. SPF itself does not require a specific action for fail or softfail.

Two rules prevent many common SPF errors. A domain must have exactly one SPF record because multiple records produce permerror. Evaluation can use at most 10 DNS-querying terms, including include, mx, and a; chained provider records can consume that limit quickly.

SPF also has a blind spot: it checks the envelope sender used during the SMTP transaction, not the From header the user sees. Ordinary forwarding often causes SPF to fail because the forwarder’s IP is not in the original sender’s record, unless the forwarder rewrites the envelope sender with Sender Rewriting Scheme (SRS). That is where DKIM helps.

DKIM: Signing Messages

DKIM (DomainKeys Identified Mail) uses public-key cryptography. Your mail server signs each outgoing message with a private key, adding a DKIM-Signature header. Receivers fetch the matching public key from DNS and verify the signature. A valid result shows that the holder of the private key signed the message and that the signed headers and body have not changed. It does not show that the message content is trustworthy.

The public key lives in a TXT record under a selector name, which allows multiple keys per domain:

txt
default._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

Here default is the selector; the signing server puts the selector name in each signature header so receivers know which key to fetch. The p= value is the base64-encoded public key, typically 2048-bit RSA.

Unlike SPF, DKIM requires software on the mail server to do the signing. On a self-hosted Postfix setup this is usually handled by a milter such as OpenDKIM or by Rspamd , which generates the key pair and signs outgoing mail. Hosted providers generate the keys for you and tell you which records to publish.

DKIM generally survives simple forwarding because the signature travels with the message. A forwarding service, mailing list, or security gateway that changes a signed header or the message body can invalidate it.

DMARC: Policy and Reporting

SPF and DKIM authenticate domains that are not necessarily the one shown in the From address. DMARC (Domain-Based Message Authentication, Reporting, and Conformance) adds that connection and publishes a handling preference in a TXT record at _dmarc:

txt
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The p= tag describes how the domain owner views mail that fails DMARC:

p=none - Expresses no DMARC-based handling preference and is the normal starting point for monitoring.
p=quarantine - Says the domain owner considers failing mail suspicious. A receiver may place it in spam or apply other scrutiny.
p=reject - Says the domain owner considers the failed use of the domain invalid.

These values are preferences, not commands. A receiving system can use other signals when deciding whether to accept, quarantine, or reject a message. The current DMARC standard specifically says that receivers must not reject mail solely because the sender publishes p=reject.

A message passes DMARC when at least one of SPF or DKIM passes and aligns. With the default relaxed alignment, the authenticated domain and the From domain must share the same organizational domain, so bounce.example.com can align with example.com. Strict alignment, enabled with aspf=s or adkim=s, requires identical domains.

Alignment is the part that blocks a common spoofing technique. An attacker can pass SPF for a domain they control while displaying your domain in the From header, but the result does not align and DMARC fails.

The rua= tag requests aggregate XML reports from participating receivers, commonly sent daily. Reports show which systems use your domain and how their messages authenticate. Start with p=none, identify legitimate services such as CRMs and monitoring tools, and fix their SPF or DKIM before considering enforcement. A report-processing service or self-hosted analyzer is easier to use than reading the raw XML. Do not treat p=reject as an automatic endpoint, especially for domains whose users send through mailing lists or forwarding services.

Checking Your Records with dig

All three mechanisms use DNS TXT records, although DKIM also requires a working signer. You can verify what the world sees with dig. Check SPF on the domain itself:

Terminal
dig +short example.com TXT

output

"v=spf1 mx ip4:203.0.113.10 include:_spf.google.com -all"

The answer may include unrelated TXT records. Confirm that exactly one returned string begins with v=spf1.

DKIM requires knowing the selector; check the record your signer uses:

Terminal
dig +short default._domainkey.example.com TXT

output

"v=DKIM1; k=rsa; " "p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."

DNS can split a long public key into adjacent quoted strings. They form one TXT record when concatenated.

And DMARC always lives at the _dmarc subdomain:

Terminal
dig +short _dmarc.example.com TXT

output

"v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

If a record is missing from the output, receivers cannot see it either. For more query options, see our dig command guide . For an end-to-end test, send a message to a Gmail address and use “Show original”, which displays PASS or FAIL for SPF, DKIM, and DMARC on the received message.

Troubleshooting

A new TXT record does not appear
Check that you used the correct DNS host name: @ or the bare domain for SPF, <selector>._domainkey for DKIM, and _dmarc for DMARC. DNS caches may continue returning the previous answer until the record’s TTL expires.

SPF returns permerror
Look for multiple TXT records beginning with v=spf1 and merge them into one. If there is only one record, count its DNS-querying terms and the terms inside every include; exceeding the 10-lookup limit also causes permerror.

SPF or DKIM passes but DMARC fails
The passing identity is probably not aligned with the visible From domain. Inspect the Authentication-Results header for the SPF envelope domain and the DKIM d= signing domain. Configure a custom return path or DKIM signing domain under your own organizational domain.

DKIM reports a body hash mismatch
Something changed the body after it was signed, often a mailing list footer, security gateway, or forwarding service. Compare a directly delivered message with the modified path, and make sure the published selector and key match the active signer.

Quick Reference

Mechanism	What the receiver checks	DNS record location	Example value
SPF	Connecting IP against the envelope sender policy	TXT at `example.com`	`v=spf1 mx -all`
DKIM	Signature against the selector’s public key	TXT at `<selector>._domainkey.example.com`	`v=DKIM1; k=rsa; p=<key>`
DMARC	SPF or DKIM alignment with the visible From domain	TXT at `_dmarc.example.com`	`v=DMARC1; p=none; rua=mailto:...`

Conclusion

SPF authorizes sending infrastructure, DKIM associates a valid signature with a domain, and DMARC checks alignment with the visible From address. If you run your own stack, our guides on setting up Postfix and Dovecot and integrating Rspamd cover the server-side configuration, including DKIM signing.

sha256sum Cheatsheet

hello@linuxize.com (Linuxize) — Thu, 16 Jul 2026 08:40:00 +0200

Generate Checksums

Print a digest for one or more files.

Command	Description
`sha256sum file.iso`	Print the SHA-256 digest of a file
`sha256sum file1 file2`	One digest line per file
`sha256sum *.tar.gz > SHA256SUMS`	Save digests to a checksum file
`printf '%s' "text" \| sha256sum`	Hash a string from stdin
`find dir/ -type f -exec sha256sum {} +`	Hash every file in a directory tree

Verify Checksums

Check files against a checksum list with -c.

Command	Description
`sha256sum -c SHA256SUMS`	Verify every file in the list
`sha256sum -c --ignore-missing SHA256SUMS`	Verify only the files that are present
`grep file.iso SHA256SUMS \| sha256sum -c -`	Verify a single file from a larger list
`echo "DIGEST file.iso" \| sha256sum -c -`	Compare against a pasted digest (two spaces)
`sha256sum -c --quiet SHA256SUMS`	Print failures only, skip `OK` lines

Useful Options

Flags shared by sha256sum, md5sum, and the other GNU hash tools.

Option	Description
`-c`, `--check`	Read digests from a file and verify them
`--quiet`	Do not print `OK` for verified files
`--status`	Print nothing; report via exit status only
`--warn`	Warn about improperly formatted lines
`--strict`	Exit non-zero when a line is badly formatted
`--ignore-missing`	Skip listed files that do not exist
`--tag`	BSD-style output, `SHA256 (file) = digest`
`-b`, `--binary`	Mark files with `*` in the output
`-z`, `--zero`	End output lines with NUL instead of newline

Scripting and Exit Codes

Automate checks in scripts and CI jobs.

Command	Description
`sha256sum -c --status SHA256SUMS && echo ok`	Branch on the verification result
`sha256sum -c SHA256SUMS \|\| exit 1`	Abort a script on any mismatch
`[ "$(sha256sum < f)" = "$(sha256sum < g)" ]`	Compare two files by digest
`sha256sum file \| cut -d' ' -f1`	Extract the bare digest value

Other Hash Commands

Same interface, different algorithms.

Command	Description
`md5sum file`	128-bit MD5; corruption checks only, not security
`sha1sum file`	160-bit SHA-1; legacy, avoid for new uses
`sha512sum file`	512-bit SHA-2 digest
`b2sum file`	BLAKE2; fast modern alternative
`cksum -a sha256 file`	Unified hash tool in newer coreutils

Troubleshooting

Quick checks for common verification problems.

Issue	Check
Digest mismatch on a download	Re-download, ideally from a different mirror
`no properly formatted checksum lines found`	Fix CRLF endings with `dos2unix`, check the file format
`No such file or directory` with `-c`	Run from the directory that holds the listed files
Every other release fails as missing	Add `--ignore-missing` to scope the check
Digest source is untrusted	Verify the GPG signature on the checksum file itself

Full walkthroughs for checksums and signing.

Guide	Description
Verify a Checksum in Linux	Full `sha256sum` and `md5sum` tutorial
Encrypt and Decrypt Files with GPG	Work with GPG keys and signatures
wget Command Examples	Download files and checksum lists

What Is stdin, stdout, and stderr in Linux

hello@linuxize.com (Linuxize) — Thu, 16 Jul 2026 08:30:00 +0200

When a Linux command reads text you type, sends results to the terminal, or prints an error beside them, it is using a set of connections prepared before the program starts. These connections are standard input, standard output, and standard error, usually shortened to stdin, stdout, and stderr.

The shell can connect these streams to a terminal, file, pipe, or another destination without changing the program itself. This guide explains what the three standard streams do, why they use file descriptors 0, 1, and 2, and how shell redirection changes their destinations.

The Three Standard Streams

A process normally starts with three open file descriptors inherited from its parent. When you launch a command from an interactive shell, the shell usually connects all three to your current terminal:

Stream	File descriptor	Purpose	Interactive default
stdin	`0`	Input read by the program	Terminal input
stdout	`1`	Normal program output	Terminal display
stderr	`2`	Errors and diagnostic messages	Terminal display

Describing stdin as the keyboard is a useful shortcut, but the program actually reads from a terminal device. The terminal handles keyboard input and passes it to the program. In a script or pipeline, stdin may instead come from a file or another command.

The numbers matter because shell redirection syntax uses them. stdout and stderr both appear on the terminal by default, so they can look like one stream even though they remain separate. A script can save normal results in one file while sending errors somewhere else.

Seeing stdout and stderr Separately

The following commands print one normal message and one warning:

Terminal
printf '%s\n' "backup complete"
printf '%s\n' "warning: archive not found" >&2

output

backup complete
warning: archive not found

Both lines appear in the same terminal, but they traveled through different streams. The first printf writes to stdout. The >&2 redirection sends the second command’s output to stderr, which lets a script report a diagnostic without mixing it into data that another command may need to process.

Changing Stream Destinations

The shell sets up redirections before it starts the command. The program continues reading and writing the same file descriptors without needing to know whether they point to a terminal, file, or pipe.

The > operator sends stdout to a file, creating the file or replacing its contents:

Terminal
ls /etc > files.txt

Nothing appears on the terminal because the directory listing went to files.txt. Since > uses stdout when no descriptor is specified, > files.txt and 1> files.txt have the same effect.

stderr remains connected to the terminal unless you redirect descriptor 2. This command requests one existing path and one missing path:

Terminal
ls /etc /nonexistent > files.txt

output

ls: cannot access '/nonexistent': No such file or directory

The successful listing went into files.txt, while the error stayed visible because it traveled through stderr. Redirect descriptor 2 to capture it separately:

Terminal
ls /etc /nonexistent > files.txt 2> errors.txt

Now normal results are in files.txt and the diagnostic is in errors.txt.

To save both streams in one file using portable shell syntax, redirect stdout first and then duplicate its destination for stderr:

Terminal
command > output.log 2>&1

The 2>&1 expression makes file descriptor 2 point to the current destination of file descriptor 1. Redirections are processed from left to right, so reversing their order produces a different result. See how to redirect stderr to stdout in Bash for combining, appending, piping, and discarding output.

Input redirection works in the other direction. The < operator connects a file to stdin:

Terminal
sort < names.txt

Here sort reads from names.txt instead of the terminal. Many commands also accept a filename as an argument, but input redirection works for any command designed to read from stdin.

How Pipes Use the Streams

A pipe (|) connects the stdout of one command to the stdin of the next, so data can move between programs without a temporary file:

Terminal
ls /etc | grep conf

The stdout of ls becomes the stdin of grep. A regular pipe carries stdout, not stderr, so an error from ls still appears on the terminal instead of passing to grep. The Linux pipes guide covers longer pipelines, error handling, and pipefail. To show output on the terminal while also saving it, use the tee command .

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Descriptor or syntax	Effect
`0`	stdin
`1`	stdout
`2`	stderr
`command < file`	Read stdin from `file`
`command > file`	Write stdout to `file`, replacing its contents
`command >> file`	Append stdout to `file`
`command 2> file`	Write stderr to `file`
`command > file 2>&1`	Write stdout and stderr to the same file
`command 2>/dev/null`	Discard stderr
`cmd1 \| cmd2`	Connect stdout from `cmd1` to stdin for `cmd2`

Conclusion

When a command sends data somewhere unexpected, identify whether it is using file descriptor 0, 1, or 2, then read its redirections from left to right. That habit makes shell pipelines and logging commands much easier to follow.

How to Configure Networking with Netplan on Ubuntu

hello@linuxize.com (Linuxize) — Wed, 15 Jul 2026 10:30:00 +0200

Since Ubuntu 17.10, networking is configured with Netplan rather than the old /etc/network/interfaces file. You write a short YAML description of how each interface should behave, and Netplan translates it into configuration for the back end that actually manages the network. This keeps the configuration in one place and makes it easy to read, but the YAML syntax trips up people who are used to the older format.

This guide explains how Netplan works and how to configure DHCP, static addresses, DNS, Wi-Fi, and bridges, then how to apply the changes without locking yourself out of a remote server.

Quick Reference

Task	Command
List Netplan files	`ls /etc/netplan/`
Show interface names	`ip link`
Show the merged configuration	`sudo netplan get`
Check configuration for errors	`sudo netplan generate`
Apply changes with rollback	`sudo netplan try`
Apply changes directly	`sudo netplan apply`
Show current network state	`sudo netplan status`

How Netplan Works

Administrators store Netplan YAML files in /etc/netplan. Netplan reads those files and generates configuration for one of two back ends, called renderers:

systemd-networkd - The usual renderer on Ubuntu Server. It runs without a graphical environment and suits headless machines.
NetworkManager - The usual renderer on Ubuntu Desktop. It handles Wi-Fi, VPNs, and interface switching, and integrates with the GNOME settings panel.

When you run netplan apply, Netplan parses the YAML, writes back-end configuration, and tells the renderer to reload it. Syntax errors stop this process, but a valid configuration with the wrong address or route can still interrupt the connection.

List the files Netplan currently reads:

Terminal
ls /etc/netplan/

output

50-cloud-init.yaml

The exact name depends on how the system was installed. Common names include 00-installer-config.yaml, 01-netcfg.yaml, and 50-cloud-init.yaml. Files are read in alphanumeric order, and later files override earlier ones, so a 90-custom.yaml takes precedence over 50-cloud-init.yaml.

The examples below use /etc/netplan/99-custom.yaml, which loads after the common installer and cloud-init filenames. Create the file with a text editor, or edit an existing file instead if you already manage it directly:

Terminal
sudo nano /etc/netplan/99-custom.yaml

Netplan configuration files should be readable and writable only by root. After saving the file, set the required permissions before applying changes:

Terminal
sudo chmod 600 /etc/netplan/*.yaml

The Structure of a Netplan File

Every Netplan file starts with a top-level network key. Under it, you can set the configuration version, choose a renderer, and list interfaces by type, such as ethernets, wifis, bridges, or vlans. Netplan defaults to version 2 and the networkd renderer when these keys are omitted, but keeping them explicit makes the file easier to understand:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: true

Version 2 is the only supported Netplan YAML format. The renderer chooses the back end, and the interface name (ens3 here) must match a real interface on the system. Find the interface names with the ip link command:

Terminal
ip link

YAML is sensitive to indentation, so use spaces, never tabs, and keep nested keys aligned. A single misaligned line is the most common reason a configuration does not apply.

Configuring DHCP

The example above already enables DHCP for IPv4 with dhcp4: true. To also enable DHCP for IPv6, add dhcp6:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: true
 dhcp6: true

This is the default configuration on most fresh installs, where the router assigns the address automatically.

Configuring a Static IP Address

To assign a fixed address, disable DHCP and set the address, gateway, and nameservers manually:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: false
 addresses:
 - 192.168.1.50/24
 routes:
 - to: default
 via: 192.168.1.1
 nameservers:
 addresses:
 - 8.8.8.8
 - 1.1.1.1

The address uses CIDR notation, so /24 is the equivalent of the 255.255.255.0 netmask. The routes block replaces the deprecated gateway4 key that older guides still use. You can assign more than one address to an interface by adding extra lines under addresses. For a focused walkthrough of static addressing on both Server and Desktop, see the dedicated guide on setting a static IP address on Ubuntu .

Configuring Wi-Fi

On a desktop or laptop, Netplan can connect to a wireless network through the wifis section. Ubuntu Desktop usually uses the NetworkManager renderer:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: NetworkManager
 wifis:
 wlp2s0:
 dhcp4: true
 access-points:
 "MyNetwork":
 password: "your-wifi-password"

Replace wlp2s0 with your wireless interface name, MyNetwork with the network SSID, and the password with your own.

Warning

The Wi-Fi password is stored in plain text inside the Netplan file. Keep the file permissions set to 600, and never commit Netplan files containing credentials to version control.

Creating a Network Bridge

A bridge joins several interfaces into one logical network, which is useful when you run virtual machines or containers that need direct access to the physical network. The example below creates a bridge named br0 that takes its address from DHCP and includes the physical interface ens3:

/etc/netplan/99-custom.yamlyaml
network:
 version: 2
 renderer: networkd
 ethernets:
 ens3:
 dhcp4: false
 bridges:
 br0:
 interfaces:
 - ens3
 dhcp4: true

Notice that the physical interface has DHCP disabled, because the bridge now owns the address rather than the interface itself.

Applying the Configuration

After editing a file, you can check it for syntax errors before doing anything to the live network. The generate command builds the back-end configuration and reports any problems:

Terminal
sudo netplan generate

When you connect over SSH, never run netplan apply blindly, because a broken configuration can drop your connection. Use netplan try instead, which applies the configuration temporarily and rolls back automatically if you do not confirm it within the timeout:

Terminal
sudo netplan try

If the connection holds and the configuration is correct, confirm it at the prompt. Confirmation makes the tested configuration permanent, so you do not need to run netplan apply afterward.

When you are working from a local console and want to apply the configuration directly, run:

Terminal
sudo netplan apply

On recent Ubuntu releases you can review the resulting state, including addresses, routes, and DNS, with the status command:

Terminal
sudo netplan status

Verify the assigned address directly with ip addr :

Terminal
ip addr show dev ens3

Troubleshooting

Changes do not take effect after netplan apply
Run sudo netplan generate and fix any YAML error it reports. If the file is valid, confirm that the interface name matches ip link, then run sudo netplan get to check whether a later file overrides your settings.

The configuration warns that gateway4 is deprecated
Replace the gateway4 line with a routes block that uses to: default and via: gateway_ip.

Wi-Fi does not connect
Make sure the renderer is set to NetworkManager, the SSID is quoted exactly, and the interface name matches the output of ip link.

The static address reverts after a reboot on a cloud instance
Cloud images often regenerate Netplan files with cloud-init. Disable that by creating /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the content network: {config: disabled}, then reboot.

Conclusion

Netplan centralizes Ubuntu networking in a few readable YAML files, with systemd-networkd driving servers and NetworkManager driving desktops. When you edit these files over SSH, reach for sudo netplan try first so a mistake rolls back on its own instead of cutting off your access.

Docker Compose Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 15 Jul 2026 09:40:00 +0200

Start & Stop

Bring services up and take them down.

Command	Description
`docker compose up`	Create and start all services
`docker compose up -d`	Start in background (detached)
`docker compose up -d --build`	Rebuild images before starting
`docker compose up -d service`	Start one service and its dependencies
`docker compose up --wait`	Detach and wait until services are running or healthy
`docker compose stop`	Stop services without removing them
`docker compose start`	Start stopped services
`docker compose restart`	Restart all services
`docker compose down`	Stop and remove containers and networks
`docker compose down -v`	Also remove project-owned named and anonymous volumes

Inspect & Logs

Check service status and output.

Command	Description
`docker compose ps`	List running project containers
`docker compose ps -a`	List all project containers, including stopped
`docker compose logs`	Show logs for all services
`docker compose logs -f service`	Follow logs for one service
`docker compose logs --tail 100 service`	Show last 100 log lines
`docker compose top`	Running processes per service
`docker compose events`	Stream container events
`docker compose port service 80`	Host port mapped to container port 80
`docker compose ls`	List running Compose projects

Exec & Run

Run commands inside service containers.

Command	Description
`docker compose exec service sh`	Open shell in a running service
`docker compose exec service command`	Run command in a running service
`docker compose exec -u root service sh`	Shell as a specific user
`docker compose run --rm service command`	Run a one-off container
`docker compose run --rm --no-deps service sh`	One-off without starting dependencies
`docker compose cp service:/path ./local`	Copy from a service container
`docker compose cp ./local service:/path`	Copy into a service container
`docker compose attach service`	Attach to a service’s output

Build & Images

Build, pull, and push service images.

Command	Description
`docker compose build`	Build all service images
`docker compose build service`	Build one service image
`docker compose build --no-cache`	Build without layer cache
`docker compose pull`	Pull service images
`docker compose push`	Push service images to a registry
`docker compose images`	List images used by services
`docker compose create`	Create containers without starting them
`docker compose watch`	Sync files and rebuild on changes

Compose File Basics

Core service directives in docker-compose.yml .

Directive	Description
`services:`	Top-level map of containers to run
`image: postgres:16`	Run an existing image
`build: .`	Build from a Dockerfile in a path
`command: ["npm", "run", "dev"]`	Override the image default command
`entrypoint: ["/entrypoint.sh"]`	Override the image entrypoint
`ports: ["8080:80"]`	Publish host port 8080 to container port 80
`volumes: ["db_data:/var/lib/postgresql/data"]`	Mount a named volume
`environment: ["DEBUG=1"]`	Set environment variables
`env_file: .env.local`	Load variables from a file
`container_name: myapp`	Fixed container name (prevents scaling)

Health & Startup Order

Control dependency order and restart behavior.

Directive	Description
`depends_on: [db]`	Start db before this service
`depends_on: {db: {condition: service_healthy}}`	Wait until db passes its health check
`healthcheck: {test: ["CMD", "pg_isready"]}`	Define a health probe
`interval`, `timeout`, `retries`, `start_period`	Health check timing fields
`restart: "no"`	Never restart (default)
`restart: always`	Always restart
`restart: on-failure`	Restart on non-zero exit
`restart: unless-stopped`	Restart unless manually stopped

Environment Variables

Pass configuration into services. Keep .env files out of version control; use Compose secrets for sensitive data.

Syntax	Description
`environment: ["API_KEY=${API_KEY}"]`	Interpolate from the shell or `.env`
`${VAR:-default}`	Use default when VAR is unset or empty
`${VAR:?message}`	Fail with message when VAR is unset or empty
`env_file: .env.local`	Load variables from a specific file
`.env`	Loaded automatically from the project directory
`docker compose --env-file .env.prod up -d`	Use an alternate env file
`docker compose config`	Render final config with variables resolved

Projects & Files

Compose looks for compose.yaml first; docker-compose.yml is still supported.

Syntax	Description
`docker compose -f compose.prod.yaml up -d`	Use a specific file
`docker compose -f base.yml -f override.yml up -d`	Merge files; later files can add, merge, or override values
`docker compose -p myproject up -d`	Set the project name
`COMPOSE_FILE=base.yml:override.yml`	Default files via environment variable
`COMPOSE_PROJECT_NAME=myproject`	Default project name
`docker compose config`	Validate and print the merged config
`docker compose config --services`	List service names
`docker compose version`	Show Compose version

Profiles & Scaling

Run optional services and multiple replicas.

Syntax	Description
`profiles: ["debug"]`	Assign a service to a profile
`docker compose --profile debug up -d`	Start with a profile enabled
`COMPOSE_PROFILES=debug,test`	Enable profiles via environment variable
`docker compose up -d --scale worker=3`	Run 3 replicas of a service
`docker compose up -d --no-deps service`	Start or update one service without its dependencies
`docker compose up -d --force-recreate`	Recreate containers even without changes

Cleanup

Remove what a project created.

Command	Description
`docker compose down`	Remove containers and networks
`docker compose down -v`	Also remove project-owned named and anonymous volumes
`docker compose down --rmi all`	Also remove images
`docker compose down --remove-orphans`	Remove containers for removed services
`docker compose rm`	Remove stopped service containers
`docker compose stop service`	Stop a single service

tree Command in Linux: Display Directory Structure

hello@linuxize.com (Linuxize) — Mon, 13 Jul 2026 08:40:00 +0200

The ls command shows the contents of one directory at a time. When you want to see how a whole project is laid out, running ls in every subdirectory gets old fast. The tree command solves this by listing a directory and everything below it as an indented tree, so you can take in the entire hierarchy at a glance.

This guide explains how to install tree and use it to display directory structures, limit depth, filter files, show sizes, and save the output to a file.

Installing tree

tree is a small utility that is not installed by default on most distributions, but it is available in the standard repositories.

On Ubuntu, Debian, and derivatives:

Terminal
sudo apt update
sudo apt install tree

On Fedora, RHEL, and derivatives:

Terminal
sudo dnf install tree

Once installed, verify the version:

Terminal
tree --version

Basic Usage

The general syntax of the tree command is as follows:

txt
tree [OPTIONS] [DIRECTORY]

When invoked without arguments, tree lists the current directory recursively. For example, running it inside a small Node.js project produces output like this:

Terminal
tree

output

.
├── package.json
├── README.md
└── src
├── app.js
└── utils
└── helpers.js
3 directories, 4 files

Each level of nesting is indented and connected with line-drawing characters, so helpers.js is clearly inside src/utils. The report line at the bottom counts everything in the listing, and since tree 2.1 that count includes the starting directory itself.

To list a different directory, pass its path as an argument:

Terminal
tree /etc/nginx

Limiting the Depth

On a large directory the default recursive listing can print thousands of lines. The -L option limits how many levels deep tree descends:

Terminal
tree -L 2 /var/log

With -L 2, tree shows the contents of /var/log and one level of subdirectories, then stops. This is usually the first option to reach for when a plain tree floods the terminal.

Showing Hidden Files

Like ls, tree skips hidden files by default. Use -a to include entries that start with a dot:

Terminal
tree -a

output

.
├── .env
├── .git
│ ├── config
│ └── HEAD
├── package.json
├── README.md
└── src
├── app.js
└── utils
└── helpers.js
4 directories, 7 files

Notice that .env and the .git directory now show up in the listing. Combining -a with -L 1 is a quick way to audit what actually lives in a directory, dotfiles included.

Listing Directories Only

When you only care about the folder structure and not the files, use -d:

Terminal
tree -d

output

.
└── src
└── utils
3 directories

The files are gone and only the directory skeleton remains, which is handy for documenting a project layout.

Displaying File Sizes

The -s option prints the size of each file in bytes. In practice you will almost always use -h instead, which prints the sizes in human-readable units:

Terminal
tree -h

output

[4.0K] .
├── [ 412] package.json
├── [1.2K] README.md
└── [4.0K] src
├── [3.4K] app.js
└── [4.0K] utils
└── [ 890] helpers.js
3 directories, 4 files

The size shown next to a directory is the size of the directory entry itself, not its contents. To get cumulative directory sizes, add --du:

Terminal
tree --du -h

With --du, each directory reports the total size of everything inside it, similar to the du command . This option reads the full hierarchy before printing, so it can take time and consume extra memory on a large directory tree.

Filtering by Pattern

The -P option lists only files that match a wildcard pattern. Quote the pattern so the shell does not expand it first:

Terminal
tree -P "*.js"

Directories are still shown even when they contain no matching files. Add --prune to remove the empty branches:

Terminal
tree -P "*.js" --prune

output

.
└── src
├── app.js
└── utils
└── helpers.js
3 directories, 2 files

Only the JavaScript files and the directories that lead to them remain. The patterns follow the same rules as shell globs; see our guide to Linux wildcards and globbing for the full syntax.

The -I option does the opposite and excludes matching entries. Multiple patterns are separated with |:

Terminal
tree -I "node_modules|.git"

This is the most common tree invocation in day-to-day work, since it hides the noise of dependency and VCS directories. In tree 2.0 and later you can also pass --gitignore to skip everything that the project’s .gitignore files exclude.

Printing Full Paths

By default each entry shows only its own name. The -f option prints the full path prefix instead:

Terminal
tree -f src

output

src
├── src/app.js
└── src/utils
└── src/utils/helpers.js
2 directories, 2 files

Full paths are useful in saved listings because each entry keeps its context even when you view the output away from the original directory.

Sorting the Output

Entries are sorted alphabetically by default. The most useful alternatives are:

-t - Sort by last modification time, oldest first.
-r - Reverse the current sort order.
-v - Sort version strings naturally, so file2 comes before file10.
--sort=size - Sort by file size.

Note that -t places the oldest entries first, which is the opposite of what ls -t does. To see the most recently modified files at the top of each directory, combine it with -r:

Terminal
tree -t -r

Saving the Output to a File

The -o option writes the tree to a file instead of the terminal:

Terminal
tree -o structure.txt

The line-drawing characters are UTF-8 by default. If the file is destined for an environment that cannot render them, force plain ASCII connectors:

Terminal
tree --charset=ascii -o structure.txt

tree can also emit structured formats directly: -J produces JSON, -X produces XML, and -H <baseHref> produces a browsable HTML listing:

Terminal
tree -J -L 2 > structure.json

Quick Reference

Command	Description
`tree`	List the current directory recursively
`tree -L 2`	Limit the listing to two levels
`tree -a`	Include hidden files
`tree -d`	Directories only
`tree -h --du`	Human-readable cumulative sizes
`tree -P "*.js" --prune`	Only files matching a pattern
`tree -I "node_modules\|.git"`	Exclude matching entries
`tree -f`	Print full paths
`tree -o file.txt`	Write the output to a file
`tree -J`	Output JSON

Conclusion

The tree command turns a nested directory hierarchy into a single readable listing, and options such as -L, -I, and --du keep the output focused on what you actually need. If you want the same tree-style view for running processes instead of files, take a look at the pstree command .

How to Encrypt and Decrypt Files with GPG

hello@linuxize.com (Linuxize) — Sun, 12 Jul 2026 11:30:00 +0200

Sooner or later you end up with a file that should not sit around in plain text: a database dump with customer data, a document with credentials, or a backup you want to park on cloud storage you do not fully trust. Encrypting the file before it leaves your machine solves the problem, and GPG is the standard tool for the job on Linux.

GnuPG (GNU Privacy Guard), invoked as gpg, implements the OpenPGP standard. It supports two ways of encrypting a file: symmetric encryption, where a single passphrase both locks and unlocks the file, and public key encryption, where anyone can encrypt a file for you but only your private key can decrypt it.

This guide explains how to encrypt and decrypt files with gpg using both methods, how to exchange encrypted files with other people, and how to handle encryption in scripts.

Quick Reference

Task	Command
Encrypt with a passphrase	`gpg -c file`
Decrypt to a file	`gpg -o file -d file.gpg`
Generate a key pair	`gpg --full-generate-key`
List public keys	`gpg --list-keys`
Export your public key	`gpg --armor --export you@example.com > public.asc`
Import someone’s public key	`gpg --import public.asc`
Encrypt for a recipient	`gpg -e -r name@example.com file`
Sign and encrypt	`gpg -s -e -r name@example.com file`
Encrypt a directory	`tar czf - dir \| gpg -c -o dir.tar.gz.gpg`
Decrypt a directory	`gpg -d dir.tar.gz.gpg \| tar xzf -`

Installing GnuPG

GnuPG is preinstalled on nearly all Linux distributions because the package managers themselves depend on it. Verify that it is available:

Terminal
gpg --version

output

gpg (GnuPG) 2.4.4
libgcrypt 1.10.3

Your version numbers may differ, but any current GnuPG 2.x release supports the commands used in this guide.

If the command is missing, install the gnupg package with sudo apt install gnupg on Ubuntu, Debian, and Derivatives, or sudo dnf install gnupg2 on Fedora, RHEL, and Derivatives.

Encrypting a File with a Passphrase

Symmetric encryption is the simplest option: one passphrase encrypts the file, and the same passphrase decrypts it. There are no keys to generate or exchange, which makes it a good fit for encrypting your own backups or sending a file to someone you can share a passphrase with over a separate channel.

Use the -c (--symmetric) option:

Terminal
gpg -c database-backup.sql

gpg prompts for a passphrase, asks you to repeat it, and writes the encrypted result to database-backup.sql.gpg. The original file is left in place. Before removing it, decrypt the encrypted copy to a temporary file and compare the two files:

Terminal
gpg -o /tmp/database-backup.sql -d database-backup.sql.gpg
cmp database-backup.sql /tmp/database-backup.sql

The cmp command prints nothing when the files are identical. After a successful comparison, remove the temporary copy and the original plaintext file:

Terminal
rm /tmp/database-backup.sql
rm database-backup.sql

Pick a long passphrase. The encryption is only as strong as the passphrase protecting it, and a short or reused one undoes the benefit of encrypting at all.

By default the output is a binary file. If you need to paste the encrypted content into an email or a ticket, add -a (--armor) to produce ASCII text instead:

Terminal
gpg -c -a notes.txt

This writes notes.txt.asc, a plain text file that survives copy and paste. You can also choose the cipher explicitly with --cipher-algo AES256 if a policy requires a specific algorithm; run gpg --version to see which ciphers your build supports.

Decrypting a File

To decrypt, pass the encrypted file to gpg with -d (--decrypt) and use -o to name the output file:

Terminal
gpg -o database-backup.sql -d database-backup.sql.gpg

gpg asks for the passphrase and writes the decrypted file. Without -o, the -d option prints the decrypted content to standard output, which is useful when you only want to look at a small encrypted text file:

Terminal
gpg -d notes.txt.asc

If you decrypt the same file again a moment later, you may not be prompted for the passphrase. That is not a bug: gpg-agent caches passphrases for a few minutes. To clear the cache immediately, reload the agent:

Terminal
gpg-connect-agent reloadagent /bye

Generating a GPG Key Pair

Public key encryption removes the shared-passphrase problem. You publish your public key, anyone can use it to encrypt files for you, and only your private key can decrypt them. The private key never leaves your machine.

Generate a key pair with:

Terminal
gpg --full-generate-key

The command walks you through a few prompts: the key type (the default is fine), the expiration date, and your name and email address. Finally, it asks for a passphrase that protects the private key on disk. When the process finishes, list your keys to confirm:

Terminal
gpg --list-keys

output

pub ed25519 2026-01-01 [SC] [expires: 2029-01-01]
1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B
uid [ultimate] Alice Example <alice@example.com>
sub cv25519 2026-01-01 [E] [expires: 2029-01-01]

The long hexadecimal string is the key fingerprint. It uniquely identifies the key, and other people use it to verify that a key really belongs to you.

Exchanging Public Keys

To let someone encrypt files for you, export your public key in ASCII format and send it to them:

Terminal
gpg --armor --export alice@example.com > alice-public.asc

When you receive a public key from someone else, import it into your keyring:

Terminal
gpg --import bob-public.asc

output

gpg: key 9F8E7D6C5B4A3F2E: public key "Bob Example <bob@example.com>" imported
gpg: Total number processed: 1
gpg: imported: 1

Before you trust an imported key, compare its fingerprint with the owner over a separate channel, such as a video call or an already-verified chat:

Terminal
gpg --fingerprint bob@example.com

If the fingerprints match, you can certify the key so gpg stops warning you about it:

Terminal
gpg --sign-key bob@example.com

Encrypting a File for a Recipient

With the recipient’s public key imported, encrypt a file for them using -e (--encrypt) and -r (--recipient):

Terminal
gpg -e -r bob@example.com report.pdf

This writes report.pdf.gpg, which only Bob’s private key can decrypt. If you have not certified Bob’s key yet, gpg shows a warning:

output

gpg: 9F8E7D6C5B4A3F2E: There is no assurance this key belongs to the named user
Use this key anyway? (y/N)

Answer y only if you have verified the fingerprint as described above. To silence the warning permanently, certify the key with --sign-key.

You can name several recipients, and each of them will be able to decrypt the same file. Include yourself if you want to keep a readable copy:

Terminal
gpg -e -r bob@example.com -r alice@example.com report.pdf

Without -r alice@example.com in that command, even you, the person who encrypted the file, could not decrypt the result.

Signing and Verifying Encrypted Files

Encryption hides the content, but it does not prove who created the file. Anyone with Bob’s public key can encrypt a file for him. Adding a signature with -s (--sign) closes that gap:

Terminal
gpg -s -u alice@example.com -e -r bob@example.com report.pdf

The -u (--local-user) option selects Alice’s signing key explicitly, which matters if you have more than one private key. gpg asks for the private key passphrase, then signs and encrypts in one pass. When Bob decrypts the file, gpg verifies the signature automatically:

Terminal
gpg -o report.pdf -d report.pdf.gpg

output

gpg: encrypted with cv25519 key, ID 9F8E7D6C5B4A3F2E, created 2026-01-01
"Bob Example <bob@example.com>"
gpg: Signature made Thu 01 Jan 2026 11:42:10 CET
gpg: using EDDSA key 1A2B3C4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A0B
gpg: Good signature from "Alice Example <alice@example.com>" [full]

The Good signature line confirms both that the file came from Alice and that it was not modified after signing. If the file was altered in transit, gpg reports a bad signature instead. For verifying plain downloads rather than encrypted files, checksums are often enough; see our guide on the sha256sum and md5sum commands .

Encrypting a Directory

gpg encrypts single files, not directories. The usual pattern is to pack the directory with tar and encrypt the archive in one pipeline:

Terminal
tar czf - project/ | gpg -c -o project.tar.gz.gpg

The tar command writes a compressed archive to standard output, and gpg encrypts the stream into project.tar.gz.gpg without ever writing an unencrypted archive to disk.

To restore the directory, reverse the pipeline:

Terminal
gpg -d project.tar.gz.gpg | tar xzf -

The same pattern works with -e -r name@example.com in place of -c when you are encrypting the archive for someone else.

Decrypting in Scripts

Backup jobs and deploy scripts cannot type a passphrase interactively. For those cases, store the passphrase in a file and point gpg at it:

Terminal
gpg --batch --yes --pinentry-mode loopback \
 --passphrase-file /root/.backup-pass \
 -o backup.sql -d backup.sql.gpg

The --batch option disables all interactive prompts, --yes overwrites the output file if it exists, and --pinentry-mode loopback allows the passphrase to come from the file instead of the interactive pinentry dialog. GPG reads only the first line of the passphrase file. The same options work with -c for encrypting.

Warning

A passphrase file is a credential. Restrict it with chmod 600, keep it outside your repository, and add it to .gitignore so it never lands in version control. Avoid passphrase files when public key encryption fits the job. Scripts need no passphrase to encrypt with -e -r because that operation uses only the recipient’s public key.

Troubleshooting

gpg: decryption failed: No secret key
The file was encrypted for a key that is not in your keyring. This often happens when someone encrypts a file with their own key instead of yours, or when you moved to a new machine without migrating your private key. Run gpg --list-packets file.gpg | head to see which key ID the file was encrypted for.

gpg: public key decryption failed: Inappropriate ioctl for device
gpg could not open a passphrase prompt, which is common over SSH or in minimal shells. Tell it which terminal to use and retry:

Terminal
export GPG_TTY=$(tty)

Add the line to ~/.bashrc to make it permanent.

gpg does not ask for the passphrase
gpg-agent has cached it. This is expected behavior; run gpg-connect-agent reloadagent /bye to clear the cache, for example before stepping away from a shared machine.

There is no assurance this key belongs to the named user
The recipient’s key is imported but not certified. Verify the fingerprint with the owner, then run gpg --sign-key name@example.com.

Conclusion

Use gpg -c with a strong passphrase when you are protecting your own files, and key-based encryption with -e -r when files move between people, adding -s when the recipient needs proof of who sent them. For TLS certificates and encrypting data in transit rather than files at rest, see our guide on how to use OpenSSL .

strace Command in Linux: Trace System Calls

hello@linuxize.com (Linuxize) — Sat, 11 Jul 2026 10:15:00 +0200

A program exits with a vague error, or hangs, and the logs say nothing useful. Before guessing, you can watch exactly what the program asks the kernel to do. Every time a process opens a file, reads a socket, or allocates memory, it makes a system call, and strace records each one along with its arguments and return value. That trace often reveals the real problem in seconds: a config file the program looked for in the wrong place, a permission denied on a socket, or a call that blocks forever.

This guide explains how to trace a command with strace, attach to a running process, filter the calls you care about, and read the output to find the failing call.

Installing strace

strace is not always installed by default, so add it from your distribution’s repositories.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install strace

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install strace

Tracing a Command

The general syntax is:

txt
strace [OPTIONS] COMMAND [ARGS]

The simplest use is to run a command under strace, which prints every system call the program makes to standard error. Trace a small command such as whoami to see the shape of the output:

Terminal
strace whoami

output

execve("/usr/bin/whoami", ["whoami"], 0x7ffd... /* 25 vars */) = 0
brk(NULL) = 0x55d3...
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
...
openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
write(1, "dejan\n", 6) = 6
exit_group(0) = ?
+++ exited with 0 +++

Each line is one system call: the name, its arguments in parentheses, and the return value after the =. A return of 3 from openat is a file descriptor, meaning the open succeeded; a return of -1 carries an error name such as ENOENT. Notice the program opened /etc/passwd to look up the user name, then write sent the result to file descriptor 1, which is standard output.

Reading Failed Calls

The reason to reach for strace is usually a failure, and failures are easy to spot because the return value is -1 followed by the error code. Suppose a program cannot start and you trace it:

Terminal
strace ./myapp

A failing line looks like this:

output

openat(AT_FDCWD, "/etc/myapp/config.yaml", O_RDONLY) = -1 ENOENT (No such file or directory)

This single line tells you the program expected its config at /etc/myapp/config.yaml and the file is not there. A -1 EACCES instead would mean the file exists but the process lacks permission. For a short trace, scan for -1 to find failed calls. With a noisy program, use -Z to print only calls that returned an error:

Terminal
strace -Z ./myapp

Not every failed call is the root cause. Programs commonly probe several paths before finding a file, so read the calls around the failure and look for the last relevant error before the program exits.

Filtering the Calls You Care About

A full trace is noisy. When you only care about file access, limit the trace to the relevant calls with -e trace=. To see just the file-opening calls, trace openat:

Terminal
strace -e trace=openat ./myapp

You can name a category instead of individual calls. The %file category covers every call that takes a filename, and %network covers network-related calls:

Terminal
strace -e trace=%file ./myapp
strace -e trace=%network ./myapp

This focus turns a flood of output into the handful of lines that matter for the question you are asking.

Attaching to a Running Process

When a process is already running, perhaps stuck or pinning the CPU, attach to it by PID with -p instead of starting a new program. First find the PID with the ps command , then attach:

Terminal
sudo strace -p 2841

strace begins printing the calls the live process makes from that moment on. You may not need sudo when the process belongs to your user, but Linux capabilities and the kernel.yama.ptrace_scope setting can impose additional restrictions. Press Ctrl+C to detach and leave the process running. For a hung process, attaching usually shows it parked in a single blocking call such as read or futex, which points straight at what it is waiting for.

Following Child Processes

By default strace follows only the process it started. Programs that fork workers, such as shells or servers, do their real work in children that the trace would miss. Add -f to follow forks so the children are traced too:

Terminal
strace -f ./server

Each line is then prefixed with the PID that made the call, so you can tell the parent and its children apart.

Summarizing System Call Time

Beyond individual calls, strace can profile where a program spends its time in the kernel. The -c flag suppresses the per-call output and prints a summary table when the program exits:

Terminal
strace -c ./myapp

output

% time seconds usecs/call calls errors syscall
------ ----------- ----------- --------- --------- ----------------
41.23 0.004812 18 267 read
22.10 0.002579 10 251 12 openat
15.04 0.001755 14 125 mmap
...
------ ----------- ----------- --------- --------- ----------------
100.00 0.011670 843 14 total

The table ranks system calls by total time, shows how many times each was called, and counts how many returned an error. The 12 openat errors show that some file lookups failed, but programs often probe optional paths as part of normal operation. Inspect the individual calls before treating the count as a problem.

Saving a Trace to a File

Traces scroll fast, so for anything non-trivial write the output to a file with -o and read it afterward:

Terminal
strace -o trace.log -f ./myapp

This keeps strace output separate from the program’s own output and gives you a file to grep, for example grep ENOENT trace.log to list every missing-file error at once.

Quick Reference

Task	Command
Trace a command	`strace ./app`
Trace only failed calls	`strace -Z ./app`
Trace only file calls	`strace -e trace=%file ./app`
Trace network calls	`strace -e trace=%network ./app`
Attach to a running process	`sudo strace -p PID`
Follow child processes	`strace -f ./app`
Summarize call time and errors	`strace -c ./app`
Write trace to a file	`strace -o trace.log ./app`

Conclusion

Use focused filters and read the calls around a failure instead of treating every error as the cause. For another view of open files and sockets on a running process, use the lsof command .

How to Manage Node.js Processes with PM2

hello@linuxize.com (Linuxize) — Fri, 10 Jul 2026 09:20:00 +0200

A Node.js app can run fine with node app.js during development, but production needs something that can restart crashes, collect logs, and come back after a reboot. A single Node.js process runs one event loop, so busy services can hit a single-process ceiling before the server itself is out of capacity. PM2 is a Node.js process manager that covers those operational pieces: it restarts crashed apps, captures stdout and stderr into rotated log files, runs networked apps in cluster mode across CPU cores, and survives a reboot through a systemd unit. The CLI is short enough to learn in an afternoon, and it covers everything from local development to a multi-server fleet.

This guide explains how to install PM2 on Linux, start and manage Node.js processes, set up clustering for multi-core servers, and persist the process list across reboots.

Install PM2

PM2 is published as an npm package. PM2 7 requires Node.js 18 or newer. With Node.js already installed, add PM2 globally:

Terminal
sudo npm install -g pm2

Confirm the version:

Terminal
pm2 --version

output

7.0.3

The pm2 command is now on $PATH for every user. PM2 stores per-user state under ~/.pm2, so each Linux user has an isolated process list, log directory, and pid file.

Start an Application

The simplest invocation starts a single Node.js process and gives it a name you can refer to later:

Terminal
pm2 start app.js --name myapp

output

[PM2] Starting /home/sara/myapp/app.js in fork_mode (1 instance)
[PM2] Done.
┌────┬───────┬─────────┬───────┬──────┬──────────┬────────┐
│ id │ name │ mode │ pid │ ↺ │ status │ cpu │
├────┼───────┼─────────┼───────┼──────┼──────────┼────────┤
│ 0 │ myapp │ fork │ 12345 │ 0 │ online │ 0% │
└────┴───────┴─────────┴───────┴──────┴──────────┴────────┘

The --name flag is optional but worth setting on every start: PM2 falls back to the script filename otherwise, and “myapp” is easier to type than “server”.

pm2 start also accepts npm scripts. If your package.json has "start": "node app.js":

Terminal
pm2 start npm --name myapp -- start

The -- separator is required so PM2 stops parsing flags and passes the remainder to npm.

Inspect Processes

pm2 ls (or pm2 list) prints the current process table:

Terminal
pm2 ls

output

┌────┬─────────┬─────────┬─────────┬─────────┬──────────┬────────┐
│ id │ name │ mode │ pid │ uptime │ status │ memory │
├────┼─────────┼─────────┼─────────┼─────────┼──────────┼────────┤
│ 0 │ myapp │ fork │ 12345 │ 3m │ online │ 64.0mb │
│ 1 │ worker │ fork │ 12346 │ 1m │ online │ 42.0mb │
└────┴─────────┴─────────┴─────────┴─────────┴──────────┴────────┘

For per-process detail, including environment variables, restart count, and log paths, ask for a detailed view:

Terminal
pm2 show myapp

The output also reports the script path, the working directory, and the last few exit codes, which together cover most “why is it restarting” investigations.

Read Logs

PM2 captures stdout and stderr into log files under ~/.pm2/logs. The streaming view is the fastest way to see what is happening right now:

Terminal
pm2 logs myapp

output

0|myapp | App listening on http://127.0.0.1:3000
0|myapp | request from 127.0.0.1 GET /

The prefix combines the PM2 id with the app name, which matters in cluster mode where multiple instances share a name. Add --lines 100 to start from the last 100 lines, or --err to tail only stderr.

For long-lived apps, install the log rotation module:

Terminal
pm2 install pm2-logrotate
pm2 set pm2-logrotate:max_size 10M
pm2 set pm2-logrotate:retain 7

The settings cap each log file at 10 MB and keep seven rotated copies, which is enough to investigate problems without filling the disk.

Restart, Reload, and Stop

Three verbs cover most lifecycle work:

Terminal
pm2 restart myapp
pm2 reload myapp
pm2 stop myapp

restart kills and respawns the process. It is the fastest option but drops in-flight requests.

reload is the zero-downtime variant. PM2 starts the new process, waits until it reports ready, and only then terminates the old one. It only works in cluster mode (more below), so the listening socket can be passed across processes.

stop shuts the process down but keeps the entry in the table, so a later pm2 start myapp brings it back without re-typing the script path. To remove the entry completely, use pm2 delete myapp.

Run in Cluster Mode

A single Node.js process runs one event loop. On multi-core servers, PM2’s cluster mode forks the application into multiple processes that share the listening socket:

Terminal
pm2 start app.js -i 4 --name myapp

Pass max instead of a number to spawn one process per logical CPU:

Terminal
pm2 start app.js -i max --name myapp

Cluster mode requires the application to handle being one of several processes. Most HTTP frameworks (Express, Fastify, Koa) work out of the box because Node.js handles the socket distribution. Code that uses in-process state (counters, caches, WebSocket session maps) needs an external store such as Redis or a sticky-session mechanism for the cluster to behave correctly.

Manage Multiple Apps with an Ecosystem File

For more than a single app, switch from CLI flags to a configuration file:

Terminal
pm2 ecosystem

The command writes ecosystem.config.js in the current directory. Edit it to list your apps:

ecosystem.config.jsjs
module.exports = {
 apps: [
 {
 name: "api",
 script: "./api/server.js",
 instances: "max",
 exec_mode: "cluster",
 env: {
 NODE_ENV: "production",
 PORT: 3000,
 },
 },
 {
 name: "worker",
 script: "./worker/index.js",
 instances: 1,
 env: {
 NODE_ENV: "production",
 },
 },
 ],
};

Start everything at once:

Terminal
pm2 start ecosystem.config.js

The file is the right place to record per-environment overrides, log paths, memory limits (max_memory_restart: "512M"), and cron-style restart schedules. Commit it alongside the application.

Survive a Reboot

PM2 does not start itself at boot. To make it do so, generate a systemd unit:

Terminal
pm2 startup systemd

output

[PM2] To setup the Startup Script, copy/paste the following command:
sudo env PATH=$PATH:/usr/bin /usr/lib/node_modules/pm2/bin/pm2 startup systemd -u sara --hp /home/sara

Run the printed command exactly as shown. It installs and enables a systemd unit named pm2-<user>.service. Then save the current process list so PM2 knows what to start:

Terminal
pm2 save

After a reboot, the systemd unit launches PM2 as your user, which resurrects each saved app. Verify the unit is enabled:

Terminal
systemctl status pm2-sara

output

● pm2-sara.service - PM2 process manager
Loaded: loaded (/etc/systemd/system/pm2-sara.service; enabled; preset: enabled)
Active: active (running)

Monitor Resources

For an at-a-glance view of CPU and memory per app, run the built-in dashboard:

Terminal
pm2 monit

The terminal UI shows a live process list with CPU and memory graphs, plus a log tail per app. Press q to quit.

For programmatic access, pm2 jlist prints the same data as JSON, which feeds into your own dashboards or monitoring scripts.

Troubleshooting

pm2: command not found after install
npm’s global bin directory is not on $PATH. Run npm config get prefix and add <prefix>/bin to $PATH, or install Node.js through the official NodeSource setup, which places npm under /usr/bin by default.

Process keeps restarting
The script crashes on startup. Run pm2 logs myapp --err to see the most recent stderr output, then fix the underlying error. Use pm2 show myapp for the restart count.

pm2 reload falls back to restart
Reload only works in cluster mode. Add -i 2 (or more) when starting the app, and the next reload will be zero-downtime.

Quick Reference

Task	Command
Install PM2 globally	`sudo npm install -g pm2`
Start an app	`pm2 start app.js --name myapp`
List processes	`pm2 ls`
Stream logs	`pm2 logs myapp`
Restart	`pm2 restart myapp`
Zero-downtime reload	`pm2 reload myapp`
Stop	`pm2 stop myapp`
Delete from list	`pm2 delete myapp`
Cluster mode (4 instances)	`pm2 start app.js -i 4`
Save process list	`pm2 save`
Generate systemd unit	`pm2 startup systemd`

FAQ

Should I use PM2 in a Docker container?
Usually no. Containers already provide isolation, and an orchestrator (Docker, systemd, Kubernetes) restarts crashed containers. Running PM2 inside hides crashes from the orchestrator and makes the container harder to debug.

Does PM2 support TypeScript?
Yes. Either compile to JavaScript first and point PM2 at the compiled file, or use --interpreter ts-node when starting. Compiling is faster at runtime and simpler in production.

How do I pass environment variables to a PM2 app?
Add an env block to the ecosystem file, or prefix the CLI invocation: NODE_ENV=production pm2 start app.js. The ecosystem file is the durable option.

Conclusion

PM2 turns a Node.js process into a managed service with one short command, and the ecosystem file scales the same workflow to many apps on the same server. Pair it with cluster mode for multi-core HTTP services, generate the systemd unit so reboots do not take the site down, and the rest is operational hygiene.

For related setup, see our guides on installing Node.js on Ubuntu and deploying a Node.js application on Ubuntu 26.04 .

Bash Parameter Expansion: Defaults, Substrings, and Replacement

hello@linuxize.com (Linuxize) — Thu, 09 Jul 2026 09:40:00 +0200

Most Bash scripts call sed, awk, or cut for jobs the shell can do by itself. Stripping an extension from a filename, providing a default when a variable is empty, or replacing part of a string are all built into the ${...} syntax, run in the current process, and cost no fork to an external program. The syntax is dense, which is why many people never move past ${var}, but there are only a handful of patterns to learn.

This guide explains Bash parameter expansion: default values, length, substrings, prefix and suffix trimming, search and replace, and case conversion, with practical examples of each.

The Basic Form

${var} expands to the value of var, exactly like $var. The braces become mandatory when the variable name would otherwise run into the surrounding text:

Terminal
file="report"
echo "${file}_final.txt"

output

report_final.txt

Without braces, Bash would look for a variable named file_final. Everything else in this guide builds on this form by adding an operator inside the braces.

Default Values

The :- operator substitutes a fallback when a variable is unset or empty:

Terminal
echo "Deploying to ${ENVIRONMENT:-staging}"

output

Deploying to staging

The variable itself is not modified; the default only applies to this one expansion. To also assign the fallback to the variable, use := instead:

Terminal
: "${LOG_DIR:=/var/log/myapp}"
echo "$LOG_DIR"

output

/var/log/myapp

The leading : is the null command; it evaluates its arguments and does nothing else, which makes it the idiomatic way to trigger the assignment. This pattern is common at the top of scripts to give every configuration variable a sane default.

Two related operators round out the family. :? aborts the script with a message when the variable is missing, which turns a silent misconfiguration into a loud one:

Terminal
: "${API_KEY:?API_KEY must be set}"

output

bash: API_KEY: API_KEY must be set

And :+ is the inverse of :-: it expands to a value only when the variable is set and non-empty, which is useful for building optional command arguments:

Terminal
curl ${PROXY:+--proxy "$PROXY"} https://example.com

When PROXY is empty, the expansion vanishes entirely and curl runs without the option.

Each operator also exists without the colon (-, =, ?, +). The colon versions treat an empty string the same as an unset variable; the colon-free versions act only when the variable is truly unset. In practice, the colon versions are what you want nearly all the time.

Defaults work on positional parameters too, which makes optional script arguments trivial:

Terminal
target="${1:-.}"

This uses the first argument if given and the current directory otherwise; see our guide on Bash script arguments for the wider context.

String Length

${#var} expands to the length of the value in characters:

Terminal
password="s3cretPass"
echo "${#password}"

output

A common use is input validation, such as rejecting a password shorter than a minimum inside an if statement . For arrays, the same syntax with [@] counts elements instead: ${#files[@]}.

Substrings

The ${var:offset:length} form extracts a substring. Offsets count from zero, and the length is optional:

Terminal
date="2026-01-01"
echo "${date:0:4}"
echo "${date:5}"

output

2026
01-01

The first expansion takes four characters starting at position zero; the second takes everything from position five onward.

Negative offsets count from the end of the string, but they require a space or parentheses so Bash does not confuse the syntax with the :- default operator:

Terminal
file="backup-2026.tar.gz"
echo "${file: -6}"

output

tar.gz

A negative length means “stop that many characters before the end” rather than a count, so ${var:1:-1} trims one character from each side. Negative lengths require Bash 4.2 or later.

Trimming Prefixes and Suffixes

Four operators remove a pattern from the front or the back of the value. # removes the shortest match from the front, ## the longest match from the front, % the shortest match from the back, and %% the longest match from the back. The patterns are globs, the same wildcards used for filenames.

The classic use is pulling filenames apart:

Terminal
path="/var/www/site/index.backup.html"

echo "${path##*/}"
echo "${path%/*}"
echo "${path%.*}"
echo "${path##*.}"

output

index.backup.html
/var/www/site
/var/www/site/index.backup
html

The first two replicate the basename and dirname commands: ##*/ deletes the longest match of “anything followed by a slash” from the front, and %/* deletes the shortest “slash followed by anything” from the back. The last two split at the final dot, so %.* strips one extension while ##*. keeps only the extension.

The shortest/longest distinction matters exactly when the pattern can match at more than one place. With the file above, ${path%.*} removes only .html, while ${path%%.*} would remove .backup.html as well.

Renaming files in a loop shows the pattern in action. For bulk changes, preview the commands first:

Terminal
for f in *.jpeg; do
 printf 'mv -- %q %q\n' "$f" "${f%.jpeg}.jpg"
done

After checking the generated commands, run the rename:

Terminal
for f in *.jpeg; do
 mv -- "$f" "${f%.jpeg}.jpg"
done

Each name has its .jpeg suffix trimmed and .jpg appended, with no sed in sight. The -- tells mv that option parsing is done, which protects filenames that begin with a dash.

Search and Replace

The ${var/pattern/replacement} form replaces the first match of a glob pattern, and doubling the first slash replaces all matches:

Terminal
csv="one,two,three"
echo "${csv/,/;}"
echo "${csv//,/;}"

output

one;two,three
one;two;three

Anchors are available: ${var/#pattern/replacement} replaces only a match at the start of the string, and ${var/%pattern/replacement} only at the end. Omitting the replacement deletes the match:

Terminal
echo "${csv//,}"

output

onetwothree

Keep in mind the pattern is a glob, not a regular expression: * and ? work, but . is a literal dot and there are no + or ^ operators. When you genuinely need regular expressions, that is the job of sed or the =~ operator; for everything simpler, the expansion is faster and has no quoting headaches. Our Bash string manipulation guide compares these approaches side by side.

Changing Case

Bash 4 added case conversion operators: ^^ uppercases the value, ,, lowercases it, and the single forms ^ and , convert only the first character:

Terminal
name="alice"
echo "${name^}"
echo "${name^^}"

header="CONTENT-TYPE"
echo "${header,,}"

output

Alice
ALICE
content-type

Lowercasing is the standard trick for case-insensitive comparisons: normalize both sides with ,, and compare the results. Most current Linux distributions ship Bash 5, and Bash 4 is enough for these operators. Availability is mainly a concern in scripts that must also run on macOS’s ancient default Bash 3.2, where they are missing.

Indirect Expansion

${!var} expands to the value of the variable whose name is stored in var:

Terminal
staging_host="staging.example.com"
production_host="prod.example.com"

env="staging"
ref="${env}_host"
echo "${!ref}"

output

staging.example.com

Indirection occasionally saves the day in configuration-driven scripts, but if you find yourself using it often, an associative array is usually the cleaner tool.

Combining with Positional Parameters

All the operators work on $1, $2, and friends, and the substring form even works on $@:

Terminal
command="${1:?usage: $0 command [args...]}"
shift_args=("${@:2}")

The first line insists on at least one argument and prints a usage message otherwise; the second collects every argument after the first into an array. These two lines are the skeleton of most subcommand-style scripts.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Expansion	Result
`${var:-default}`	Value, or `default` if unset or empty
`${var:=default}`	Same, and assigns the default to `var`
`${var:?message}`	Value, or exit with `message` if unset or empty
`${var:+word}`	`word` only if `var` is set and non-empty
`${#var}`	Length of the value
`${var:2:5}`	Five characters starting at offset 2
`${var: -3}`	Last three characters
`${var#pattern}`	Remove shortest matching prefix
`${var##pattern}`	Remove longest matching prefix
`${var%pattern}`	Remove shortest matching suffix
`${var%%pattern}`	Remove longest matching suffix
`${var/old/new}`	Replace first match
`${var//old/new}`	Replace all matches
`${var/#old/new}`	Replace match at start only
`${var/%old/new}`	Replace match at end only
`${var^^}` / `${var,,}`	Uppercase / lowercase the value
`${var^}` / `${var,}`	Uppercase / lowercase the first character
`${!var}`	Value of the variable named by `var`

Conclusion

Parameter expansion replaces a surprising share of the sed | awk | cut pipelines found in everyday scripts, with defaults via :- and :=, filename surgery via # and %, and replacement via // covering the bulk of real cases. The patterns pair naturally with the string techniques in our Bash string manipulation guide, and with set -u from the Bash set command , where a well-placed ${var:-} marks a variable as intentionally optional.

smartctl Command in Linux: Check Disk Health with SMART

hello@linuxize.com (Linuxize) — Wed, 08 Jul 2026 09:40:00 +0200

Disks rarely die without warning. Long before a drive stops responding, it usually accumulates reallocated sectors, read errors, or climbing temperatures, and the drive itself keeps count through SMART (Self-Monitoring, Analysis and Reporting Technology). The smartctl command reads those counters, so the question “is this disk failing?” gets an answer based on the drive’s own bookkeeping instead of guesswork.

This guide explains how to use smartctl to check drive health, read the attributes that actually predict failure, run self-tests, and keep an eye on NVMe wear.

smartctl Syntax

The basic syntax is:

txt
smartctl [OPTIONS] DEVICE

DEVICE is normally a whole disk such as /dev/sda, /dev/sdb, or /dev/nvme0, not a mounted directory. Most checks need root because smartctl sends commands directly to the drive. If you are not sure which device names your disks have, run lsblk first.

Installing smartctl

smartctl is part of the smartmontools package.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install smartmontools

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install smartmontools

After installation, run smartctl with sudo unless your distribution has granted your user direct access to storage devices.

Checking Whether a Drive Supports SMART

Start with the identity summary:

Terminal
sudo smartctl -i /dev/sda

output

Model Family: Samsung based SSDs
Device Model: Samsung SSD 870 EVO 1TB
Serial Number: S6PTNM0T812345A
Firmware Version: SVT02B6Q
User Capacity: 1,000,204,886,016 bytes [1.00 TB]
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

Besides confirming SMART support, this output gives you the model and serial number, which you will want when matching a physical drive to a device name or claiming a warranty. In the rare case SMART is available but disabled, enable it with sudo smartctl -s on /dev/sda.

Checking Overall Health

The quickest check is the drive’s own verdict:

Terminal
sudo smartctl -H /dev/sda

output

SMART overall-health self-assessment test result: PASSED

A FAILED result means the drive predicts its own failure within 24 hours and warranty replacement is justified; back up immediately.

Warning

Do not read PASSED as “healthy”. The overall verdict flips only when an attribute crosses the manufacturer’s failure threshold, and drives regularly corrupt data while still technically passing. The attributes in the next section tell the real story, and no SMART output replaces working backups.

Reading SMART Attributes

The attribute table is where failure announces itself early:

Terminal
sudo smartctl -A /dev/sda

output

ID# ATTRIBUTE_NAME FLAG VALUE WORST THRESH TYPE UPDATED WHEN_FAILED RAW_VALUE
5 Reallocated_Sector_Ct 0x0033 100 100 010 Pre-fail Always - 0
9 Power_On_Hours 0x0032 097 097 000 Old_age Always - 11284
12 Power_Cycle_Count 0x0032 099 099 000 Old_age Always - 413
177 Wear_Leveling_Count 0x0013 099 099 000 Pre-fail Always - 8
187 Reported_Uncorrect 0x0032 100 100 000 Old_age Always - 0
194 Temperature_Celsius 0x0022 067 052 000 Old_age Always - 33
197 Current_Pending_Sector 0x0032 100 100 000 Old_age Always - 0
198 Offline_Uncorrectable 0x0030 100 100 000 Old_age Offline - 0

Two number systems live in this table. VALUE is a normalized score where higher is better; the drive flags failure when it drops to THRESH. RAW_VALUE is the actual count, and for the attributes that matter, the raw count is what you read.

Four attributes predict failure well, and their healthy raw value is zero:

Reallocated_Sector_Ct (5) - Sectors the drive has retired and remapped to spares. A handful may stay stable for years, but a count that grows between checks is the classic sign of a dying disk.
Reported_Uncorrect (187) - Errors the drive could not correct internally. Any nonzero value correlates strongly with failure.
Current_Pending_Sector (197) - Sectors the drive could not read and is waiting to remap. Pending sectors mean data in those spots is already at risk.
Offline_Uncorrectable (198) - Confirmed unreadable sectors found during offline scanning.

Note the raw values now, check again in a week, and treat growth in any of these four as your cue to replace the drive. Temperature (194) is worth a glance too: sustained operation above roughly 50°C shortens drive life, and a spike often points at a failed case fan.

Running Self-Tests

Attributes are passive bookkeeping; self-tests actively exercise the drive. The test runs inside the drive’s firmware, so you can keep using the system while it works. Start with the short test, which takes a couple of minutes:

Terminal
sudo smartctl -t short /dev/sda

output

=== START OF OFFLINE IMMEDIATE AND SELF-TEST SECTION ===
Sending command: "Execute SMART Short self-test routine immediately in off-line mode".
Testing has begun.
Please wait 2 minutes for test to complete.

The long test (-t long) reads the entire surface and takes from under an hour on an SSD to many hours on a large hard drive; it is the right choice when a short test passes but you still suspect the drive. Check the results once the wait time has passed:

Terminal
sudo smartctl -l selftest /dev/sda

output

Num Test_Description Status Remaining LifeTime(hours) LBA_of_first_error
# 1 Short offline Completed without error 00% 11284 -
# 2 Extended offline Completed without error 00% 10102 -

A failed entry lists the LBA of the first error, which is the drive telling you exactly where it can no longer read. At that point the useful response is replacement, not repair; filesystem-level checks like fsck fix filesystem structures, not failing hardware underneath them.

Checking NVMe Drives

NVMe drives report health through a different log format, and smartctl -a presents the main fields directly:

Terminal
sudo smartctl -a /dev/nvme0

output

=== START OF SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED
Critical Warning: 0x00
Temperature: 41 Celsius
Available Spare: 100%
Available Spare Threshold: 10%
Percentage Used: 3%
Data Units Written: 18,536,442 [9.49 TB]
Media and Data Integrity Errors: 0
Error Information Log Entries: 0

Three fields carry the signal. Percentage Used is the drive’s own wear estimate against its rated endurance, so 3% after a year of use projects decades of life, while a value racing toward 100% on a young drive means the workload is chewing through it. Available Spare falling toward its threshold plays the role reallocated sectors play on SATA drives. Media and Data Integrity Errors should be zero, full stop.

Checking Drives in USB Enclosures

USB adapters often hide the drive behind a bridge chip, and smartctl reports Unknown USB bridge instead of SMART data. Most bridges pass SMART through when asked explicitly:

Terminal
sudo smartctl -a -d sat /dev/sdb

The -d sat option tells smartctl to tunnel ATA commands through the bridge. If that fails, -d sntasmedia or -d sntjmicron handle common NVMe-to-USB chips, and some cheap enclosures simply do not pass SMART at all.

Continuous Monitoring with smartd

The smartmontools package also ships smartd, a daemon that polls your drives and warns you instead of waiting for you to remember. A single line in /etc/smartd.conf covers all drives:

/etc/smartd.conftxt
DEVICESCAN -a -o on -S on -s (S/../.././02|L/../../6/03) -m root -M exec /usr/share/smartmontools/smartd-runner

This monitors all detected devices, runs a short self-test daily at 02:00 and a long test on Saturdays at 03:00, and reports problems to root’s mail. Enable it with:

Terminal
sudo systemctl enable --now smartd

Distribution packages ship a commented default config that is close to this already, so often you only need to enable the service.

Troubleshooting

Permission denied or operation not permitted
Run the command with sudo. smartctl needs direct device access, and an unprivileged shell usually cannot send SMART commands to a disk.

SMART support is disabled
If smartctl -i says SMART is available but disabled, turn it on with sudo smartctl -s on /dev/sda, replacing /dev/sda with the correct device.

Unknown USB bridge
Try the SAT passthrough driver with sudo smartctl -a -d sat /dev/sdb. If that fails on an NVMe-to-USB enclosure, try -d sntasmedia or -d sntjmicron. Some adapters do not expose SMART data at all.

No such device or wrong disk shown
Confirm the device path with lsblk before running smartctl. SATA disks usually appear as /dev/sdX, while NVMe drives usually appear as /dev/nvme0 or /dev/nvme0n1.

Quick Reference

Task	Command
Identify drive and SMART support	`sudo smartctl -i /dev/sda`
Overall pass/fail verdict	`sudo smartctl -H /dev/sda`
Attribute table	`sudo smartctl -A /dev/sda`
Full ATA disk report	`sudo smartctl -x /dev/sda`
NVMe health	`sudo smartctl -a /dev/nvme0`
Start a short self-test	`sudo smartctl -t short /dev/sda`
Start a full-surface test	`sudo smartctl -t long /dev/sda`
View self-test results	`sudo smartctl -l selftest /dev/sda`
Drive behind a USB adapter	`sudo smartctl -a -d sat /dev/sdb`

Conclusion

A monthly smartctl -A glance at reallocated, pending, and uncorrectable counts, or smartd doing the same automatically, converts most disk failures from surprises into scheduled replacements. When the numbers start moving, copy the data off first and experiment second; a drive that is reallocating sectors owes you nothing. For checking the filesystems that live on top of healthy drives, see our guide on the fsck command .

What Is Load Average in Linux: 1, 5, and 15 Minute Averages

hello@linuxize.com (Linuxize) — Tue, 07 Jul 2026 10:45:00 +0200

You log in to a slow server, run uptime or top , and see three numbers next to “load average”. They look like a verdict on how busy the machine is, but a value of 2.5 means very different things on a laptop with two cores and a server with thirty-two. Read in isolation, the numbers say almost nothing.

This guide explains what the load average actually measures, why there are three of them, and how to decide whether a given value is healthy or a sign of trouble.

What the Load Average Measures

The load average is the average number of processes that are either using the CPU or waiting to run, measured over a period of time. On Linux it also counts processes in the uninterruptible sleep state, which usually means they are waiting on disk or other I/O. This last detail is what sets Linux apart from some other systems, and it is the reason a server can show a high load while the CPU looks mostly idle.

In short, the load average answers the question “how many tasks are competing for resources right now?” rather than “what percentage of the CPU is in use?” A process stuck waiting on a slow disk still counts toward the load, even though it is not burning any CPU cycles.

The Three Numbers

The load average is reported as three values. Running uptime shows them at the end of the line:

Terminal
uptime

output

 14:32:51 up 7 days, 3:14, 2 users, load average: 0.52, 0.74, 0.91

The three numbers are exponentially weighted moving averages over the last 1, 5, and 15 minutes:

0.52 - The average over the last minute.
0.74 - The average over the last 5 minutes.
0.91 - The average over the last 15 minutes.

Reading them together tells you the trend, which matters more than any single value. When the 1-minute number is higher than the 15-minute number, load is rising and the system is getting busier. When the 1-minute number is lower, a spike has passed and the system is settling down. In the output above, the load is gradually falling.

How Load Relates to CPU Cores

A load average means nothing until you compare it to the number of logical CPU cores, because each logical core can run one task at a time. A load of 1.0 means there is exactly enough work to keep one core fully busy. On a single-core machine that is full capacity, but on a four-core machine three cores are still idle.

The rule of thumb is to divide the load average by the core count:

Load equal to the number of cores means the system is fully used with no waiting.
Load below the core count means there is spare capacity.
Load above the core count means processes are queuing and waiting for a turn.

Check how many logical CPU cores the system has with nproc:

Terminal
nproc

output

On this four-core machine, a load average of 0.91 is comfortable, since it is well below 4. The same 0.91 on a single-core virtual machine would mean the CPU is nearly saturated. For a broader look at processor metrics, see the guide on checking CPU usage in Linux .

Where to See the Load Average

Several tools report the load average, and which one you reach for depends on how much detail you want.

The quickest view is uptime, which prints the three values on a single line. The top command shows the same numbers in its header and refreshes them live, alongside per-process CPU usage. The htop command displays them too, with a friendlier interface and colored meters. The w command prints the load average above a list of logged-in users.

For scripting, read the raw values directly from the kernel:

Terminal
cat /proc/loadavg

output

0.52 0.74 0.91 1/523 18204

The first three fields are the familiar 1, 5, and 15 minute averages. The fourth field, 1/523, shows the number of currently runnable scheduling entities over the total number of scheduling entities, and the last field is the PID of the most recently created process. Because the format is fixed, /proc/loadavg is convenient to parse in monitoring scripts.

Load Average Versus CPU Usage

It is tempting to treat load average and CPU usage as the same thing, but they answer different questions. CPU usage is the percentage of time the processor spends doing work right now. Load average is the number of tasks competing for the CPU and other resources, smoothed over time.

The gap between them shows up clearly with I/O. If a process is blocked waiting on a slow disk, it counts toward the load average but uses almost no CPU. You can end up with a load of 8 on a four-core box while top reports the CPU as 90 percent idle. In that situation the bottleneck is not the processor, it is the disk, and the fix is to investigate I/O rather than CPU. To find which resource is the real constraint, combine the load reading with tools such as top, vmstat, or iostat.

Quick Reference

Reading	Meaning
`1-minute load`	Short-term pressure. Reacts quickly to spikes.
`5-minute load`	Medium-term pressure. Smooths brief changes.
`15-minute load`	Longer trend. Best for sustained load.
`load < cores`	The system usually has spare capacity.
`load = cores`	The system is fully used, with little waiting.
`load > cores`	Tasks are likely queuing for CPU time or I/O.

FAQ

What is a good load average?
A load average below the number of logical CPU cores means the system has spare capacity. A sustained load above the core count means processes are waiting. There is no single “good” number, because it depends entirely on how many cores the machine has.

Is a load average of 1.0 bad?
On a single-core system, 1.0 means the CPU is fully used with no headroom. On a multi-core system, 1.0 is light, because the other cores are idle. Always divide the value by the core count from nproc.

Why is the load high when the CPU is idle?
Linux counts processes in uninterruptible sleep, usually those waiting on disk or other I/O, toward the load average. A high load with an idle CPU points to an I/O bottleneck rather than a processor one.

Which of the three numbers should I watch?
Compare them. If the 1-minute value is higher than the 15-minute value, load is climbing. If it is lower, a spike is passing. The 15-minute number is the best indicator of a sustained trend.

Conclusion

The load average is a measure of demand on the system, not a percentage, and it only makes sense when you compare it to the number of logical CPU cores. When a high load does not line up with CPU usage, suspect disk or other I/O, and use top or iostat to find the real bottleneck.

Markdown Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 07 Jul 2026 09:20:00 +0200

Document Structure

Create headings and separate sections.

Syntax	Description
`# Heading 1`	Top-level heading
`## Heading 2`	Second-level heading
`### Heading 3`	Third-level heading
`---`	Horizontal rule
Blank line	Separate paragraphs
`<!-- comment -->`	HTML comment

Text Formatting

Style words and phrases inline.

Syntax	Description
`bold`	Bold text
`italic`	Italic text
`*bold italic*`	Bold and italic text
`~~strikethrough~~`	Strikethrough text
`code`	Inline code
`<sub>sub</sub>`	Subscript with HTML
`<sup>sup</sup>`	Superscript with HTML

Links and Images

Point readers to pages, anchors, files, and media.

Syntax	Description
`[Linuxize](https://linuxize.com)`	Link to a page
`[Heading](#heading)`	Link to a page anchor
`[Reference][id]`	Reference-style link
`[id]: https://linuxize.com`	Reference link target
`![Alt text](image.jpg)`	Image with alt text
`[![Alt](image.jpg)](https://example.com)`	Linked image

Lists

Create ordered, unordered, and task lists.

Syntax	Description
`- Item`	Unordered list item
`* Item`	Unordered list item
`1. Item`	Ordered list item
`- Nested item`	Nested list item
`- [ ] Task`	Unchecked task item
`- [x] Task`	Checked task item

Code Blocks

Show commands, snippets, and configuration files.

Syntax	Description
`command`	Inline code
```	Start or end a fenced code block
```bash	Fenced Bash code block
Four leading spaces	Indented code block
````<br>```bash<br>echo "hi"<br>```<br>````	Fence a block that contains triple backticks

Tables

Use pipes and dashes to build simple tables.

Syntax	Description
`\| Name \| Role \|`	Header row
`\|------\|------\|`	Separator row
`\| a \| b \|`	Data row
`\|:---\|`	Left-align column
`\|---:\|`	Right-align column
`\|:---:\|`	Center-align column

Blockquotes

Quote text and nest quoted lines.

Syntax	Description
`> Quote`	Single-line blockquote
`> Quote` `>` `> More`	Multi-paragraph blockquote
`>> Nested quote`	Nested blockquote
`> - Item`	List inside a blockquote
`> Note: Text`	Styled note in a quote

Escaping and Special Characters

Print Markdown control characters as literal text.

Syntax	Description
`\literal asterisk\`	Show asterisks
`\# not a heading`	Show a hash at line start
`\[text\]`	Show square brackets
`\\`	Show a backslash
`<tag>`	Show angle brackets
`&`	Show an ampersand

Common Extensions

Use syntax supported by many Markdown renderers.

Syntax	Description
`- [x] Done`	Task list item
`~~deleted~~`	Strikethrough
`:smile:`	Emoji shortcode
`[^1]`	Footnote marker
`[^1]: Footnote text`	Footnote definition
`term` `: definition`	Definition list

How to Install Claude Code on Ubuntu and Linux

hello@linuxize.com (Linuxize) — Mon, 06 Jul 2026 09:35:00 +0200

Claude Code is Anthropic’s AI coding agent for the terminal. You start it inside a project directory, describe what you want in plain language, and it reads the code, edits files, and runs commands to get there.

This guide covers the recommended native installer first, then the official Linux package-manager repositories and npm alternative for systems that need them.

Prerequisites

Claude Code runs on Ubuntu 20.04+, Debian 10+, and Alpine 3.19+, on x64 or ARM64, with at least 4 GB of RAM. You also need a Claude account: a Pro, Max, Team, or Enterprise plan, or an Anthropic Console account with API billing. The free Claude.ai plan does not include Claude Code access.

Quick Reference

Task	Command
Install, recommended	`curl -fsSL https://claude.ai/install.sh \| bash`
Install with apt, advanced	`sudo apt install claude-code` (after adding the repository)
Install with dnf, advanced	`sudo dnf install claude-code` (after adding the repository)
Install with apk, advanced	`apk add claude-code` (after adding the repository)
Install with npm, alternative	`npm install -g @anthropic-ai/claude-code`
Verify	`claude --version` or `claude doctor`
Start	`claude` (inside a project directory)
Update	`claude update`
Uninstall (native)	`rm -f ~/.local/bin/claude && rm -rf ~/.local/share/claude`

Option 1: The Native Installer (Recommended)

Anthropic’s native installer works on every supported distribution and keeps itself updated in the background:

Terminal
curl -fsSL https://claude.ai/install.sh | bash

As with any piped installer, you can download the script first and read it before running it. The installer places the claude binary in ~/.local/bin and its version data in ~/.local/share/claude; no root privileges are needed. On Alpine and other musl-based distributions, install libgcc, libstdc++, and ripgrep through the package manager first, then set USE_BUILTIN_RIPGREP=0 in the env section of Claude Code’s settings.json.

By default you get the latest release channel. If you prefer the stable channel, which trails by about a week and skips releases with major regressions, install with:

Terminal
curl -fsSL https://claude.ai/install.sh | bash -s stable

Option 2: Linux Package Managers (Advanced)

The native installer is the recommended path for most Linux workstations. Anthropic also publishes official signed apt, dnf, and apk repositories for managed systems where updates should flow through the operating system package manager.

On Ubuntu, Debian, and Derivatives, add the signing key and the apt repository, then install the package:

Terminal
sudo install -d -m 0755 /etc/apt/keyrings
sudo curl -fsSL https://downloads.claude.ai/keys/claude-code.asc -o /etc/apt/keyrings/claude-code.asc
echo "deb [signed-by=/etc/apt/keyrings/claude-code.asc] https://downloads.claude.ai/claude-code/apt/stable stable main" | sudo tee /etc/apt/sources.list.d/claude-code.list
sudo apt update
sudo apt install claude-code

Before trusting the key, verify its fingerprint:

Terminal
gpg --show-keys /etc/apt/keyrings/claude-code.asc

The reported fingerprint should be 31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE. Package manager installations do not auto-update; new versions arrive through your normal sudo apt update && sudo apt upgrade workflow.

On Fedora, RHEL, and Derivatives, create a dnf repository file and install the package:

Terminal
sudo tee /etc/yum.repos.d/claude-code.repo <<'EOF'
[claude-code]
name=Claude Code
baseurl=https://downloads.claude.ai/claude-code/rpm/stable
enabled=1
gpgcheck=1
gpgkey=https://downloads.claude.ai/keys/claude-code.asc
EOF
sudo dnf install claude-code

When dnf prompts you to accept the signing key, verify that the fingerprint matches 31DD DE24 DDFA B679 F42D 7BD2 BAA9 29FF 1A7E CACE. To upgrade later, run:

Terminal
sudo dnf upgrade claude-code

On Alpine Linux, download the repository key, add the stable repository, and install the package:

Terminal
wget -O /etc/apk/keys/claude-code.rsa.pub https://downloads.claude.ai/keys/claude-code.rsa.pub
echo "https://downloads.claude.ai/claude-code/apk/stable" >> /etc/apk/repositories
apk add claude-code

Verify the downloaded Alpine key before trusting it:

Terminal
sha256sum /etc/apk/keys/claude-code.rsa.pub

The checksum should be 395759c1f7449ef4cdef305a42e820f3c766d6090d142634ebdb049f113168b6. To upgrade later, run apk update && apk upgrade claude-code.

Option 3: npm

If you already manage global tools through npm, Claude Code is available as a package. It requires Node.js 22 or later:

Terminal
npm install -g @anthropic-ai/claude-code

The package downloads the same native binary the standalone installer uses, so the installed claude command does not run through Node.js at runtime.

Warning

Do not run npm install -g with sudo. It creates root-owned files in your npm directory and breaks later updates. If the install fails with permission errors, configure npm to use a user-writable global prefix instead.

To upgrade an npm installation later, run npm install -g @anthropic-ai/claude-code@latest.

Verifying the Installation

Confirm the binary is on your PATH and working:

Terminal
claude --version

output

2.1.201 (Claude Code)

Your version number will differ. For a fuller health check covering the installation type, auto-update status, and configuration, run:

Terminal
claude doctor

Start Claude Code from inside the project you want to work on, since it uses the current directory as its workspace:

Terminal
cd ~/projects/my-app
claude

On the first run it opens a browser window to sign in. Log in with your Claude.ai account (Pro, Max, Team, or Enterprise) or with an Anthropic Console account if you pay per API usage. After authenticating once, the session is stored and you go straight to the prompt on subsequent runs. From there, try something small first, for example explain this project or summarize what app.js does.

Updating Claude Code

Native installations check for updates on startup and install them in the background, so normally there is nothing to do. To force an update immediately:

Terminal
claude update

Package-manager installations update with the system. Use sudo apt update && sudo apt upgrade claude-code on Ubuntu and Debian, sudo dnf upgrade claude-code on Fedora and RHEL, and apk update && apk upgrade claude-code on Alpine. Npm installations update with npm install -g @anthropic-ai/claude-code@latest.

Uninstalling Claude Code

For the native installer, remove the binary and version data:

Terminal
rm -f ~/.local/bin/claude
rm -rf ~/.local/share/claude

For apt, remove the package and repository configuration:

Terminal
sudo apt remove claude-code
sudo rm /etc/apt/sources.list.d/claude-code.list /etc/apt/keyrings/claude-code.asc

For dnf, remove the package and repository file:

Terminal
sudo dnf remove claude-code
sudo rm /etc/yum.repos.d/claude-code.repo

For apk, remove the package, repository entry, and key:

Terminal
apk del claude-code
sed -i '\|downloads.claude.ai/claude-code/apk|d' /etc/apk/repositories
rm /etc/apk/keys/claude-code.rsa.pub

For npm, run npm uninstall -g @anthropic-ai/claude-code. User settings and session history live in ~/.claude and ~/.claude.json; delete those too if you want to remove user-level state. Claude Code can also create project-level .claude directories and .mcp.json files, so remove those from individual projects only when you no longer need their saved settings.

Troubleshooting

claude: command not found after installing
The native installer puts the binary in ~/.local/bin, which some shells do not have on their PATH. Add it to your shell profile and reload:

Terminal
echo 'export PATH="$HOME/.local/bin:$PATH"' >> ~/.bashrc
source ~/.bashrc

npm prints an EBADENGINE warning
Your Node.js is older than version 22. The install usually still completes, since the package ships a native binary, but upgrading Node.js removes the warning and matches the supported configuration.

Sign-in loop or “This account does not have access”
Claude Code is not included in the free Claude.ai plan. Log in with a Pro, Max, Team, or Enterprise account, or use an Anthropic Console account with billing set up.

Conclusion

The one-line native installer is the right choice for most machines, the apt repository fits servers that standardize on package-manager updates, and npm works where Node.js tooling is already in place; all three install the same binary. Once you are set up, Claude Code pairs naturally with the GitHub CLI for turning its changes into commits and pull requests, and if you prefer running models locally, see our guide to Ollama on Ubuntu .

ffmpeg Command in Linux: Convert, Compress, and Extract Media

hello@linuxize.com (Linuxize) — Sun, 05 Jul 2026 18:10:00 +0200

Sooner or later every Linux user ends up with a media file in the wrong shape: a video that is too large to share, an MKV that a TV refuses to play, or a lecture recording you only want as audio. ffmpeg handles all of these from the command line. It reads and writes virtually every audio and video format in existence, and once you know a handful of recipes, one tool covers them all.

This guide explains how to use ffmpeg to inspect media files, convert between formats, compress video, extract audio, trim clips, and process files in batches.

Installing ffmpeg

On Ubuntu, Debian, and derivatives, ffmpeg is available in the standard repositories:

Terminal
sudo apt update
sudo apt install ffmpeg

On Fedora, the ffmpeg-free package in the default repositories covers many common tasks, but it has a smaller codec set than a full FFmpeg build. Start with the default package:

Terminal
sudo dnf install ffmpeg-free

Verify the installation by checking the version:

Terminal
ffmpeg -version

ffmpeg Command Syntax

The general syntax of the ffmpeg command is as follows:

txt
ffmpeg [GLOBAL_OPTIONS] -i INPUT [OUTPUT_OPTIONS] OUTPUT

Two details of this layout matter. First, option order: options placed before -i apply to the input, and options placed after it apply to the output. Second, ffmpeg infers the output container from the file extension, so writing output.mp4 is enough to request an MP4 file.

The options you will use constantly are the codec selectors:

-c - Set the codec for all streams; -c copy copies streams without re-encoding.
-c:v - Set the video codec, for example libx264.
-c:a - Set the audio codec, for example aac.
-vn / -an - Drop the video or audio stream entirely.

Inspecting a Media File

Before converting anything, look at what the file contains. The ffprobe tool ships with ffmpeg and prints the container and stream details:

Terminal
ffprobe -hide_banner input.mp4

output

Input #0, mov,mp4,m4a,3gp,3g2,mj2, from 'input.mp4':
Duration: 00:12:34.56, start: 0.000000, bitrate: 4523 kb/s
Stream #0:0[0x1](und): Video: h264 (High) (avc1 / 0x31637634), yuv420p(progressive), 1920x1080, 4387 kb/s, 30 fps
Stream #0:1[0x2](und): Audio: aac (LC) (mp4a / 0x6134706D), 48000 Hz, stereo, fltp, 128 kb/s

The output tells us this file is an MP4 container with two streams: H.264 video at 1080p and AAC stereo audio. Knowing the streams matters because a media file is really two separate things: the container (MP4, MKV, WebM) is just a wrapper, while the codecs (H.264, AAC, VP9, Opus) define how the actual audio and video are encoded. Many “conversions” only need a new wrapper, which brings us to the first recipe.

Converting Between Formats

If the codecs inside the file are already compatible with the target container, you can change the container without re-encoding. This is called remuxing, it is lossless, and it finishes in seconds:

Terminal
ffmpeg -i input.mkv -c copy output.mp4

The -c copy option copies the existing streams into the new container untouched. This is the right way to turn an MKV with H.264 video into an MP4 that a TV or phone will accept.

When the codecs themselves need to change, drop -c copy and let ffmpeg re-encode. For example, to convert an MP4 to a WebM with VP9 video and Opus audio:

Terminal
ffmpeg -i input.mp4 -c:v libvpx-vp9 -crf 32 -b:v 0 -c:a libopus output.webm

Re-encoding is slow compared to remuxing because every frame is decoded and encoded again, so reach for -c copy first and re-encode only when the format actually requires it.

Extracting Audio and Converting to MP3

To pull the audio track out of a video without touching its quality, drop the video with -vn and copy the audio stream:

Terminal
ffmpeg -i video.mp4 -vn -c:a copy audio.m4a

Since the AAC stream is copied as-is, the extraction is instant and lossless. The .m4a extension matches the AAC audio inside.

To get an MP3 instead, re-encode the audio with the LAME encoder:

Terminal
ffmpeg -i video.mp4 -vn -c:a libmp3lame -q:a 2 audio.mp3

The -q:a option controls variable bitrate quality on a scale from 0 (best) to 9 (smallest); -q:a 2 averages around 190 kb/s and is transparent for most content.

For more quality settings, partial extraction, and batch processing, see our guide to converting MP4 to MP3 with ffmpeg .

Compressing Video

The most effective way to shrink a video is re-encoding it with H.264 in Constant Rate Factor mode:

Terminal
ffmpeg -i input.mp4 -c:v libx264 -crf 23 -preset slow -c:a aac -b:a 128k output.mp4

Two options control the trade-offs here:

-crf - Quality target from 0 to 51; lower is better quality and larger files. 23 is the default, 18 is close to visually lossless, and values up to 28 are acceptable for casual sharing. As a rule of thumb, adding 6 roughly halves the file size.
-preset - Encoding speed from ultrafast to veryslow. Slower presets spend more CPU time to achieve better compression at the same quality; slow is a good default when file size matters.

For even smaller files at the cost of encoding time and some device compatibility, use H.265 with a higher CRF:

Terminal
ffmpeg -i input.mp4 -c:v libx265 -crf 28 -c:a copy output.mp4

H.265 at CRF 28 often looks comparable to H.264 at CRF 23 while producing a smaller file, especially for high-resolution video. Older devices and some browsers cannot play H.265, so H.264 remains the safer choice for wide distribution.

Resizing and Scaling Video

Scaling is done with the scale video filter. To resize a video to 1280 pixels wide while keeping the aspect ratio:

Terminal
ffmpeg -i input.mp4 -vf scale=1280:-2 -c:a copy output.mp4

The -2 tells ffmpeg to compute the height automatically and round it to an even number, which avoids errors with common H.264 and yuv420p output. Swapping the values (scale=-2:720) targets a height of 720 pixels instead. Since only the video changes, the audio is copied through with -c:a copy.

Cutting and Trimming Video

To cut a clip from a longer video, combine a start position with an end position or duration:

-ss - Start position, as seconds or HH:MM:SS.
-to - End position.
-t - Duration, as an alternative to -to.

The fast way places -ss before the input and copies the streams:

Terminal
ffmpeg -ss 00:01:00 -to 00:02:30 -i input.mp4 -c copy clip.mp4

This extracts the segment between 1:00 and 2:30 in under a second, because nothing is re-encoded. The trade-off is precision: with -c copy the cut can only start on a keyframe, so the actual start may land up to a few seconds off. When you need a frame-exact cut, re-encode instead:

Terminal
ffmpeg -ss 00:01:00 -to 00:02:30 -i input.mp4 -c:v libx264 -crf 18 -c:a aac clip.mp4

Extracting Images from Video

To grab a single frame as an image, seek to the position and request one video frame:

Terminal
ffmpeg -ss 00:00:10 -i input.mp4 -frames:v 1 thumbnail.jpg

This writes the frame at the 10-second mark to thumbnail.jpg, which is a quick way to generate a video thumbnail. To extract a sequence of frames, use the fps filter; the following saves one frame per second with numbered filenames:

Terminal
ffmpeg -i input.mp4 -vf fps=1 frame_%03d.png

The %03d in the output name becomes a zero-padded counter, producing frame_001.png, frame_002.png, and so on.

Batch Converting Files

For a directory of files, wrap the conversion command in a shell loop. The following bash for loop converts every MKV in the current directory to MP4:

Terminal
for f in *.mkv; do ffmpeg -i "$f" -c:v libx264 -crf 23 -c:a aac "${f%.mkv}.mp4"; done

The ${f%.mkv} expansion strips the old extension so each output file keeps the original name. Quote the variables as shown so filenames with spaces survive the loop.

Quick Reference

Task	Command
Change container losslessly	`ffmpeg -i in.mkv -c copy out.mp4`
Convert video to MP3	`ffmpeg -i in.mp4 -vn -c:a libmp3lame -q:a 2 out.mp3`
Compress with H.264	`ffmpeg -i in.mp4 -c:v libx264 -crf 23 -preset slow -c:a aac -b:a 128k out.mp4`
Compress with H.265	`ffmpeg -i in.mp4 -c:v libx265 -crf 28 -c:a copy out.mp4`
Resize to 1280 wide	`ffmpeg -i in.mp4 -vf scale=1280:-2 -c:a copy out.mp4`
Fast trim (keyframe cut)	`ffmpeg -ss 00:01:00 -to 00:02:30 -i in.mp4 -c copy clip.mp4`
Single frame at 10s	`ffmpeg -ss 00:00:10 -i in.mp4 -frames:v 1 thumb.jpg`
Inspect streams	`ffprobe -hide_banner in.mp4`

Troubleshooting

Unknown encoder libx264, libx265, or libmp3lame
Your FFmpeg package was built without that encoder. Check the available encoders with ffmpeg -encoders, then install a fuller FFmpeg build from your distribution. On Fedora, this usually means enabling RPM Fusion and installing the full ffmpeg package instead of ffmpeg-free.

Could not write header for output file
This often happens when you try to copy streams into a container that does not support them. For example, not every MKV stream can be remuxed into MP4 with -c copy. Re-encode the incompatible stream, or choose a container that supports the original codecs.

The output file already exists
FFmpeg asks before overwriting existing files. Add -y only when you are sure the output can be replaced, or write to a new filename while testing.

FAQ

Does converting with -c copy lose quality?
No. Stream copy moves the encoded audio and video into a new container byte for byte, so the result is identical to the source. Quality is only affected when re-encoding, that is, whenever a codec is specified instead of copy.

Which CRF value should I use?
For H.264, start at 23 and adjust by eye: 18 to 20 for material you care about, 26 to 28 when size matters more than fidelity. For H.265, add about 5 to get a comparable result, so 28 is the usual starting point.

Why is my trimmed clip starting at the wrong time?
With -c copy, cuts snap to the nearest keyframe, which can shift the start by a few seconds depending on how the source was encoded. Re-encode the clip to cut on the exact frame.

Conclusion

A small set of ffmpeg recipes covers almost everything you do with media files day to day: remux with -c copy when only the container is wrong, re-encode with a sensible CRF when size or codec must change, and combine -ss, -vf scale, and -vn for trimming, resizing, and audio extraction. For distribution-specific installation details, see our guides on installing ffmpeg on Ubuntu and Debian .

Fix npm E401: Unable to Authenticate

hello@linuxize.com (Linuxize) — Sat, 04 Jul 2026 19:20:00 +0100

You run npm install or npm publish and the command stops with npm error code E401 and a message such as Unable to authenticate, your authentication token seems to be invalid. The registry is reachable, but it rejects your request because the credentials npm sent are missing, expired, or pointed at the wrong place. This shows up most often with private registries such as npm’s paid tier, GitHub Packages, Verdaccio, or an Artifactory or Nexus proxy, where every request must carry a valid token.

This guide explains what the E401 error means and how to fix it by repairing the token, aligning the registry, and checking the auth settings in your .npmrc.

What the Error Means

A failed install looks like this:

output

npm error code E401
npm error Unable to authenticate, your authentication token seems to be invalid.
npm error To correct this please try logging in again with:
npm error npm login

HTTP 401 is the “unauthorized” status. npm asked the registry for a package, the registry required authentication, and the credentials it received did not check out. The usual causes are a token that expired or was revoked, an .npmrc that has no auth entry for the registry being used, or a scoped package that resolves to a private registry while your token only covers the public one.

Confirm Which Registry npm Is Using

Before changing any tokens, check where npm is actually sending the request. A mismatch between the registry you think you are using and the one configured is the most common reason a valid token still fails:

Terminal
npm config get registry

output

https://registry.npmjs.org/

If your project installs scoped packages from a private registry, that scope is mapped separately. Check it explicitly, replacing @myorg with your scope:

Terminal
npm config get @myorg:registry

When the scope points at one registry but your token belongs to another, npm sends no valid credentials and the registry returns 401.

Log In Again to Refresh the Token

The fastest fix for an expired or revoked token is to log in again, which writes a fresh token into your user .npmrc:

Terminal
npm login

For a scoped private registry, log in against that registry and scope so the token lands in the right place:

Terminal
npm login --scope=@myorg --registry=https://registry.example.com/

After logging in, confirm the registry recognizes you. For the public registry, run:

Terminal
npm whoami

For a private registry, use the same registry URL from the login command:

Terminal
npm whoami --registry=https://registry.example.com/

output

your-username

If the relevant npm whoami command prints your username, authentication is working again. If it returns its own E401, the login did not store a usable token, the command checked the wrong registry, or you should inspect the .npmrc directly.

Inspect and Repair .npmrc

npm reads credentials from .npmrc files, checking the project file first and then the user file at ~/.npmrc. Open the user file in an editor rather than printing it to the terminal, because it may contain real tokens:

Terminal
nano ~/.npmrc

A working entry for the public registry looks like this, where the token is the secret npm sends on every request:

~/.npmrctxt
//registry.npmjs.org/:_authToken=npm_xxxxxxxxxxxxxxxxxxxx

The registry fragment in that line must match the registry host and path npm uses. A token stored under //registry.npmjs.org/ does nothing for requests to //npm.pkg.github.com/. For a private registry the entry uses the same pattern with that host:

~/.npmrctxt
//npm.pkg.github.com/:_authToken=ghp_xxxxxxxxxxxxxxxxxxxx
@myorg:registry=https://npm.pkg.github.com/

If the token line is missing, malformed, or points at the wrong host, correct it and run the install again. Tokens with restricted permissions can also fail, especially when a read-only token is used for npm publish, so make sure the token’s scope matches the action.

Warning

Never commit a project .npmrc that contains a real _authToken to version control. Add .npmrc to your .gitignore, or reference the token through an environment variable such as //registry.npmjs.org/:_authToken=${NPM_TOKEN} and set NPM_TOKEN in your shell or CI secrets.

Fixing E401 in CI Pipelines

In a continuous integration job there is no interactive npm login, so the token comes from an environment variable. Write a minimal .npmrc at the start of the job that keeps the token reference literal in the file:

Terminal
printf '%s\n' '//registry.npmjs.org/:_authToken=${NPM_TOKEN}' > .npmrc

The single quotes keep ${NPM_TOKEN} in .npmrc, and npm replaces it with the environment variable value during the install. The NPM_TOKEN value should come from your CI provider’s secret store, not from a checked-in file. If the pipeline still returns E401, print npm config get registry in the job to confirm it targets the registry the token was issued for.

For publishing from GitHub Actions or GitLab CI/CD, use npm trusted publishing when it fits your registry and workflow. If you still need a token, create a granular token with the minimum publish permissions and shortest practical expiration.

Troubleshooting

npm whoami still returns E401 after login
The login wrote the token to a different .npmrc than the one npm reads for this project, the command checked the wrong registry, or the token lacks the needed permissions. For private registries, run npm whoami --registry=<registry-url>, check both ~/.npmrc and any project .npmrc, and reissue the token with the correct scope.

Install works but publish fails
The token is read-only or does not have publish rights for the package or scope. Generate a token with publish permission and update the auth line.

Error only appears for one scoped package
That scope is mapped to a private registry your token does not cover. Add a @scope:registry line and an _authToken entry for that registry’s host.

Conclusion

E401 is an authentication problem, not a network one: npm reached the registry but sent credentials it would not accept. Refreshing the token with npm login, confirming the registry and scope match, and repairing the _authToken line in .npmrc resolves nearly every case. For a wider tour of npm options and configuration, see the npm command guide .

How to Install and Use Super Productivity on Linux

hello@linuxize.com (Linuxize) — Thu, 02 Jul 2026 09:50:00 +0200

Planning work on Linux often means jumping between a notes app, a timer, an issue tracker, and a calendar. Super Productivity brings those pieces into one open-source desktop app: tasks, time tracking, Pomodoro and Flowtime timers, project notes, scheduled work, and integrations for tools such as Jira, GitHub, GitLab, Gitea, Redmine, OpenProject, and Google Calendar.

This guide explains how to install Super Productivity on Linux using the common package formats, how to run the self-hosted web app with Docker, and how to create your first task after installation.

Technical review: Johannes Millan, creator of Super Productivity, reviewed the install commands used in this guide.

Quick Reference

Method	Command or File	Best For
Flatpak	`flatpak install flathub com.super_productivity.SuperProductivity`	Most Linux desktops
Snap	`sudo snap install superproductivity`	Ubuntu and systems with `snapd`
AppImage	`superProductivity-x86_64.AppImage`	Portable use without package installation
deb	`sudo apt install ./superProductivity-amd64.deb`	Ubuntu, Debian, and derivatives
rpm	`sudo dnf install ./superProductivity-x86_64.rpm`	Fedora, RHEL, and derivatives
Docker	`docker run -d -p 8080:80 johannesjo/super-productivity:latest`	Self-hosted web app
Source	`npm install`, `npm run env`, `ng serve`	Development and testing

The desktop downloads referenced in this guide are for amd64 and x86_64 Linux systems. Use the latest GitHub releases page for the current file names, checksums, and older release files.

Install Super Productivity with Flatpak

Flatpak is the best starting point for most Linux desktop users because the app comes from Flathub and updates through the Flatpak tooling you may already use.

If Flatpak and Flathub are already configured, install Super Productivity with:

Terminal
flatpak install flathub com.super_productivity.SuperProductivity

Start it from your desktop application menu, or run it from the terminal:

Terminal
flatpak run com.super_productivity.SuperProductivity

Flatpak will download the application and any required runtime that is not already installed. Future updates are handled with flatpak update.

Install Super Productivity with Snap

On Ubuntu, snapd is usually installed and enabled by default. On other distributions, install and enable snapd first, then install the Super Productivity snap:

Terminal
sudo snap install superproductivity

After installation, open Super Productivity from the application menu. You can also start it from the terminal:

Terminal
superproductivity

Snap packages update automatically in the background. If you want to check for updates manually, run:

Terminal
sudo snap refresh superproductivity

Install Super Productivity as an AppImage

Use the AppImage when you want a portable file that runs from your home directory without installing a package into the system package database.

Download superProductivity-x86_64.AppImage from the latest releases page . If the file is in your Downloads directory, make it executable and run it:

Terminal
cd ~/Downloads
chmod +x superProductivity-x86_64.AppImage
./superProductivity-x86_64.AppImage

An AppImage does not add a system package entry for apt, dnf, or Snap. To update it later, download the new AppImage, make it executable, and replace the old file.

Install the deb Package on Ubuntu or Debian

For Ubuntu, Debian, Linux Mint, Pop!_OS, and other Debian-based systems, download superProductivity-amd64.deb from the latest release page.

Install the local deb package with apt . The ./ before the file name tells apt to install the file from the current directory instead of searching the repositories:

Terminal
cd ~/Downloads
sudo apt install ./superProductivity-amd64.deb

Using apt for a local deb file is usually safer than calling dpkg directly because apt can resolve missing dependencies. For more detail on local deb files, see our guide to installing deb packages on Ubuntu .

Install the rpm Package on Fedora, RHEL, or openSUSE

For Fedora, RHEL, Rocky Linux, AlmaLinux, and related distributions, download superProductivity-x86_64.rpm from the latest release page.

Install it with dnf :

Terminal
cd ~/Downloads
sudo dnf install ./superProductivity-x86_64.rpm

On openSUSE, use zypper instead:

Terminal
cd ~/Downloads
sudo zypper install ./superProductivity-x86_64.rpm

Both commands install a local RPM file and pull any required dependencies from the configured repositories. If you want to inspect RPM files before installing them, see the rpm command guide .

Run the Web App with Docker

The Docker image runs the Super Productivity web app in a container. This is different from the desktop package: the app is served through your browser, and the container does not store task data by itself.

Run the container on port 8080:

Terminal
docker run -d -p 8080:80 johannesjo/super-productivity:latest

Open http://localhost:8080 in your browser. If port 8080 is already in use, change the first port number, for example -p 8081:80.

Browser data is stored in the browser profile you use to open the app. Restarting or replacing the container does not preserve anything inside the container because the application state is not stored there. For a Docker Compose setup with an optional WebDAV sync backend, see the official Run with Docker documentation.

Build Super Productivity from Source

Building from source is useful if you want to test development changes or contribute to the project. You need Git and Node.js 20 or newer.

Clone the repository and install the dependencies:

Terminal
git clone https://github.com/super-productivity/super-productivity.git
cd super-productivity
npm install -g @angular/cli
npm install
npm run env

Start the web development server:

Terminal
ng serve

Open http://127.0.0.1:4200 in your browser. To run the Electron desktop app while the development server is running, open a second terminal in the same project directory and run:

Terminal
npm start

To build distributable desktop packages, run:

Terminal
npm run dist

The build can take several minutes because it compiles the frontend and packages the Electron app.

First Use

When you open Super Productivity for the first time, choose the setup that matches how you want to work. You can keep it simple as a local task list, use it primarily as a time tracker, or configure a fuller workspace with projects, scheduled tasks, integrations, and sync.

Create a project from the sidebar, then add a task to the project or to the Today view. Tasks can have notes, estimates, reminders, subtasks, and links, which makes the app useful for work that starts in an issue tracker but needs local planning.

To start time tracking, select a task and use the play button. When you stop the timer, Super Productivity keeps the tracked time with the task so you can review what you worked on later. This is useful for client work, daily summaries, or comparing estimates with actual time.

The schedule view lets you place tasks on a day plan next to calendar items. If you use Google Calendar or another supported integration, connect it from the settings after the basic setup is working.

Super Productivity is local-first. On Linux desktop builds, user data is stored under ~/.config/superProductivity/. The Docker and browser versions store data in browser storage. If you want access from multiple devices, open Settings and configure one of the sync options such as WebDAV, Nextcloud, Dropbox, or Super Sync.

For backups and migration, use the Sync and Export/Import section in Settings. Export a backup before switching package formats or moving from the desktop app to the browser version.

Update Super Productivity

If you installed the Flatpak version, update it with:

Terminal
flatpak update com.super_productivity.SuperProductivity

If you installed the Snap version, updates happen automatically, but you can refresh the package manually:

Terminal
sudo snap refresh superproductivity

For AppImage, deb, and rpm installs, download the newer file from the latest release page and install or replace it using the same method you used above. For Docker, pull the newer image and recreate the container with the same port mapping. Since the browser stores the web app data, replacing the container does not migrate browser profiles or sync settings.

Troubleshooting

flatpak: command not found
Flatpak is not installed. On Ubuntu, Debian, and derivatives, install it and add Flathub:

Terminal
sudo apt install flatpak
flatpak remote-add --if-not-exists flathub https://dl.flathub.org/repo/flathub.flatpakrepo

On Fedora, RHEL, and derivatives, install Flatpak with:

Terminal
sudo dnf install flatpak

Flatpak cannot find the Super Productivity app
The Flathub remote is probably missing or disabled. Run flatpak remotes and confirm that flathub is listed. If it is missing, add it with the flatpak remote-add command shown above.

The AppImage does not start
Some distributions need a FUSE compatibility package for AppImages. On Ubuntu 24.04 and newer, install:

Terminal
sudo apt install libfuse2t64

On older Ubuntu and Debian releases, use:

Terminal
sudo apt install libfuse2

On Fedora, RHEL, and derivatives, install:

Terminal
sudo dnf install fuse-libs

After installing the package, make the AppImage executable again and run it from the terminal so you can see any remaining error message.

The deb install searches the repositories instead of the local file
Use ./ before the file name when installing from the current directory: sudo apt install ./superProductivity-amd64.deb. Without ./, apt treats the argument as a package name from a repository.

The Docker web app opens but your data is missing
The Docker container serves the app, but task data is stored in the browser profile. Open the same browser and profile you used before, or configure sync from inside Super Productivity before switching devices or browsers.

ng: command not found when building from source
Install the Angular CLI globally:

Terminal
npm install -g @angular/cli

Alternatively, run the local CLI through npx ng serve after npm install finishes.

Conclusion

Flatpak is the simplest install path for most Linux desktops, while Snap, AppImage, deb, rpm, Docker, and source installs cover the cases where you need a specific package format or deployment style. After installation, create a project, add a few tasks, and configure backups or sync before relying on Super Productivity for daily work.

Linux Wildcards and Globbing Explained

hello@linuxize.com (Linuxize) — Wed, 01 Jul 2026 15:10:00 +0200

When you type rm *.log and the shell deletes every log file in the directory, the rm command never saw the *. The shell expanded the pattern into a list of matching file names first, then handed those names to rm. This expansion is called globbing, and the special characters that drive it are wildcards. Understanding when and how the shell expands them explains a lot of everyday behavior, including why a pattern sometimes matches nothing, why hidden files are skipped, and why quoting a pattern changes what happens.

This guide explains the wildcard patterns the shell understands, how globbing differs from regular expressions, and how to control expansion when you do not want it.

What Globbing Is

Globbing is the shell’s expansion of wildcard patterns into matching file and directory names, and it happens before the command runs. When you write a command containing *, ?, or [...], the shell looks at the current directory, replaces the pattern with every name that matches, and only then executes the command with that list of names as arguments.

This timing is the key point. The command receives a list of real file names, not the pattern, so a program like ls or rm has no idea a wildcard was ever involved. If no file matches, the shell normally leaves the pattern unchanged and passes the literal text through, which is a common source of confusing errors.

Before using a wildcard with a command that removes or overwrites files, print the expansion first:

Terminal
printf '%s\n' *.log

After you confirm the file names, use the same pattern with the command you intended to run.

The Wildcard Characters

Three wildcards cover most patterns you will write.

The asterisk * matches any sequence of characters, including none. List every file ending in .txt:

Terminal
ls *.txt

output

notes.txt report.txt todo.txt

The question mark ? matches exactly one character. This matches file1.log and fileA.log but not file10.log, because ? stands for a single character only:

Terminal
ls file?.log

Square brackets [...] match exactly one character from a set. List files that start with a, b, or c:

Terminal
ls [abc]*

You can give a range inside the brackets with a hyphen, so [0-9] matches any single digit and [a-z] any single lowercase letter:

Terminal
ls report[0-9].pdf

To match any character except those in the set, begin it with ! (or ^ in bash), so [!0-9]* matches names that do not start with a digit.

Bash also uses shell pattern syntax in case statements , where patterns match strings instead of expanding file names.

Brace Expansion

Brace expansion is related but works differently: it generates a list of strings from a pattern, whether or not any file matches. The shell expands {a,b,c} into each comma-separated item. This copies a file to two destinations in one command:

Terminal
cp config.yaml{,.bak}

That expands to cp config.yaml config.yaml.bak, a common shortcut for making a quick backup. Braces also take ranges, so {1..5} becomes 1 2 3 4 5:

Terminal
mkdir project-{1..3}

This creates project-1, project-2, and project-3. The important difference from wildcards is that brace expansion does not look at the filesystem; it just produces text. A wildcard only expands to names that actually exist, while braces expand regardless.

Hidden Files and No-Match Behavior

By default, * does not match names beginning with a dot, so ls * skips hidden files like .bashrc. This is deliberate, since it keeps dotfiles out of everyday listings. For a listing that includes hidden files, use ls -A. In Bash, you can also enable dotglob so wildcard patterns include dotfiles.

Be careful with patterns such as .*, especially with destructive commands. Some shells can match . and .. with that pattern, which means “this directory” and “the parent directory.” For hidden file patterns in scripts, prefer a more specific pattern such as .[!.]* when it fits your case.

When a pattern matches nothing, the shell passes the literal pattern to the command, which often produces a “No such file or directory” error mentioning the raw * or ?. Bash can change this with shell options: shopt -s nullglob makes an unmatched pattern expand to nothing instead, and shopt -s failglob makes it an error. These are useful in scripts where an unexpanded pattern would cause a subtle bug.

Globbing Is Not Regular Expressions

Wildcards look like regular expressions but are a different, simpler system, and confusing the two leads to wrong results. The same characters mean different things:

In globbing, * means “any sequence of characters.” In a regular expression, * means “zero or more of the preceding character.”
In globbing, ? means “exactly one character.” In a regular expression, ? means “zero or one of the preceding character.”

So the glob *.txt and the regex .*\.txt describe the same idea in two different languages. Globbing applies to file name matching by the shell, while regular expressions are used by tools such as grep, sed, and awk to match text within files. See our guide on finding files in Linux for matching names with find, and on the grep command for matching text with regular expressions.

POSIX Character Classes

Inside the bracket syntax you can use named POSIX classes, which are clearer than ranges and adapt to locale. They are written as [[:class:]], and the common ones are [:digit:], [:alpha:], [:alnum:], [:upper:], [:lower:], and [:space:]. This matches any file whose name starts with a digit:

Terminal
ls [[:digit:]]*

The double brackets are required: the inner [:digit:] is the class, and the outer [...] is the bracket expression that contains it.

Extended Globbing

Bash offers more powerful patterns when you enable extended globbing with shopt -s extglob. These add grouping and quantifiers that resemble regular expressions. A pattern-list is one or more patterns separated with |, such as @(jpg|png):

?(pattern-list) - Matches zero or one occurrence.
*(pattern-list) - Matches zero or more.
+(pattern-list) - Matches one or more.
@(pattern-list) - Matches exactly one of the given patterns.
!(pattern-list) - Matches anything except the pattern.

For example, with extended globbing enabled, ls !(*.txt) lists every file that does not end in .txt, which is awkward to express otherwise:

Terminal
shopt -s extglob
ls !(*.txt)

If you use extended globs in a bash -c one-liner, enable extglob before the shell parses the line that contains the pattern. One simple approach is to start Bash with the option already enabled:

Terminal
bash -O extglob -c 'ls !(*.txt)'

Prevent Expansion with Quoting

Because the shell expands wildcards before the command runs, you must quote a pattern when you want the command to receive it literally. A tool like find does its own pattern matching, so you quote the pattern to stop the shell from expanding it first:

Terminal
find . -name "*.log"

Without the quotes, the shell would expand *.log against the current directory before find ever saw it, and find would search for the wrong names. Single quotes, double quotes, or a backslash before the wildcard all prevent globbing.

Quick Reference

Pattern or option	Meaning
`*`	Any sequence of characters, including none
`?`	Exactly one character
`[abc]`	One character from the set
`[a-z]`	One character in the range
`[!abc]`	One character not in the set
`[[:digit:]]`	One character in the POSIX class
`{a,b,c}`	Each listed string (brace expansion)
`{1..5}`	Each value in the range
`!(pattern-list)`	Anything but the pattern, with `extglob` enabled
`shopt -s nullglob`	Expand an unmatched pattern to nothing
`shopt -s failglob`	Treat an unmatched pattern as an error
`shopt -s dotglob`	Include dotfiles in wildcard matches

FAQ

What is the difference between a wildcard and globbing?
A wildcard is a special character such as * or ?. Globbing is the process the shell performs to expand a pattern containing wildcards into the list of matching file names before running the command.

Why does my wildcard match nothing or cause an error?
When no file matches, the shell passes the literal pattern to the command, which often reports “No such file or directory” with the raw * shown. Confirm the files exist, or set shopt -s nullglob so an unmatched pattern expands to nothing.

Is shell globbing the same as a regular expression?
No. They share characters but assign different meanings: in globbing * is any run of characters, while in regex * is zero or more of the previous character. Globbing matches file names; regex matches text inside files.

Why does * not match hidden files?
By design, * does not match names that begin with a dot, to keep dotfiles out of normal listings. Use ls -A for listings, enable shopt -s dotglob in Bash, or match them with a careful dotfile pattern such as .[!.]*.

Conclusion

Wildcards are patterns and globbing is the shell expanding them into real file names before a command runs, which is why the command never sees the * and why quoting changes the outcome. Keep wildcard syntax separate from regular expressions, preview expansions before destructive commands, and quote patterns whenever a tool should match them itself.

uniq Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 30 Jun 2026 17:30:00 +0200

Basic Syntax

Core uniq command forms.

Command	Description
`uniq file.txt`	Remove adjacent duplicate lines
`uniq input.txt output.txt`	Write filtered result to a file
`sort file.txt \| uniq`	Sort first so all duplicates are adjacent
`cat file.txt \| uniq`	Read from standard input
`uniq -z file.txt`	Use NUL as the line delimiter

Count and Filter

Count occurrences or isolate duplicate and unique lines.

Command	Description
`uniq -c file.txt`	Prefix each line with its occurrence count
`uniq -d file.txt`	Print only duplicated lines, one per group
`uniq -D file.txt`	Print every line of each duplicate group
`uniq -u file.txt`	Print lines without an adjacent duplicate
`sort file.txt \| uniq -c \| sort -rn`	Frequency count, most common first

Comparison Control

Change which part of each line is compared.

Command	Description
`uniq -i file.txt`	Ignore case when comparing
`uniq -f1 file.txt`	Skip the first field before comparing
`uniq -s5 file.txt`	Skip the first 5 characters
`uniq -w10 file.txt`	Compare only the first 10 characters
`uniq --group file.txt`	Show all lines, groups split by a blank line

Common Pipelines

Practical combinations with other commands.

Command	Description
`sort access.log \| uniq -c \| sort -rn \| head`	Most frequent log lines
`cut -d, -f1 data.csv \| sort \| uniq`	Unique values from a CSV column
`awk '{print $1}' access.log \| sort \| uniq -c`	Count requests per IP address
`sort emails.txt \| uniq -d`	Addresses that appear more than once
`sort words.txt \| uniq -u`	Words that appear exactly once

Troubleshooting

Quick checks for common uniq issues.

Issue	Check
Duplicates not removed	Lines must be adjacent; pipe through `sort` first
Case treated as different	Add `-i` to ignore case
Trailing spaces split groups	Normalize whitespace first (e.g. `sed 's/ *$//'`)
Fields skipped incorrectly	`-f` skips whitespace-separated fields, not delimiter columns
Count column hard to rank	Pipe `uniq -c` into `sort -rn` to order by frequency

Use these guides for full duplicate-handling and text-processing workflows.

Guide	Description
uniq Command in Linux	Full `uniq` guide with examples
sort Command in Linux	Sort lines so duplicates become adjacent
sort Cheatsheet	Quick reference for sorting options
wc Command in Linux	Count lines, words, and bytes
cut Command in Linux	Extract fields from text
awk Command in Linux	Field-based text processing

What Is /dev/null in Linux

hello@linuxize.com (Linuxize) — Tue, 30 Jun 2026 09:35:00 +0200

Read through almost any shell script or crontab and you will eventually find something like > /dev/null 2>&1 tacked onto the end of a command. It looks cryptic, but it is one of the most common patterns in Linux, and it does one simple thing: it throws output away. Understanding /dev/null clears up a whole class of these expressions at once.

This guide explains what /dev/null is and shows how to use it to silence command output and empty files.

What /dev/null Is

/dev/null is a special file known as the null device. It is not a regular file on disk, even though it lives in the filesystem at /dev/null. It is provided by the kernel and behaves in two ways:

Anything written to it is discarded. The data simply disappears, and the write reports success.
Anything read from it returns end-of-file immediately, so it acts as an empty source.

Because of this, /dev/null is often called the “black hole” of the system. It gives you a place to send output you do not care about, without writing it to a real file or printing it to the screen.

Reading from /dev/null

Reading from /dev/null immediately returns end-of-file. You can see that by counting how many bytes are available from it:

Terminal
wc -c < /dev/null

output

The command prints 0 because there is no input to read. This behavior is useful when a command expects input but you want to give it an empty stream. A common case is running a command inside a script that might otherwise pause to read from the keyboard. Pointing its standard input at /dev/null feeds it an immediate end-of-file so it never blocks:

Terminal
ssh user@host "uptime" < /dev/null

Here ssh reads from /dev/null instead of the script’s own input, so it cannot accidentally swallow lines meant for the rest of the script.

Discarding Standard Output

Every command can produce two streams: standard output (stdout) for normal results and standard error (stderr) for error messages. To throw away the normal output of a command while still seeing errors, redirect stdout to /dev/null:

Terminal
find / -name "*.log" > /dev/null

This runs the search but discards the list of matching files. Any “Permission denied” messages still appear on screen, because those go to stderr, which is untouched. The > operator on its own redirects stdout, which has the file descriptor number 1, so > /dev/null is the same as 1> /dev/null.

Discarding Standard Error

To do the opposite and hide only the error messages while keeping the normal output, redirect stderr, which is file descriptor 2:

Terminal
find / -name "*.log" 2> /dev/null

Now the matching files print normally, but the “Permission denied” noise from directories you cannot read is gone. This is a common way to clean up the output of commands that scan large parts of the filesystem.

Discarding Both Streams

When you want a command to run completely silently, send both streams to /dev/null. This is the > /dev/null 2>&1 pattern from the start of the article:

Terminal
command > /dev/null 2>&1

Reading it left to right: > /dev/null sends stdout to the null device, and 2>&1 then sends stderr to wherever stdout currently points, which is /dev/null. The order matters. If you reverse it to 2>&1 > /dev/null, stderr is pointed at the screen first, before stdout is redirected, so error messages still show up.

In the Bash shell there is a shorthand that redirects both streams at once:

Terminal
command &> /dev/null

This is the reason cron jobs so often end this way. A cron job that prints anything tends to generate an email to the owner, so silencing both streams keeps a routine job quiet. For a fuller look at how these streams work, see the guide on redirecting stderr and stdout in Bash .

Emptying a File

Because reading from /dev/null produces no data, you can use it as an empty source to truncate a file. Redirecting it into a file replaces the contents with nothing:

Terminal
cat /dev/null > app.log

The file app.log still exists, but it is now zero bytes. A shorter version uses an empty redirect, which has the same effect:

Terminal
> app.log

This is handy for clearing a log file that has grown too large without deleting and recreating it, which keeps the file’s permissions and any open file handles intact. For more ways to do this safely, see the guide on truncating files in Linux .

Quick Reference

Task	Command
Discard standard output	`command > /dev/null`
Discard standard error	`command 2> /dev/null`
Discard both streams, POSIX style	`command > /dev/null 2>&1`
Discard both streams in Bash	`command &> /dev/null`
Use an empty input stream	`command < /dev/null`
Empty a file with shell redirection	`> file`

FAQ

What does > /dev/null 2>&1 mean?
It discards all output from a command. > /dev/null sends standard output to the null device, and 2>&1 redirects standard error to the same place, so neither stream prints anything.

What is the difference between > /dev/null and 2> /dev/null?
> /dev/null discards standard output and leaves error messages visible. 2> /dev/null discards standard error and leaves normal output visible.

Is /dev/null a real file?
It is a special device file provided by the kernel, not a regular file on disk. Writing to it discards data, and reading from it returns end-of-file immediately.

Are /dev/zero and /dev/null the same?
No. /dev/null returns nothing when read, while /dev/zero returns an endless stream of null bytes. Both discard anything written to them, but only /dev/zero produces data on read.

Conclusion

/dev/null is the standard place to send output you do not want, whether that is silencing a noisy command, keeping a cron job quiet, or emptying a log file. Once the > /dev/null 2>&1 pattern makes sense, most of the redirection you see in scripts becomes easy to read.

Fix SSH "Host Key Verification Failed" Error

hello@linuxize.com (Linuxize) — Mon, 29 Jun 2026 09:30:00 +0200

You connect to a server you have used many times, and instead of a password or shell prompt SSH stops with a loud warning that the remote host identification has changed, followed by Host key verification failed. SSH blocks the session before authentication begins. It does this on purpose: it remembers the public key of every server you trust, and when the key it sees does not match the one it stored, it assumes something is wrong and blocks the connection to protect you.

This guide explains why the error happens, how to tell a routine change apart from a real warning sign, and how to clear the stale entry safely so you can connect again.

Quick Reference

For a printable quick reference, see the SSH cheatsheet .

Task	Command
Remove a host entry	`ssh-keygen -R hostname`
Remove by IP	`ssh-keygen -R 192.168.1.10`
Show the server’s new key fingerprint	`ssh-keyscan host \| ssh-keygen -lf -`
known_hosts file (user)	`~/.ssh/known_hosts`
known_hosts file (system)	`/etc/ssh/ssh_known_hosts`

What the Error Means

The full warning looks alarming, and it is meant to:

output

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!
Someone could be eavesdropping on you right now (man-in-the-middle attack)!
It is also possible that a host key has just been changed.
The fingerprint for the ED25519 key sent by the remote host is
SHA256:abc123....
Please contact your system administrator.
Add correct host key in /home/user/.ssh/known_hosts to get rid of this message.
Offending ED25519 key in /home/user/.ssh/known_hosts:14
Host key verification failed.

The first time you connect to a server, SSH records its public host key in ~/.ssh/known_hosts. On every later connection it compares the key the server presents against the saved one. When they differ, SSH refuses to continue and points to the exact line in known_hosts that no longer matches, here line 14.

The change is usually harmless and happens when:

The server was reinstalled or rebuilt, so it generated a new host key.
A cloud instance was destroyed and a new one took the same IP address.
You connect by an IP or name that now points to a different machine.

It can also, rarely, mean a real man-in-the-middle attack. That is why you should confirm the new key is expected before you remove the old one.

Warning

Do not blindly delete the entry on a server you do not control or were not expecting to change. If you cannot explain why the host key changed, treat the warning as genuine and verify the new fingerprint with the server’s administrator before connecting.

Verify the New Host Key

Before removing anything, check what key the server now offers and compare it to a trusted source. The ssh-keyscan command fetches the host key, and piping it to ssh-keygen -lf - prints its fingerprint:

Terminal
ssh-keyscan example.com | ssh-keygen -lf -

output

256 SHA256:abc123def456... example.com (ED25519)

Compare this fingerprint with one from a place you trust, such as your cloud provider’s console, the server’s setup output, or your administrator. If it matches, the change is legitimate and you can clear the old entry. If it does not, stop and investigate, since the warning may be real.

Remove the Stale Entry

The clean way to fix a confirmed key change is to remove only the offending entry with ssh-keygen -R. This works even when known_hosts uses hashed host names, and it leaves every other saved host untouched:

Terminal
ssh-keygen -R example.com

output

# Host example.com found: line 14
/home/user/.ssh/known_hosts updated.
Original contents retained as /home/user/.ssh/known_hosts.old

If you connect to the server by IP address as well as by name, remove that entry too:

Terminal
ssh-keygen -R 192.168.1.10

Now reconnect. SSH no longer has a saved key for the host, so it asks you to confirm the new one:

Terminal
ssh user@example.com

output

The authenticity of host 'example.com (192.168.1.10)' can't be established.
ED25519 key fingerprint is SHA256:abc123def456....
Are you sure you want to continue connecting (yes/no/[fingerprint])?

Confirm that the fingerprint matches the one you verified earlier, then type yes. SSH saves the new key and connects normally from now on.

Editing known_hosts by Hand

You can also open ~/.ssh/known_hosts and delete the exact line named in the error, which was line 14 in the example above. This is fine when host names are stored in plain text, but many systems hash them for privacy, so the line will not be human readable. For that reason ssh-keygen -R is the more reliable choice, since it finds and removes the right entry regardless of hashing.

Troubleshooting

The error returns after removing the entry
You likely connect by both a host name and an IP address, and only one entry was removed. Run ssh-keygen -R for each form you use, then reconnect.

A system-wide entry is the problem
The matching key lives in /etc/ssh/ssh_known_hosts, not your personal file. Edit that file with sudo, or remove the entry with sudo ssh-keygen -f /etc/ssh/ssh_known_hosts -R hostname.

The fingerprint does not match what you expected
Do not connect. A mismatch you cannot explain may indicate interception. Confirm the correct key with the server’s administrator or your provider’s console first.

The new connection still fails after accepting the key
This is a different problem, usually authentication rather than the host key. See our guide on fixing SSH Permission denied (publickey) .

FAQ

What is the known_hosts file?
It is the list of server public keys your SSH client has accepted, stored in ~/.ssh/known_hosts. SSH compares each server against this list and warns you when a key changes. The ~/.ssh folder guide covers every file it contains.

Is it safe to delete the known_hosts entry?
Yes, once you have confirmed the new host key is genuine. Removing it only makes SSH ask you to trust the server again. Do not remove it blindly on a host whose change you cannot explain.

Why did the host key change?
The most common reasons are a server reinstall, a rebuilt cloud instance, or an IP address now used by a different machine. Each of these produces a new host key, which triggers the warning.

How do I check a server’s host key fingerprint?
Run ssh-keyscan host | ssh-keygen -lf - and compare the fingerprint with a trusted source such as your provider’s console or the server’s setup logs.

Conclusion

The Host key verification failed error is SSH refusing to connect because a server’s key no longer matches the one it saved. Verify the new fingerprint, then remove the stale entry with ssh-keygen -R and reconnect to trust the new key. For broader protection of your SSH access, see our guide on SSH hardening best practices .

Hard Links vs Symbolic Links in Linux

hello@linuxize.com (Linuxize) — Sun, 28 Jun 2026 09:20:00 +0100

Linux gives you two ways to make a file accessible under more than one name: hard links and symbolic links. They look similar in a directory listing, and both are created with the ln command, but they work in fundamentally different ways. Choosing the wrong one leads to surprises, such as a link that breaks when you move a file, or a “copy” that still takes up space after you delete the original. Understanding what each link actually points to makes the choice obvious.

This guide explains how hard links and symbolic links differ, what an inode is, when each type breaks, and which one to reach for in common situations.

What an Inode Is

To see the difference, you first need to know how Linux stores a file. Every file’s data is tracked by an inode, a structure that holds the metadata (permissions, owner, size, timestamps) and the location of the data on disk. The file name you see is not the file itself; it is a directory entry that points to an inode. The inode, in turn, points to the data.

This separation is the whole story. A hard link is another directory entry pointing at the same inode. A symbolic link is a small file of its own that contains a path to another name.

You can see inode numbers with ls -i:

Terminal
ls -i document.txt

output

1572881 document.txt

The number on the left is the inode. Two names that share an inode number are the same file. For a closer look at inodes, including what happens when a filesystem runs out of them, see what an inode is in Linux .

Hard Links

A hard link is an additional name for an existing inode. Both names are equal; neither is the “original.” Create one by passing the existing file and the new name to ln with no options:

Terminal
ln document.txt backup.txt

Now list both with ls -li to see what happened:

Terminal
ls -li document.txt backup.txt

output

1572881 -rw-r--r-- 2 dejan dejan 102 Jan 1 09:00 backup.txt
1572881 -rw-r--r-- 2 dejan dejan 102 Jan 1 09:00 document.txt

Both names share inode 1572881, so they are the same file viewed through two directory entries. The number 2 after the permissions is the link count: the inode now has two names. Editing through either name changes the same data, because there is only one set of data.

Because both names are equal, deleting one does not remove the file. The data survives until the link count reaches zero:

Terminal
rm document.txt

After this, backup.txt still contains everything, and the link count drops to 1. The file is only freed when its last name is removed.

Hard links have two firm limits that come from how inodes work:

They cannot cross filesystems. An inode number is only meaningful within one filesystem, so a hard link and its target must live on the same filesystem.
They cannot link directories. Allowing this would let you create loops in the directory tree, so the kernel forbids it for ordinary users.

Symbolic Links

A symbolic link, also called a symlink or soft link, is a separate small file that holds the path to another file or directory. It has its own inode, and its contents are simply the target path. Create one by adding the -s option to ln:

Terminal
ln -s report.txt shortcut.txt

List it with ls -li:

Terminal
ls -li report.txt shortcut.txt

output

1572895 -rw-r--r-- 1 dejan dejan 102 Jan 1 09:00 report.txt
1572902 lrwxrwxrwx 1 dejan dejan 10 Jan 1 09:05 shortcut.txt -> report.txt

The symlink has a different inode (1572902), the type field starts with l for link, and the listing shows where it points with the -> arrow. When you open shortcut.txt, the kernel follows the stored path to report.txt and works with that file.

Because a symlink only stores a path, it is far more flexible than a hard link:

It can point across filesystems, since it holds a path rather than an inode number.
It can point to a directory, which is how most “shortcut to a folder” setups work.

The trade-off is that a symlink depends on its target existing. If you remove or rename report.txt, the symlink still points to the old path and becomes a dangling link:

Terminal
rm report.txt
cat shortcut.txt

output

cat: shortcut.txt: No such file or directory

The error comes from the missing target, not from the link being removed. You can still see the dangling symlink with ls -l:

Terminal
ls -l shortcut.txt

output

lrwxrwxrwx 1 dejan dejan 10 Jan 1 09:05 shortcut.txt -> report.txt

The link is still there, but it points to nothing. Moving the target breaks a symlink in the same way, while a hard link is unaffected because it does not depend on a path.

Key Differences

The table below summarizes how the two types compare:

Property	Hard link	Symbolic link
Points to	The same inode (the data)	A path to another name
Own inode	No, shares the target’s	Yes, separate inode
Cross filesystems	No	Yes
Link to a directory	No	Yes
Survives deleting the target	Yes, data persists	No, becomes a dangling link
Survives moving the target	Yes	No, the stored path breaks
Create with	`ln target name`	`ln -s target name`

Which One to Use

Reach for a symbolic link in most everyday cases. Linking to a directory, pointing to a file on another disk, or creating a shortcut whose target may be replaced later all require a symlink, and the visible -> target makes the relationship easy to understand. The current versions of configuration files and the entries under /etc/alternatives are managed with symlinks for exactly these reasons.

Choose a hard link when you want two names that are truly the same file on one filesystem and you want the data to survive even if one name is removed. Backup and snapshot tools use hard links to make multiple directory trees share unchanged files without storing the data twice, which is efficient because the bytes exist only once.

FAQ

What is the main difference between a hard link and a symbolic link?
A hard link is another name for the same inode and shares the file’s data directly. A symbolic link is a separate file that stores a path to another name. Deleting the target keeps a hard link working but breaks a symbolic link.

Why can I not create a hard link across two disks?
A hard link points to an inode number, which is only unique within a single filesystem. A target on another filesystem has no meaningful inode in the first filesystem, so the kernel rejects the hard link. Use a symbolic link instead.

How do I tell whether a file is a symlink?
Run ls -l. A symbolic link’s permission string starts with l and the listing shows the target after a -> arrow. A hard link looks like an ordinary file, but ls -li reveals it shares an inode number with its other names.

What happens to a hard link when I delete the original?
Nothing is lost. The two names are equal, so removing one only decreases the link count. The data is freed only when the last name pointing to the inode is removed.

Conclusion

The difference comes down to what each link points to: a hard link is another name for the same inode and its data, while a symbolic link is a pointer to a path that can break. Use symlinks for directories, cross-disk references, and shortcuts, and use hard links when you want identical, persistent names for one file on a single filesystem. For the commands themselves, see our guide on creating symbolic links with ln and on removing symbolic links .

How to Install NVIDIA CUDA Toolkit on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Sat, 27 Jun 2026 09:35:00 +0100

When you want to train models, compile GPU code, or run local AI tools on Ubuntu, the NVIDIA driver alone is not always enough. Development tools and many build workflows also need the NVIDIA CUDA Toolkit, which provides the nvcc compiler, CUDA libraries, profiling tools, and headers used by PyTorch, TensorFlow, llama.cpp, ComfyUI, and other GPU-aware software.

This guide explains how to install the CUDA Toolkit on Ubuntu 26.04 using two methods: the Ubuntu archive package, which is the simplest path for casual use, and the NVIDIA developer repository, which provides the latest CUDA release and matching drivers.

Quick Reference

Task	Command
Check for an NVIDIA GPU	`lspci
Install from Ubuntu archive	`sudo apt install nvidia-cuda-toolkit`
Install Ubuntu-recommended driver	`sudo ubuntu-drivers install`
Download NVIDIA keyring	`wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64/cuda-keyring_1.1-1_all.deb`
Add NVIDIA CUDA repository	`sudo dpkg -i cuda-keyring_1.1-1_all.deb`
Install latest NVIDIA toolkit	`sudo apt install cuda-toolkit`
Pin CUDA 13.3 toolkit	`sudo apt install cuda-toolkit-13-3`
Install NVIDIA repository driver	`sudo apt install cuda-drivers`
Check driver and GPU	`nvidia-smi`
Check toolkit compiler	`nvcc --version`

Prerequisites

Before installing CUDA, make sure you have:

A server or workstation running Ubuntu 26.04 with a user with sudo privileges .
A supported NVIDIA GPU. For CUDA 13.3, use a Turing, Ampere, Ada, Hopper, Blackwell, or newer GPU when you need full library support. Older Maxwell, Pascal, and Volta cards may require an older CUDA release.
Several gigabytes of free disk space. A full Toolkit install uses around 6 to 8 GB.
Secure Boot disabled, or a plan to enroll a Machine Owner Key. The proprietary NVIDIA driver does not load when Secure Boot is enabled and the kernel module is unsigned.

Confirm that the system sees an NVIDIA GPU before going further:

Terminal
lspci | grep -i nvidia

output

01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)
01:00.1 Audio device: NVIDIA Corporation GA106 High Definition Audio Controller (rev a1)

The output should list at least one VGA or 3D controller from NVIDIA. If nothing appears, the GPU is not seated correctly, the slot is disabled in the BIOS, or the card is not supported by the host.

Choosing an Install Method

Ubuntu offers two practical install methods.

The Ubuntu archive ships nvidia-cuda-toolkit as a regular apt package. The version lags behind upstream, but the package integrates with Ubuntu’s update flow and uses the same NVIDIA driver Ubuntu provides.

The NVIDIA repository provides the latest CUDA release, including features and library versions that the Ubuntu archive does not have yet. It can also install the matching driver via the cuda-drivers meta-package. Use this method when you need the newest CUDA release for PyTorch, TensorFlow, or other frameworks pinned to a specific CUDA version.

The two methods are mutually exclusive. Mixing packages from both sources can produce conflicting library paths and broken nvcc lookups. If you switch methods later, remove the old toolkit packages first.

Method 1: Install CUDA from the Ubuntu Archive

Update the package index and install the toolkit:

Terminal
sudo apt update
sudo apt install nvidia-cuda-toolkit

The nvidia-cuda-toolkit package pulls in the compiler, libraries, and headers from the Ubuntu archive. Next, inspect the NVIDIA driver choices for your GPU:

Terminal
ubuntu-drivers devices

The exact driver number depends on your GPU and the Ubuntu archive at install time. Look for the line marked recommended, then install it automatically:

Terminal
sudo ubuntu-drivers install

Reboot once the install finishes so the kernel loads the NVIDIA driver in place of the open-source nouveau driver:

Terminal
sudo reboot

After the system comes back up, jump to the verification section to confirm the driver and toolkit work.

Method 2: Install CUDA from the NVIDIA Repository

The NVIDIA repository is the right choice when you need the latest CUDA release. The setup is two steps: install the repository keyring, then install the toolkit and drivers from the new repository.

Install the CUDA Keyring

NVIDIA distributes a small .deb package that adds the repository definition and signing key to apt. For Ubuntu 26.04 on x86_64, download and install the ubuntu2604 keyring package:

Terminal
wget https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2604/x86_64/cuda-keyring_1.1-1_all.deb
sudo dpkg -i cuda-keyring_1.1-1_all.deb

The keyring package writes /etc/apt/sources.list.d/cuda-ubuntu2604-x86_64.list and installs the GPG key apt uses to verify the repository.

Install the Toolkit and Driver

Refresh the package index and install the toolkit. At publication time, the NVIDIA Ubuntu 26.04 repository publishes CUDA Toolkit 13.3:

Terminal
sudo apt update
sudo apt install cuda-toolkit

The cuda-toolkit meta-package follows the latest CUDA release in the repository. To stay on CUDA 13.3 and avoid automatic movement to the next minor release, install the versioned package instead:

Terminal
sudo apt install cuda-toolkit-13-3

Install the matching driver. The cuda-drivers meta-package always pulls in the version paired with the installed toolkit:

Terminal
sudo apt install cuda-drivers

Reboot so the kernel loads the new driver:

Terminal
sudo reboot

Configure Environment Variables

The NVIDIA repository installs CUDA under /usr/local/cuda. Add the toolkit binaries to your shell PATH so nvcc is available from a new terminal. Append the following line to ~/.bashrc:

~/.bashrcsh
export PATH=/usr/local/cuda/bin${PATH:+:${PATH}}

Reload the shell so the changes take effect:

Terminal
source ~/.bashrc

The Ubuntu archive package places binaries in /usr/bin and libraries in standard system paths, so this step is not needed for Method 1.

Verify the Install

Confirm that the driver loaded and the GPU is visible:

Terminal
nvidia-smi

output

+-----------------------------------------------------------------------------------------+
| NVIDIA-SMI 610.43.02 Driver Version: 610.43.02 CUDA Version: 13.3 |
+-----------------------------------------------+----------------------+------------------+
| GPU Name Persistence-M | Bus-Id Disp.A | Volatile Uncorr. ECC |
| Fan Temp Perf Pwr:Usage/Cap | Memory-Usage | GPU-Util Compute M. |
|=========================================+======================+========================|
| 0 NVIDIA GeForce RTX 3060 Off | 00000000:01:00.0 Off | N/A |
| 0% 38C P8 13W / 170W | 8MiB / 12288MiB | 0% Default |
+-----------------------------------------+----------------------+------------------------+

The output shows the GPU model, driver version, and the CUDA version that the driver supports. The driver-reported CUDA version is the maximum runtime version the driver can load; the installed toolkit can be the same or older.

Check the toolkit compiler:

Terminal
nvcc --version

output

nvcc: NVIDIA (R) Cuda compiler driver
Copyright (c) 2005-2026 NVIDIA Corporation
Cuda compilation tools, release 13.3, V13.3.33

The release line is the toolkit version installed on the system. For CUDA-aware applications, this is the version that matters at compile time.

Run a CUDA Sample

The fastest way to confirm the GPU runs CUDA workloads is the deviceQuery sample. The samples now build with CMake, so install Git, CMake, and build tools, then clone the official samples repository, build the deviceQuery target, and run it from the build tree:

Terminal
sudo apt install git build-essential cmake
git clone --depth 1 https://github.com/NVIDIA/cuda-samples.git
cd cuda-samples
cmake -B build
cmake --build build --target deviceQuery -j$(nproc)
./build/Samples/1_Utilities/deviceQuery/deviceQuery

output

./deviceQuery Starting...
CUDA Device Query (Runtime API) version (CUDART static linking)
Detected 1 CUDA Capable device(s)
Device 0: "NVIDIA GeForce RTX 3060"
CUDA Driver Version / Runtime Version 13.3 / 13.3
CUDA Capability Major/Minor version number: 8.6
Total amount of global memory: 12288 MBytes
...
Result = PASS

A PASS result confirms the toolkit, driver, and GPU work together end-to-end. Frameworks such as PyTorch and TensorFlow rely on the same runtime that this sample exercises, so a passing deviceQuery is a strong signal that machine-learning workloads will run.

Troubleshooting

nvidia-smi reports “No devices were found”
The driver is not loaded. Run lsmod | grep nvidia. If nothing is listed, check the Secure Boot state with mokutil --sb-state. Disable Secure Boot in the BIOS or enroll a Machine Owner Key for the NVIDIA kernel module, then reboot.

nouveau driver still loaded
The open-source nouveau driver conflicts with the NVIDIA driver. Confirm with lsmod | grep nouveau. Blacklist it by creating /etc/modprobe.d/blacklist-nouveau.conf with the lines blacklist nouveau and options nouveau modeset=0, then run sudo update-initramfs -u and reboot.

nvcc not found after install from the NVIDIA repository
The PATH does not include /usr/local/cuda/bin. Add the export line from the environment variables section to ~/.bashrc and run source ~/.bashrc. Verify the binary is on disk with ls /usr/local/cuda/bin/nvcc.

Driver fails to build after a kernel upgrade
The DKMS module needs the matching kernel headers. Install them with sudo apt install linux-headers-$(uname -r), then reinstall the driver package. For the NVIDIA repository method, run sudo apt install --reinstall cuda-drivers. Reboot once the build completes.

CUDA version mismatch errors from PyTorch or TensorFlow
Frameworks ship binaries built against a specific CUDA version. The CUDA version reported by nvidia-smi is the maximum runtime the driver supports. Pick the framework build whose CUDA version is less than or equal to that value.

Out of disk space during install
The full toolkit is large. Free space in /var/cache/apt with sudo apt clean, or install only the components you need by replacing cuda-toolkit with smaller meta-packages such as cuda-compiler-13-3 and cuda-libraries-dev-13-3.

Conclusion

A working CUDA install gives Ubuntu 26.04 the GPU compute stack needed by PyTorch, TensorFlow, llama.cpp, and similar tools. Pin the toolkit version when you build software against a specific CUDA release, and rerun nvidia-smi after every kernel upgrade to make sure the driver still loads.

How to Check if a Command Exists in Bash

hello@linuxize.com (Linuxize) — Fri, 26 Jun 2026 09:25:00 +0200

Scripts often depend on tools such as git, curl, jq, or docker. If one of those commands is missing, Bash usually fails later with command not found, which can be hard to diagnose if the script has already created files, changed directories, or started a deployment step.

A small dependency check at the top of the script gives you a cleaner failure path. You can print a useful error, exit with a non-zero status, or install the missing package in setup scripts that are meant to manage the local machine.

This guide shows the reliable command -v pattern, how to capture the resolved path, and when alternatives such as type, hash, and which make sense.

Recommended Check: command -v

For scripts, the safest default is to run command -v and test its exit status:

sh
if command -v git >/dev/null 2>&1; then
 echo "git is available"
else
 echo "git is not installed" >&2
 exit 1
fi

command -v NAME exits with status 0 when the shell can resolve NAME as a command. If the name is not found, it exits with a non-zero status. Redirecting both stdout and stderr to /dev/null hides the resolved path or lookup message, so the check stays quiet unless you print your own error.

In Bash, command -v can find executables on PATH, shell builtins, functions, and shell keywords. It may also report aliases in shells where alias expansion is enabled, but scripts should not treat aliases as required dependencies. Check for the actual command your script will run.

Capture the Path

When you need the resolved command path later in the script, assign the output inside the if condition:

sh
if git_bin=$(command -v git); then
 echo "git found at: $git_bin"
else
 echo "git is required but was not found" >&2
 exit 1
fi

For external programs, the variable contains the path that Bash found through PATH, such as /usr/bin/git. For builtins and functions, command -v may return the command name instead of a filesystem path.

This pattern keeps the check and the assignment tied together. Avoid assigning first and checking only whether the variable is non-empty, because the exit status tells you exactly whether the lookup succeeded.

Check Multiple Commands

When a script depends on several external programs, validate all of them before doing any work. In a Bash script, an array keeps the command list clear:

sh
required_commands=(git curl jq)
missing_commands=()

for cmd in "${required_commands[@]}"; do
 if ! command -v "$cmd" >/dev/null 2>&1; then
 missing_commands+=("$cmd")
 fi
done

if ((${#missing_commands[@]} > 0)); then
 printf 'Error: missing required commands: %s\n' "${missing_commands[*]}" >&2
 exit 1
fi

The loop records every missing command, then prints them on a single stderr line with >&2. The ${missing_commands[*]} expansion joins the names with a space, so all missing dependencies appear in one message. Exiting before the main work begins prevents partial runs and gives callers a clear failure status. For more on exit values, see the Bash exit code guide .

Install a Missing Command

For local setup scripts, you may want to install a dependency when it is missing. On Ubuntu, Debian, and derivatives, the pattern looks like this:

sh
if ! command -v jq >/dev/null 2>&1; then
 echo "jq not found, installing..."
 sudo apt update
 sudo apt install -y jq
fi

Use auto-install logic only in scripts where changing the system is expected, such as a bootstrap script for a development machine or server. For general-purpose scripts, print the missing dependency and let the user decide how to install it.

Alternative: type

type is a Bash builtin that shows how a command name will be interpreted:

sh
if type git >/dev/null 2>&1; then
 echo "git is available"
fi

This behaves similarly to command -v for a basic existence check, but type is mainly useful when you want explanation output for a person. For example, it can show whether a name is a builtin, function, alias, keyword, or executable file.

If you specifically need an executable file on PATH in Bash, use type -P:

sh
if type -P git >/dev/null 2>&1; then
 echo "git executable found"
fi

The type command is useful for debugging shell name resolution. For a deeper look at its options, see the type command guide .

Alternative: hash

hash is another Bash builtin that can resolve command names and remember executable paths in the shell’s hash table:

sh
if hash git 2>/dev/null; then
 echo "git is available"
fi

This can work for quick Bash-only checks, but it is less clear than command -v and is not the best general-purpose pattern. Do not use hash -t name as the first lookup, because -t prints an entry only after the command has already been hashed in the current shell.

Use command -v unless you specifically need to inspect or manage Bash’s command hash table.

Why Not which

which is common in interactive terminal use, but it is not the best choice inside scripts:

sh
# Avoid this in scripts
if which git >/dev/null 2>&1; then
 echo "git found"
fi

Unlike command -v, which is usually an external program and is not standardized by POSIX. Its behavior and output can vary between systems, and it may not reflect Bash functions, builtins, or aliases the same way the shell does.

Use which when you are typing at a prompt and only want a quick path lookup. Use command -v when the result controls script logic.

Quick Reference

Task	Pattern
Check whether a command exists	`command -v name >/dev/null 2>&1`
Check and branch	`if command -v name >/dev/null 2>&1; then ... fi`
Capture the resolved path	`if name_bin=$(command -v name); then ... fi`
Check several commands in Bash	`for c in git curl jq; do command -v "$c"; done`
Print dependency errors	`echo "missing command" >&2`
Check for an executable file in Bash	`type -P name >/dev/null 2>&1`
Avoid for script logic	`which name`

Conclusion

Use command -v at the start of Bash scripts that depend on external programs, then fail early with a clear stderr message when a dependency is missing. For broader script guardrails, see our Bash best practices guide.

setuid, setgid, and the Sticky Bit Explained

hello@linuxize.com (Linuxize) — Thu, 25 Jun 2026 18:40:00 +0200

The familiar read, write, and execute permissions cover most of what you do with files, but Linux has three more permission bits that change how programs run and how shared directories behave. They explain why an ordinary user can change their own password with a tool owned by root, why files created in a team directory all share the same group, and why anyone can write to /tmp yet cannot delete another user’s files there. These are the setuid, setgid, and sticky bits.

This guide explains what each special permission does on files and on directories, how to set and read them, and the security points to keep in mind.

Where the Special Bits Fit

A file’s mode has three groups of permissions, for the owner, the group, and others, each with read, write, and execute. The special bits sit alongside them and are shown inside the same execute positions. In a numeric chmod value they form a fourth leading digit:

4 - setuid
2 - setgid
1 - sticky bit

So chmod 4755 sets setuid plus 755, and chmod 2770 sets setgid plus 770. You can also set them symbolically with u+s, g+s, and +t, which is often clearer.

The setuid Bit

The setuid (“set user ID”) bit applies to executable files. Normally a program runs with the privileges of the user who starts it. When the setuid bit is set, the program instead runs with the privileges of the file’s owner. The classic example is passwd, which is owned by root because it must write to /etc/shadow, a file ordinary users cannot touch:

Terminal
ls -l /usr/bin/passwd

output

-rwsr-xr-x 1 root root 68208 Jan 1 09:00 /usr/bin/passwd

The s in the owner’s execute position (where you would expect x) is the setuid bit. Because the file is owned by root and carries setuid, any user who runs passwd does so with root privileges for the duration of that command, which is what lets them update their own entry in a protected file.

Set the bit on a file with either form:

Terminal
sudo chmod u+s program
sudo chmod 4755 program

If the file does not also have the execute bit set, the listing shows a capital S instead of s, which signals setuid without execute and is usually a mistake.

The setgid Bit

The setgid (“set group ID”) bit behaves differently depending on whether it is set on a file or a directory, and the directory case is the more useful of the two.

On an executable file, setgid works like setuid but for the group: the program runs with the file’s group privileges rather than the caller’s.

On a directory, setgid changes how new files inside it are owned. Normally a new file takes the primary group of the user who created it. With setgid set on the directory, every new file and subdirectory instead inherits the directory’s group, and new subdirectories also keep the setgid bit.

This is the standard way to set up a shared project folder where everything created should belong to one team group. Assuming the developers group already exists, you can assign the directory to that group and set the bit like this:

Terminal
sudo chgrp developers /srv/project
sudo chmod 2775 /srv/project
ls -ld /srv/project

output

drwxrwsr-x 2 root developers 4096 Jan 1 09:00 /srv/project

The s in the group’s execute position is the setgid bit. From now on, new files that members create in /srv/project inherit the developers group automatically, so the team does not have to fix group ownership by hand. Group write access still depends on the file mode, the user’s umask, or a default ACL, so set those defaults to match how the team works. Set the bit symbolically with chmod g+s /srv/project.

The Sticky Bit

The sticky bit applies to directories. When it is set, a user may only delete or rename a file inside the directory if they own that file (or own the directory, or are root), even when the directory itself is world-writable. The canonical example is /tmp, where every user needs to create files but no user should be able to remove another’s:

Terminal
ls -ld /tmp

output

drwxrwxrwt 10 root root 4096 Jan 1 09:00 /tmp

The t in the others’ execute position is the sticky bit. Without it, a world-writable directory would let any user delete any file in it, since delete permission depends on the directory, not the file. The sticky bit closes that gap. Set it on a shared directory with either form:

Terminal
sudo chmod +t /shared/dropbox
sudo chmod 1777 /shared/dropbox

As with the other bits, a capital T appears instead of t when the directory lacks the others-execute permission.

Reading the Bits in ls Output

Each special bit reuses an execute slot in the permission string, so you read them by position:

setuid replaces the owner’s x, shown as s (or S without execute).
setgid replaces the group’s x, shown as s (or S without execute).
sticky replaces the others’ x, shown as t (or T without execute).

A lowercase letter means the underlying execute permission is also set; an uppercase letter means it is not. To find setuid programs across the system, use find with a -perm test, for example sudo find / -perm -4000 -type f -print.

Quick Reference

For a printable quick reference to chmod modes, see the chmod cheatsheet .

Bit	Symbolic	Numeric	Applies to	Effect
setuid	`u+s`	`4`	Executable files	Runs with the file owner’s privileges
setgid	`g+s`	`2`	Files and directories	File: runs with the file’s group. Directory: new files inherit the directory’s group
sticky	`+t`	`1`	Directories	Only the file owner can delete or rename files in the directory

Security Notes

Setuid and setgid are powerful, and a setuid-root program is a common target for attackers, because a flaw in it can hand over root privileges. Keep these points in mind:

Set setuid or setgid only on programs that genuinely need it, and prefer well-audited system tools over custom scripts.
The Linux kernel ignores the setuid and setgid bits on shell scripts, so you cannot make a script run as another user this way. Use sudo rules instead.
Audit the setuid programs on a system periodically with sudo find / -perm -4000 -type f -print and investigate anything unexpected.

Warning

Never set the setuid bit on a file just to work around a permission error. A setuid-root binary that you do not fully control is a serious privilege-escalation risk. When a user needs to run one specific command with higher privileges, configure that in /etc/sudoers rather than marking a program setuid.

FAQ

What does the setuid bit do? It makes an executable run with the privileges of the file’s owner rather than the user who starts it. A setuid-root program such as passwd runs as root, which lets ordinary users perform a tightly scoped privileged action.

What is the difference between setgid on a file and on a directory? On a file, setgid runs the program with the file’s group privileges. On a directory, it makes new files and subdirectories inherit the directory’s group instead of the creator’s primary group, which is how shared team folders keep a consistent group.

Why am I unable to delete a file in /tmp that I do not own? The sticky bit is set on /tmp. In a directory with the sticky bit, only the owner of a file (or the directory owner or root) may delete or rename it, even though the directory is writable by everyone.

Does setuid work on shell scripts? No. The kernel ignores setuid and setgid on scripts for security reasons. To let a user run a script with higher privileges, grant that command through sudo configuration instead.

Conclusion

The setuid, setgid, and sticky bits extend the standard permission model to control how programs run and how shared directories behave. Use setuid and setgid sparingly and only on trusted programs, lean on setgid directories and the sticky bit for safe shared spaces, and reach for sudo rather than setuid scripts. For the underlying permission model, see our guide on Linux file permissions and the chmod command .

GitHub CLI: Manage Repositories, Issues, and Pull Requests

hello@linuxize.com (Linuxize) — Wed, 24 Jun 2026 10:10:00 +0200

Switching between a terminal and a browser can slow down routine GitHub work. You may only need to create a pull request, check a workflow failure, or open an issue, but each task normally requires finding the right page and clicking through several screens.

GitHub CLI, available through the gh command, brings these operations into your terminal. It works with repositories, pull requests, issues, releases, GitHub Actions, and the GitHub API. This guide covers the commands you will use most often in a local Git workflow.

GitHub CLI Command Syntax

The general syntax for gh commands is:

txt
gh COMMAND SUBCOMMAND [FLAGS]

Most commands work against the repository in the current directory. To target another repository, use --repo OWNER/REPOSITORY with commands that support it.

Install GitHub CLI

On Ubuntu, Debian, and derivatives, update the package index and install the gh package:

Terminal
sudo apt update
sudo apt install gh

On Fedora, RHEL, and derivatives, install it with dnf:

Terminal
sudo dnf install gh

Confirm that the command is available:

Terminal
gh --version

output

gh version 2.95.0 (2026-06-17)
https://github.com/cli/cli/releases/tag/v2.95.0

Your version may differ from the example. If the command prints a version number, the installation is ready.

Authenticate with GitHub

Before gh can access your repositories, authenticate with your GitHub account:

Terminal
gh auth login

The interactive prompt asks which GitHub host you use, whether Git should connect over HTTPS or SSH, and how you want to authenticate. For GitHub.com, the web browser method is usually the simplest option.

Check the active account and authentication scopes with:

Terminal
gh auth status

output

github.com
✓ Logged in to github.com account octocat
- Active account: true
- Git operations protocol: ssh
- Token scopes: 'gist', 'read:org', 'repo', 'workflow'

If you use GitHub Enterprise Server, pass its hostname:

Terminal
gh auth login --hostname github.example.com

For CI jobs and other non-interactive environments, gh can read a token from the GH_TOKEN or GITHUB_TOKEN environment variable.

Warning

Do not place access tokens directly in shell scripts or commit them to a repository. Store them in your CI secret manager or another protected environment variable source.

Work with Repositories

To clone a repository, pass its OWNER/REPOSITORY name:

Terminal
gh repo clone cli/cli

This runs the appropriate Git clone operation using the authentication and protocol configured for your account.

From inside a local repository, display its description, default branch, and README with:

Terminal
gh repo view

Open the current repository in your browser by adding --web:

Terminal
gh repo view --web

You can also create a GitHub repository from an existing local project. Run the following command from the project directory:

Terminal
gh repo create my-project --private --source=. --remote=origin --push

The options perform the following actions:

--private - Creates a private repository. Use --public when the repository should be public.
--source=. - Uses the current directory as the repository source.
--remote=origin - Adds the new GitHub repository as the origin remote.
--push - Pushes the local commits after creating the repository.

Before using --push, check the files that are about to be published with git status and confirm that secrets, local configuration, and generated files are excluded through .gitignore.

Manage Pull Requests

List open pull requests for the current repository with:

Terminal
gh pr list

output

Showing 2 of 2 open pull requests in owner/project
ID TITLE BRANCH CREATED AT
#42 Add health check endpoint feature/health about 2 hours ago
#38 Update deployment docs docs/deployment about 3 days ago

To create a pull request from the current branch, use:

Terminal
gh pr create

GitHub CLI prompts for the title, body, base branch, and other details. If the branch commits already contain a useful title and description, use --fill:

Terminal
gh pr create --fill

To create a draft pull request and request a reviewer in one command:

Terminal
gh pr create --fill --draft --reviewer octocat

View the pull request associated with the current branch:

Terminal
gh pr view

Add --web to open it in the browser, or specify a pull request number when it is not associated with your current branch:

Terminal
gh pr view 42 --web

To check out a contributor’s pull request locally:

Terminal
gh pr checkout 42

Review its changes and status checks before merging:

Terminal
gh pr diff 42
gh pr checks 42

If the pull request is ready, merge it with a merge commit, squash commit, or rebase:

Terminal
gh pr merge 42 --squash

The merge command changes the remote repository, so review the diff and checks first.

Manage Issues

List open issues in the current repository:

Terminal
gh issue list

You can filter by label, assignee, or search query. The following command shows open bug reports assigned to you:

Terminal
gh issue list --label bug --assignee @me

Create an issue interactively with:

Terminal
gh issue create

For a quick issue with a known title and body, provide both values directly:

Terminal
gh issue create \
 --title "Deployment fails when the cache is empty" \
 --body "The deployment job exits during the cache restore step."

View an issue in the terminal:

Terminal
gh issue view 27

When the issue has been resolved, close it with an optional comment:

Terminal
gh issue close 27 --comment "Fixed in pull request #42."

Inspect GitHub Actions Runs

GitHub CLI can list workflow runs without opening the Actions page:

Terminal
gh run list

output

STATUS TITLE WORKFLOW BRANCH EVENT ID
X Add health check endpoint CI feature pull 123456789
✓ Update deployment docs CI main push 123450001

Inspect a specific run by passing its ID:

Terminal
gh run view 123456789

For a failed run, show only the logs for failed steps:

Terminal
gh run view 123456789 --log-failed

Watch a running workflow until it completes:

Terminal
gh run watch 123456789

If a workflow supports the workflow_dispatch event, start it manually with:

Terminal
gh workflow run build.yml

Use gh run rerun 123456789 --failed when you need to retry only the failed jobs from an existing run.

Create and Download Releases

To create a release from an existing Git tag and generate notes from merged pull requests:

Terminal
gh release create v1.0.0 --generate-notes

If the tag does not exist, GitHub CLI creates it from the repository’s default branch unless you provide another target with --target.

List existing releases with:

Terminal
gh release list

Download all assets attached to a release:

Terminal
gh release download v1.0.0

To publish build files when creating the release, list them after the tag:

Terminal
gh release create v1.0.0 dist/app-linux-amd64 dist/checksums.txt

Format Output for Scripts

Many gh commands support --json for structured output. For example, list pull request numbers, titles, and authors:

Terminal
gh pr list --json number,title,author

Use --jq to select and format fields without piping the result to a separate jq process:

Terminal
gh pr list \
 --json number,title \
 --jq '.[] | "#\(.number) \(.title)"'

output

#42 Add health check endpoint
#38 Update deployment docs

Structured output is more reliable in scripts than parsing the default table, which is intended for people and can change with terminal width.

Call the GitHub API

The gh api command sends authenticated requests to GitHub’s REST or GraphQL API. From inside a repository, list release tag names with:

Terminal
gh api repos/{owner}/{repo}/releases --jq '.[].tag_name'

The {owner} and {repo} placeholders are filled from the current repository. To request a specific API version or media type, pass additional headers with -H.

For a POST request, use -f for string fields or -F for typed fields:

Terminal
gh api repos/{owner}/{repo}/issues \
 -f title="API-created issue" \
 -f body="Created with gh api."

This command creates a real issue. Use a test repository while learning write operations.

Create Command Aliases

Aliases shorten commands you use repeatedly. The following alias opens the current pull request in a browser:

Terminal
gh alias set pv 'pr view --web'

You can then run:

Terminal
gh pv

List all configured aliases with:

Terminal
gh alias list

Quick Reference

Task	Command
Authenticate	`gh auth login`
Check authentication	`gh auth status`
Clone a repository	`gh repo clone OWNER/REPO`
View the current repository	`gh repo view`
Create a repository from the current directory	`gh repo create NAME --source=. --push`
List pull requests	`gh pr list`
Create a pull request	`gh pr create --fill`
Check out a pull request	`gh pr checkout NUMBER`
Show pull request checks	`gh pr checks NUMBER`
List issues	`gh issue list`
Create an issue	`gh issue create`
List workflow runs	`gh run list`
Show failed workflow logs	`gh run view ID --log-failed`
Create a release	`gh release create TAG --generate-notes`
Call the REST API	`gh api ENDPOINT`
Create an alias	`gh alias set NAME 'COMMAND'`

Troubleshooting

GitHub CLI reports that authentication is required
Run gh auth status to inspect the active account. If the credentials are missing or expired, authenticate again with gh auth login. In CI, confirm that GH_TOKEN or GITHUB_TOKEN is available to the step that runs the command.

The command targets the wrong repository
Run the command from inside the intended Git repository, pass --repo OWNER/REPOSITORY, or set a default with gh repo set-default. This is especially important in scripts that run outside a working tree.

A command returns an insufficient scopes error
The stored token does not have permission for the requested operation. Run gh auth refresh and select the additional scope requested by the error. Organization policies may also restrict token access.

gh pr create cannot find commits between branches
Push the current branch and confirm that it contains commits not present in the base branch. Use git status, git log, and git diff BASE...HEAD to check the local state before retrying.

FAQ

What is the difference between Git and GitHub CLI?
Git manages commits, branches, tags, and repository history. GitHub CLI manages GitHub features such as pull requests, issues, releases, and Actions runs. You will often use git for local history and gh for the remote collaboration workflow.

Can GitHub CLI work with private repositories?
Yes. The authenticated account must have access to the repository, and the token used by gh must include the required permissions.

How do I use a different repository without changing directories?
Add --repo OWNER/REPOSITORY to supported commands. For example, gh issue list --repo cli/cli lists issues from that repository regardless of your current directory.

Can GitHub CLI produce machine-readable output?
Yes. Commands that expose --json can return selected fields, and --jq can filter or format the result. The gh api command also supports --jq and --template.

Does GitHub CLI support GitHub Enterprise Server?
Yes. Authenticate with gh auth login --hostname HOSTNAME, then use that host for repository and API operations.

Conclusion

GitHub CLI keeps repository administration and collaboration close to your existing Git workflow. Start with gh auth login, gh repo, gh pr, and gh issue, then add Actions, releases, and gh api as your terminal workflow grows.

date Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 23 Jun 2026 17:03:18 +0200

Display Date and Time

Print the current date and time in common forms.

Command	Description
`date`	Current date and time in the default format
`date +%F`	Date in YYYY-MM-DD format
`date +%T`	Time in HH:MM:SS format
`date +"%F %T"`	Date and time combined
`date -u`	Current time in UTC
`date -R`	Date in RFC 5322 email format
`date --iso-8601=seconds`	ISO 8601 with seconds

Common Format Specifiers

Build custom output with % controls after a +.

Specifier	Description
`%Y` `%m` `%d`	Year, month, day of month
`%H` `%M` `%S`	Hour (24h), minute, second
`%I` `%p`	Hour (12h), AM/PM
`%A` `%a`	Full / abbreviated weekday name
`%B` `%b`	Full / abbreviated month name
`%j` `%u`	Day of year, day of week (Mon=1)
`%F` `%T` `%D`	YYYY-MM-DD, HH:MM:SS, mm/dd/yy
`%s` `%n`	Unix timestamp, newline

Format Examples

Combine specifiers into ready-to-use strings.

Command	Description
`date +"%Y-%m-%d"`	2026-06-23
`date +"%H:%M:%S"`	14:31:01
`LC_TIME=C date +"%A, %d %B %Y"`	Tuesday, 23 June 2026
`date +"%Y%m%d"`	Compact stamp for filenames
`date +"%Y-%m-%d_%H-%M-%S"`	Safe timestamp for logs
`date +"%Z (%z)"`	Timezone name and offset

Relative Dates

Use -d (or --date) with a date string.

Command	Description
`date -d "tomorrow"`	Tomorrow’s date
`date -d "yesterday"`	Yesterday’s date
`date -d "monday"`	Upcoming Monday (today if it is Monday)
`date -d "last week"`	One week ago
`date -d "30 days ago"`	30 days in the past
`date -d "2 hours"`	Two hours from now
`date -d "16 Dec 1974" +%A`	Weekday of a fixed date

Timezones

Override the timezone for one invocation.

Command	Description
`TZ='Asia/Tokyo' date`	Show time in another timezone
`TZ='UTC' date`	Show current UTC time
`date -d 'TZ="Australia/Sydney" 09:00 next Mon'`	Convert a time across zones
`date +"%Z"`	Show the current timezone abbreviation
`date +"%z"`	Show the numeric UTC offset

Unix Timestamps

Convert between epoch seconds and dates.

Command	Description
`date +%s`	Current Unix timestamp
`date -d @1234567890`	Convert a timestamp to a date
`date -d @1234567890 +"%F %T"`	Convert and format a timestamp
`date -u -d @0`	Print the Unix epoch start
`date -d "2026-06-23 12:00" +%s`	Convert a date to a timestamp

Files and Scripts

Read file times and capture the date in scripts.

Command	Description
`date -r /etc/hosts`	Last modification time of a file
`backup-$(date +%F).sql`	Date-stamped filename
`now=$(date +%s)`	Store the timestamp in a variable
`date +"%F %T" >> log.txt`	Append a timestamp to a log
`date --debug -d "next fri"`	Show how a date string is parsed

Set the System Clock

Disable NTP before a manual change, then re-enable it afterward.

Command	Description
`sudo timedatectl set-ntp false`	Disable automatic time synchronization
`sudo date --set="2026-06-23 17:30"`	Set the date and time
`sudo date --set="17:30"`	Set the time only
`sudo date MMDDhhmmCCYY`	Set the clock with the legacy positional format
`sudo timedatectl set-time '2026-06-23 17:30:00'`	Preferred way on systemd systems
`sudo timedatectl set-ntp true`	Re-enable automatic time synchronization

Use these references for deeper date and time tasks.

Guide	Description
`date Command in Linux`	Full walkthrough of formatting, timezones, and epoch conversion
`timedatectl Cheatsheet`	Manage system time, timezone, and NTP sync
`Set or Change the Time Zone in Linux`	Change the system timezone
`crontab Cheatsheet`	Schedule time-based jobs

How to Install Caddy on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Tue, 23 Jun 2026 09:40:00 +0200

When you publish a website or put an application behind a reverse proxy, configuring HTTPS can take longer than installing the web server. Caddy handles certificate issuance, renewal, and HTTP-to-HTTPS redirects automatically for most deployments.

Once your domain points to the server, a short Caddyfile is often enough to serve the site over HTTP/2 and HTTP/3. This guide explains how to install Caddy on Ubuntu 26.04 from the official APT repository, serve a static site, configure a reverse proxy, and manage the service with systemd.

Quick Reference

Task	Command
Install Caddy	`sudo apt install caddy`
Edit configuration	`sudo nano /etc/caddy/Caddyfile`
Reload configuration	`sudo systemctl reload caddy`
Restart Caddy	`sudo systemctl restart caddy`
Check status	`sudo systemctl status caddy`
Validate Caddyfile	`sudo caddy validate --config /etc/caddy/Caddyfile`
Format Caddyfile	`sudo caddy fmt --overwrite /etc/caddy/Caddyfile`
View logs	`sudo journalctl -u caddy -f`

Prerequisites

Before you start, make sure you have:

An Ubuntu 26.04 server with a user that has sudo access.
A domain name with an A or AAAA record pointing to the server if you want a publicly trusted HTTPS certificate.
TCP ports 80 and 443 open in the server firewall and any provider-level firewall.

If you use UFW , allow HTTP and HTTPS traffic with these commands:

Terminal
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Caddy supports HTTP/3 over UDP. Allow UDP port 443 if you want clients to use it:

Terminal
sudo ufw allow 443/udp

If you only want to test Caddy locally, use an explicit HTTP address such as http://localhost or a non-standard port such as :8080 in the Caddyfile. Caddy will not activate automatic HTTPS for that site address.

Install Caddy from the Official Repository

The Caddy project maintains an official APT repository on Cloudsmith. We will use it to install the current stable release and receive future Caddy updates through APT.

Install the prerequisite packages:

Terminal
sudo apt update
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl

Add the Caddy signing key:

Terminal
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
 | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg

Add the Caddy APT repository:

Terminal
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
 | sudo tee /etc/apt/sources.list.d/caddy-stable.list

Make both repository files readable by APT:

Terminal
sudo chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg
sudo chmod o+r /etc/apt/sources.list.d/caddy-stable.list

Update the package index and install Caddy:

Terminal
sudo apt update
sudo apt install -y caddy

The package installs the binary at /usr/bin/caddy, creates the caddy system user, adds a default configuration at /etc/caddy/Caddyfile, and installs the caddy.service systemd unit.

Display the installed version:

Terminal
caddy version

Next, confirm that the service is running:

Terminal
sudo systemctl status caddy

The status output should show active (running). Press q to exit the status screen.

You can also request the default site from the server:

Terminal
curl -I http://localhost

A working installation returns an HTTP 200 OK response and includes Server: Caddy in the headers. You can also open the server’s IP address in a browser to view the default page.

Serve a Static Site

Caddy reads its configuration from /etc/caddy/Caddyfile. The default file serves content from /usr/share/caddy on port 80.

Before changing it, create a backup:

Terminal
sudo cp /etc/caddy/Caddyfile /etc/caddy/Caddyfile.backup

Next, open the Caddyfile:

Terminal
sudo nano /etc/caddy/Caddyfile

Replace the contents with the following site block. Change example.com to your domain:

/etc/caddy/Caddyfilecaddy
example.com {
 root * /var/www/example.com
 file_server
}

The domain on the first line is the site address. Caddy uses it to obtain a certificate, redirect HTTP requests to HTTPS, and serve the site securely. You do not need a separate certificate block or listen directive.

Create the document root and add a test page:

Terminal
sudo mkdir -p /var/www/example.com
echo "<h1>Hello from Caddy</h1>" | sudo tee /var/www/example.com/index.html
sudo chmod -R a+rX /var/www/example.com

The caddy service only needs read access to static site files. Keeping the files owned by your deployment user or by root prevents the web server process from changing them.

Before applying the new configuration, validate it:

Terminal
sudo caddy validate --config /etc/caddy/Caddyfile

If the command does not report an error, reload Caddy:

Terminal
sudo systemctl reload caddy

The reload command applies the new Caddyfile without stopping the service. Caddy then requests a certificate and redirects HTTP traffic to HTTPS. If DNS points to the server and ports 80 and 443 are reachable, certificate issuance usually completes within a few seconds.

Add a Reverse Proxy

Caddy is often used in front of an application running on the same server. For example, if a Node.js or Python application listens on 127.0.0.1:3000, use this Caddyfile:

/etc/caddy/Caddyfilecaddy
app.example.com {
 reverse_proxy 127.0.0.1:3000
}

With this configuration, Caddy handles HTTPS and forwards requests to the application. It also passes the incoming Host header, sets the common X-Forwarded-* headers, and supports WebSocket connections without extra directives.

To proxy a subpath, scope the directive:

/etc/caddy/Caddyfilecaddy
example.com {
 root * /var/www/example.com
 file_server

 handle /api/* {
 reverse_proxy 127.0.0.1:3000
 }
}

Requests under /api/ are sent to the application with the /api prefix unchanged. Other requests continue to use the static file server. If the application expects /users instead of /api/users, replace handle with handle_path to remove the matching prefix before proxying the request.

Validate and reload the configuration after making the change:

Terminal
sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

If you also work with Nginx, see our Nginx reverse proxy guide for the equivalent configuration.

Host Multiple Sites

You can host several domains and subdomains from the same Caddyfile. Add one site block for each hostname:

/etc/caddy/Caddyfilecaddy
example.com {
 root * /var/www/example.com
 file_server
}

blog.example.com {
 root * /var/www/blog
 file_server
 encode gzip
}

api.example.com {
 reverse_proxy 127.0.0.1:8080
}

Caddy obtains and renews a certificate for each eligible hostname. Unlike an Nginx sites-available setup, this configuration does not require a separate symlink step.

As the number of sites grows, you can split the configuration across files with the import directive:

/etc/caddy/Caddyfilecaddy
import /etc/caddy/sites/*.caddy

Create the /etc/caddy/sites directory, then add one .caddy file for each site. Run caddy validate after adding or removing an imported file.

Validate and Format the Caddyfile

Before every reload, validate the Caddyfile:

Terminal
sudo caddy validate --config /etc/caddy/Caddyfile

Validation parses the file and provisions its modules without starting another server. If Caddy finds a syntax or configuration error, it reports the affected line or directive.

Caddy also includes a formatter for indentation and spacing:

Terminal
sudo caddy fmt --overwrite /etc/caddy/Caddyfile

The --overwrite option replaces the file with the formatted version. Review the file or keep it in version control if you want to inspect formatting changes before deployment.

Manage Caddy with systemd

The package runs Caddy as a systemd service named caddy.service. Use these commands to control it:

Terminal
sudo systemctl start caddy
sudo systemctl stop caddy
sudo systemctl restart caddy
sudo systemctl reload caddy
sudo systemctl status caddy

For Caddyfile changes, use reload instead of restart. Reloading applies the new configuration through Caddy’s admin API without interrupting active connections.

The package normally enables the service during installation. If it was disabled, enable it again with:

Terminal
sudo systemctl enable caddy

View Caddy Logs

Caddy writes its runtime and service logs to the systemd journal. Follow new entries with journalctl :

Terminal
sudo journalctl -u caddy -f

Access logging is separate and is not enabled by default. To write JSON access logs to a file, add a log directive to the site block:

/etc/caddy/Caddyfilecaddy
example.com {
 root * /var/www/example.com
 file_server

 log {
 output file /var/log/caddy/access.log
 format json
 }
}

Create the log directory once with the correct ownership:

Terminal
sudo mkdir -p /var/log/caddy
sudo chown caddy:caddy /var/log/caddy

Reload Caddy after validating the change. Caddy rotates file-based access logs by default, and JSON output can be read by log collection tools such as Vector, Loki, or Elasticsearch.

Update Caddy

Because Caddy was installed from an APT repository, you can update it with the normal package workflow:

Terminal
sudo apt update
sudo apt install --only-upgrade caddy

The package upgrade keeps your Caddyfile and Caddy data under /var/lib/caddy. After an update, confirm the installed version and service status:

Terminal
caddy version
sudo systemctl status caddy

Troubleshooting

bind: address already in use on port 80 or 443
Another web server (often Apache or a previous Nginx install) is already listening on the port. Stop the conflicting service with sudo systemctl stop apache2 or sudo systemctl stop nginx, then start Caddy.

Certificate issuance fails
Caddy needs inbound access on port 80 for the HTTP challenge or port 443 for the TLS-ALPN challenge. Confirm the firewall allows both, that every configured A or AAAA record points at this server, and that no other proxy intercepts the validation request. The journal log (journalctl -u caddy) shows the exact ACME error.

permission denied reading /var/www/...
Caddy runs as the caddy user, not as root. Files under the document root must be readable, and parent directories must be executable. Run sudo chmod -R a+rX /var/www/example.com, then check each parent directory if the error continues. Avoid giving the service account ownership of files that it only needs to serve.

Caddyfile validates but the site is unreachable
Check that the site block uses the exact hostname requested by the browser. Test DNS with getent hosts example.com, then use curl -v https://example.com to inspect the connection and response.

HTTP requests are not redirected to HTTPS
Automatic HTTPS is disabled when a site address starts with http:// or contains only an HTTP port. Use example.com rather than http://example.com in the Caddyfile, validate the configuration, and inspect the journal for certificate errors.

Conclusion

Once Caddy is running, most day-to-day work happens in /etc/caddy/Caddyfile. Validate each change before reloading, and keep ports 80 and 443 reachable so Caddy can issue certificates and redirect visitors to HTTPS.

curl vs wget: Differences and When to Use Each

hello@linuxize.com (Linuxize) — Mon, 22 Jun 2026 10:20:00 +0200

When a script needs to fetch a URL, both curl and wget may appear to do the same job. Their defaults and strengths are different, however. wget is designed around downloading files and recursively retrieving web content, while curl transfers data to or from a URL and gives you detailed control over requests.

This comparison explains the differences between curl and wget, then shows which command fits common download, scripting, and API tasks.

The Short Answer

Use wget when you want to save files, retrieve URLs from a list, mirror web content, or leave a download running in the background. Use curl when you need to send request data, set headers, upload content, work with an API, or pipe a response into another command.

The most visible difference is the default output. wget saves the response to a file, while curl writes it to standard output.

Key Differences

Property	wget	curl
Primary purpose	Downloading files and mirroring sites	Transferring data to and from a server
Default behavior	Saves to a file	Prints to standard output
Recursive download	Yes, built in (`-r`)	No
Follows redirects	Yes, by default	Only with `-L`
Resume a download	`-c`	`-C -`
Protocols	HTTP, HTTPS, FTP, and FTPS	Many, including HTTP, FTP, SFTP, SCP, SMTP, and more
Background download	Yes (`-b`)	No
Request and upload controls	Supports headers, methods, and request bodies	Extensive controls for headers, authentication, uploads, and request data
Reusable library	Standalone program	Uses libcurl, which applications can use directly

Downloading a Single File

Both tools handle a single file well, but their defaults differ. wget saves the file using the last component of the URL:

Terminal
wget https://example.com/archive.tar.gz

The file is saved in the current directory as archive.tar.gz, with download progress shown in the terminal. A plain curl URL writes the response body to standard output. To save the file using the name from the URL, add -O:

Terminal
curl -O https://example.com/archive.tar.gz

To choose the local filename, wget uses -O name and curl uses -o name. With curl, lowercase -o takes a filename, while uppercase -O derives the filename from the URL.

Following Redirects

Download URLs often redirect to a mirror or versioned path. wget follows HTTP redirects by default. curl requires -L (--location) to follow the Location header:

Terminal
curl -L -O https://example.com/latest/archive.tar.gz

Without -L, curl returns the redirect response instead of requesting the final URL. This can leave you with an empty or unexpectedly small file when you expected the actual download.

Resuming an Interrupted Download

Both tools can continue a partial download when the server supports range requests. With wget, add -c:

Terminal
wget -c https://example.com/large.iso

With curl, use -C -. The dash tells curl to determine the resume offset from the existing local file:

Terminal
curl -C - -O https://example.com/large.iso

Downloading Recursively

Recursive retrieval is one of wget’s main advantages. It can inspect downloaded HTML pages, follow links, and retrieve additional content. Curl transfers the URLs you provide but does not crawl pages to discover more URLs.

For example, the following command follows links below the starting location:

Terminal
wget -r -np https://example.com/files/

The -r flag enables recursion, and -np (--no-parent) prevents wget from following links above the starting path. Recursive retrieval can download much more content than expected, so restrict the depth, domains, or accepted file types when running it against a large site.

Curl can still download several known URLs in one invocation, including in parallel with --parallel, but it cannot discover those URLs by parsing a page.

Working with an API

For web APIs, curl provides clearer controls for request bodies, headers, authentication, response output, and uploads. This command sends a JSON body with a POST request:

Terminal
curl -H "Content-Type: application/json" \
 -d '{"name":"linuxize"}' \
 https://api.example.com/users

The -d option supplies request data and makes curl send a POST request, so -X POST is unnecessary. Because the response is written to standard output, you can pipe it directly into a tool such as jq.

GNU Wget also supports custom methods, headers, and request bodies. It does not support the same range of protocols and upload formats, including multipart/form-data, so curl is generally the better API client. Our guide on using curl with REST APIs covers request methods, authentication, and response handling in more detail.

Downloading in the Background

For a long download that should continue after the command returns to the shell, wget provides built-in background mode:

Terminal
wget -b https://example.com/large.iso

Wget writes progress to wget-log unless you select another log file. Curl has no equivalent option built into the command; use shell job control, nohup, screen, or tmux when a curl transfer must run independently.

Conclusion

Choose wget for file-oriented downloads, recursive retrieval, and built-in background operation. Choose curl for APIs, uploads, pipelines, and detailed request control; the curl command examples and wget command examples guides cover each tool in depth.

PostgreSQL Backup and Restore with pg_dump and pg_restore

hello@linuxize.com (Linuxize) — Sun, 21 Jun 2026 13:40:00 +0200

A working backup is the difference between a bad afternoon and a bad week. PostgreSQL provides pg_dump and pg_restore for logical backups. These client utilities work with local or remote databases and produce portable archives that you can load into a compatible PostgreSQL server.

This guide explains how to use pg_dump for single databases, pg_dumpall for cluster-wide backups, and pg_restore to bring a database back from a dump file. It covers the common output formats, partial backups, and the practical mistakes that turn a backup into an unrestorable file.

Quick Reference

For a printable quick reference, see the PostgreSQL cheatsheet .

Task	Command
Plain SQL backup	`pg_dump mydb > mydb.sql`
Custom-format backup	`pg_dump -Fc -f mydb.dump mydb`
Parallel directory backup	`pg_dump -Fd -j 4 -f mydb_backup mydb`
Restore plain SQL	`psql -X --set ON_ERROR_STOP=on -d newdb -f mydb.sql`
Restore an archive	`pg_restore --exit-on-error -d newdb mydb.dump`
Parallel archive restore	`pg_restore --exit-on-error -j 4 -d newdb mydb.dump`
Back up roles and tablespaces	`pg_dumpall --globals-only > globals.sql`
Inspect an archive	`pg_restore --list mydb.dump`

Logical vs Physical Backups

Before reaching for pg_dump, it helps to know what it is and what it is not.

A logical backup exports the database as SQL statements or as a portable archive that can be replayed against an empty database. Plain-text dumps are human-readable, and archive formats support selective restores. Logical dumps are also the normal choice when moving a database to a newer PostgreSQL major version.

A physical backup copies the data files on disk, usually with pg_basebackup or a tool such as pgBackRest. Physical backups are faster to restore for large clusters and can be combined with WAL archiving for point-in-time recovery, but they are tied more closely to the PostgreSQL server version and storage layout.

pg_dump and pg_restore are useful for logical exports, migrations, and smaller recovery jobs. They do not replace a physical backup and WAL retention plan when your recovery requirements include restoring the entire cluster to a specific point in time.

pg_dump Syntax

The general syntax for pg_dump is:

txt
pg_dump [OPTIONS] DBNAME

Common options:

-h, --host - Database host
-p, --port - Database port
-U, --username - PostgreSQL user
-F, --format - Output format: p (plain SQL), c (custom), d (directory), or t (tar)
-f, --file - Output file or directory path
-j, --jobs - Parallel workers (directory format only)
-t, --table - Dump only matching tables
-n, --schema - Dump only matching schemas
--data-only - Skip schema and dump only data
--schema-only - Skip data and dump only schema

pg_dump connects as a regular client. The connecting role needs enough privileges to read every selected object. Running routine backups with a dedicated role is safer than allowing a script to connect as the postgres superuser.

Plain SQL Dump

The simplest backup is a plain SQL file. It is human-readable, can be opened in any editor, and is restored with psql instead of pg_restore.

Dump a single database to a SQL file:

Terminal
sudo -u postgres pg_dump mydb > mydb.sql

The output is a sequence of CREATE, COPY, and ALTER statements. Restore it into a database created from template0 so that local additions to template1 do not cause duplicate-object errors:

Terminal
sudo -u postgres createdb -T template0 mydb_restored
sudo -u postgres psql -X --set ON_ERROR_STOP=on -d mydb_restored -f mydb.sql

The -X option prevents settings in .psqlrc from changing the restore, while ON_ERROR_STOP makes psql stop at the first SQL error. Without it, psql continues and can leave a partially restored database.

Plain SQL is convenient for small databases, code review, and migrations between PostgreSQL versions. It cannot be restored in parallel and does not support the flexible object selection available in archive formats.

Custom Format

The custom format is a practical default for logical backups. It is a compressed archive that supports selective and parallel restore, plus inspection with pg_restore --list.

Dump a database in custom format:

Terminal
sudo -u postgres pg_dump -Fc -f mydb.dump mydb

-Fc selects the custom format, and -f writes the output to a file. The resulting mydb.dump is a binary archive, not SQL text, so you restore it with pg_restore:

Terminal
sudo -u postgres createdb -T template0 mydb_restored
sudo -u postgres pg_restore --exit-on-error -d mydb_restored mydb.dump

--exit-on-error prevents pg_restore from continuing after a failed SQL command. The custom format is useful when you want one file per database and the option to restore selectively later.

Directory Format with Parallel Workers

For larger databases, the directory format can be written and restored in parallel. Instead of one file, it creates a directory containing a table of contents and separate data files.

Dump in directory format with four parallel workers:

Terminal
sudo -u postgres pg_dump -Fd -j 4 -f mydb_backup mydb

-Fd selects the directory format and -j 4 uses four workers. A parallel dump opens one leader connection plus one connection for each worker, so this command uses five database connections.

Restore the same backup in parallel:

Terminal
sudo -u postgres createdb -T template0 mydb_restored
sudo -u postgres pg_restore --exit-on-error -d mydb_restored -j 4 mydb_backup

Parallel jobs increase load on the database server and storage. Start with a worker count near the number of available CPU cores, then measure the effect on your system.

Remote Backups

pg_dump does not need to run on the database host. You can back up a remote database over the network as long as the connecting role has access:

Terminal
pg_dump -h db.example.com -p 5432 -U backup_user -Fc -f mydb.dump mydb

You will be prompted for the password unless one is available from a PostgreSQL password file or another libpq authentication source. For automation, create ~/.pgpass and restrict its permissions:

Terminal
touch ~/.pgpass
chmod 600 ~/.pgpass

Add the connection entry to the file:

~/.pgpasstxt
db.example.com:5432:mydb:backup_user:replace_with_password

Warning

Do not commit .pgpass or backup credentials to version control. Keep the file outside the project, restrict it to mode 600, and use a secrets manager when your automation platform provides one.

A dedicated backup role with only the required read access is safer than reusing an application role. On supported PostgreSQL versions, membership in the predefined pg_read_all_data role can provide read access to tables, views, and sequences, but row-level security policies may require additional planning.

Dumping Specific Tables or Schemas

You do not always need a full database. pg_dump accepts patterns to include or exclude specific objects.

Dump only the orders table:

Terminal
sudo -u postgres pg_dump -Fc -t orders -f orders.dump mydb

Dump every table in the public schema:

Terminal
sudo -u postgres pg_dump -Fc -n public -f public.dump mydb

Exclude a table that you do not need to back up, such as a large cache table:

Terminal
sudo -u postgres pg_dump -Fc -T sessions -f mydb.dump mydb

The same flags accept psql-style patterns when quoted, which lets you match a group of tables (-t 'logs_*'). Partial dumps do not automatically include every object on which the selected table or schema depends, so test them against a clean database before relying on them.

Schema-Only and Data-Only Dumps

Sometimes you want just the structure of a database, or just the data without the DDL.

Create a schema-only backup:

Terminal
sudo -u postgres pg_dump --schema-only -Fc -f schema.dump mydb

Create a data-only backup:

Terminal
sudo -u postgres pg_dump --data-only -Fc -f data.dump mydb

Data-only restores can fail when the existing schema has triggers or foreign-key constraints that reject the incoming rows. The safest workflow is to restore the schema and data into an empty database. pg_restore --disable-triggers is available for data-only restores, but it requires superuser privileges and must be used carefully.

Cluster-Wide Backups with pg_dumpall

pg_dump backs up one database at a time. For roles, tablespaces, and other global objects, use pg_dumpall.

Create a cluster-wide plain SQL backup:

Terminal
sudo -u postgres pg_dumpall > cluster.sql

Restore it into an empty cluster:

Terminal
sudo -u postgres psql -X --set ON_ERROR_STOP=on -f cluster.sql postgres

pg_dumpall takes a separate snapshot of each database, so changes spanning multiple databases are not captured at one synchronized point in time. A common pattern is to combine pg_dumpall --globals-only for roles and tablespaces with per-database pg_dump runs. This provides one file with global objects and one archive per database that you can restore selectively.

Terminal
sudo -u postgres pg_dumpall --globals-only > globals.sql
for db in mydb analytics reports; do
 sudo -u postgres pg_dump -Fc -f "$db.dump" "$db"
done

pg_restore Syntax

The general syntax for pg_restore is:

txt
pg_restore [OPTIONS] [FILE]

Common options:

-d, --dbname - Target database name
-j, --jobs - Parallel workers (custom or directory format)
-c, --clean - Drop existing objects before recreating them
-C, --create - Create the database named in the archive
-e, --exit-on-error - Stop after the first SQL error
-t, --table - Restore only named tables
-n, --schema - Restore only named schemas
--data-only - Restore data and skip DDL
--schema-only - Restore DDL and skip data
--list - Print the archive table of contents

Warning

A dump can contain SQL that runs code during the restore. Only restore backups from sources you trust. Inspect plain SQL directly or render an archive as SQL with pg_restore --file before loading an untrusted dump.

Restoring a Database

The standard restore creates an empty target database and replays the archive into it:

Terminal
sudo -u postgres createdb -T template0 mydb_restored
sudo -u postgres pg_restore --exit-on-error -d mydb_restored mydb.dump

For a large dump, parallelize the restore:

Terminal
sudo -u postgres pg_restore --exit-on-error -d mydb_restored -j 4 mydb.dump

To create the database recorded in the archive, connect to an existing maintenance database such as postgres and pass -C:

Terminal
sudo -u postgres pg_restore --exit-on-error -C -d postgres mydb.dump

The database passed with -d is used only for the initial CREATE DATABASE command. The remaining objects are restored into the database name stored in the archive. Parallel jobs can be combined with -C; the incompatible option is --single-transaction.

Warning

The --clean option drops existing objects before restoring them. Prefer a new empty database for recovery tests. If you must replace existing objects, review the target carefully and combine --clean with --if-exists to reduce harmless missing-object errors.

Selective Restore

One reason to use the custom or directory format is selective restore. Start by writing the archive table of contents to a text file:

Terminal
sudo -u postgres pg_restore --list mydb.dump > toc.txt

Edit toc.txt, remove unwanted lines or comment them out with a semicolon, then pass the list back to pg_restore:

Terminal
sudo -u postgres pg_restore --exit-on-error -L toc.txt -d mydb_restored mydb.dump

This is the most controlled way to restore a table or a few schemas from a full database dump. A selected object can still depend on types, functions, extensions, or other objects that are not in the edited list.

Compression and Storage

Custom and directory archives use compression by default. You can adjust the compression level with -Z:

Terminal
sudo -u postgres pg_dump -Fc -Z 9 -f mydb.dump mydb

Higher compression can reduce file size at the cost of additional CPU time. For a plain SQL dump, pipe the output through a compressor:

Terminal
sudo -u postgres pg_dump mydb | gzip > mydb.sql.gz

For automated backups, write to a dedicated directory with restrictive permissions, add rotation, and copy the result off-host. Create the directory and edit the postgres user’s crontab :

Terminal
sudo install -d -m 700 -o postgres -g postgres /var/backups/postgresql
sudo -u postgres crontab -e

Add the following daily backup entry:

txt
0 2 * * * /usr/bin/pg_dump -Fc -f /var/backups/postgresql/mydb-$(date +\%F).dump mydb

The percent sign is escaped because an unescaped % has a special meaning in crontab commands. Use a separate rotation policy and keep another copy outside the database host.

Verifying a Backup with a Test Restore

Listing an archive confirms that pg_restore can read its table of contents, but only a test restore proves that the objects and data can be loaded. Create a temporary database, restore the archive, and update the optimizer statistics:

Terminal
sudo -u postgres createdb -T template0 mydb_verify
sudo -u postgres pg_restore --exit-on-error -d mydb_verify mydb.dump
sudo -u postgres psql -X -d mydb_verify -c "ANALYZE;"

Check row counts, critical queries, and required extensions. After verification, remove the temporary database:

Terminal
sudo -u postgres dropdb mydb_verify

Schedule restore tests regularly and record how long they take. Recovery time matters as much as whether the dump command completed.

Troubleshooting

pg_dump: error: connection to server failed
The host, port, socket path, or authentication settings are wrong, or PostgreSQL is not listening on the requested address. Check the service with sudo systemctl status postgresql, confirm listen_addresses, and review the matching rule in pg_hba.conf.

pg_dump: error: permission denied for table ...
The connecting role cannot read one or more selected objects. Grant the required USAGE and SELECT privileges, or grant the trusted backup role membership in pg_read_all_data. Databases that use row-level security need additional review because that predefined role does not bypass RLS policies.

pg_restore: error: could not execute query ... role does not exist
The dump references roles that do not exist on the target cluster. Restore the globals first, recreate the missing roles, or use --no-owner --no-privileges when preserving original ownership and grants is not required.

pg_restore: error: relation ... already exists
The target database already contains objects from the dump. Restoring into a fresh database is the safest solution. If replacing the existing objects is intentional, use --clean --if-exists after verifying the target.

Restore is very slow on a large dump
Use a custom or directory archive with -j parallel workers. Increase the job count gradually while watching CPU, disk throughput, available connections, and memory use. Too many jobs can make the restore slower.

Restored database is missing extensions
The extension software must be installed on the target server before PostgreSQL can run the CREATE EXTENSION statements from the dump. Install the matching extension package, recreate the empty target database, and run the restore again.

FAQ

Is pg_dump safe to run on a live database?
Yes. pg_dump creates a consistent export while normal reads and writes continue. It holds ACCESS SHARE locks on dumped tables, which can conflict with schema changes that need exclusive locks. Large dumps also create load and can keep old row versions available longer, so monitor them and schedule demanding jobs appropriately.

Should I use pg_dump or pg_basebackup for backups?
Use pg_dump for logical backups of individual databases and for cross-version migrations. Use pg_basebackup as part of a physical backup, replication, or point-in-time recovery plan for the whole cluster. Production systems commonly need both logical exports and physical recovery coverage.

Can I restore a dump from a newer PostgreSQL version into an older one?
Do not rely on restoring into an older major version. PostgreSQL expects pg_dump output to load into newer server versions, but backward compatibility is not guaranteed. The pg_dump client must be the same major version as the source server or newer, and it cannot dump a server newer than itself. For an upgrade, use the target version’s client tools when possible.

How do I back up only the database structure, not the data?
Use pg_dump --schema-only. This is useful for reviewing schema changes and creating empty databases for migration tests.

Where does pg_dump store the dump?
It writes to the path passed with -f, or to standard output when no file is specified. There is no default backup directory. For automated jobs, create a directory owned by the backup account and restrict access to it.

Conclusion

Use a custom-format pg_dump with pg_dumpall --globals-only when you need portable logical backups, then store the files off-host and prove them with scheduled restore tests. For setup and access control, continue with the PostgreSQL on Ubuntu 26.04 guide and PostgreSQL user management .

pip Cheatsheet

hello@linuxize.com (Linuxize) — Sat, 20 Jun 2026 13:40:00 +0200

Install Packages

Add packages from PyPI and other sources.

Command	Description
`pip install package`	Install the latest version
`pip install pkg1 pkg2`	Install several packages
`pip install --user package`	Install into the user site
`pip install -e .`	Install local project in editable mode
`pip install 'package[extra]'`	Install with optional extras
`pip install ./dist/pkg.whl`	Install from a wheel file
`python -m pip install package`	Install through the python launcher

Versions and Sources

Pin versions and install from other indexes.

Command	Description
`pip install package==1.2.3`	Install an exact version
`pip install 'package>=1.0,<2.0'`	Install within a version range
`pip install --upgrade package`	Upgrade to the latest version
`pip install --pre package`	Allow pre-release versions
`pip install 'git+https://host/repo.git'`	Install from a Git repository
`pip install -i https://mirror/simple package`	Use an alternate index URL
`pip index versions package`	List available versions

Requirements Files

Record and reproduce a project environment.

Command	Description
`pip install -r requirements.txt`	Install from a requirements file
`pip freeze`	Print installed packages with versions
`pip freeze > requirements.txt`	Write current packages to a file
`pip download -r requirements.txt -d ./pkgs`	Download packages without installing
`pip install --no-deps -r requirements.txt`	Install without dependencies
`pip uninstall -r requirements.txt`	Remove packages listed in a file

Remove Packages

Uninstall packages and verify the tree.

Command	Description
`pip uninstall package`	Remove a package
`pip uninstall -y package`	Remove without confirmation
`pip uninstall pkg1 pkg2`	Remove several packages
`pip check`	Verify installed dependencies

Inspect Packages

List installed packages and read metadata.

Command	Description
`pip list`	List installed packages
`pip list --outdated`	Show packages with newer versions
`pip list --not-required`	List packages no other package needs
`pip show package`	Show package details
`pip show -f package`	List files installed by a package
`pip --version`	Show the pip and Python version

Virtual Environments

Isolate project dependencies with venv.

Command	Description
`python -m venv myenv`	Create a virtual environment
`source myenv/bin/activate`	Activate the environment (Linux/macOS)
`deactivate`	Leave the active environment
`pip install --upgrade pip`	Upgrade pip inside the environment
`pip install --break-system-packages package`	Override PEP 668 (use sparingly)

Configuration and Cache

Adjust pip settings and manage the cache.

Command	Description
`pip config list`	Show the current configuration
`pip config set global.index-url URL`	Set a default index URL
`pip install --no-cache-dir package`	Install without using the cache
`pip cache dir`	Show the cache location
`pip cache info`	Show cache size and counts
`pip cache purge`	Clear the wheel cache

Use these references for pip and Python workflows.

Guide	Description
`Install pip on Debian`	Install pip3 on Debian 11, 12, and 13
`Install pip on Ubuntu`	Install pip3 on Ubuntu
`Python Virtual Environments`	Create and use isolated environments
`pip vs apt`	When to use pip or the system package manager

Linux Tips, Tricks and Tutorials on Linuxize

Regular Expressions Explained: How Regex Patterns Work

What a Regular Expression Is #

Literal Characters and Metacharacters #

Anchors and Word Boundaries #

Character Classes: Matching Sets #

The Dot and Quantifiers: Matching Repetition #

Grouping and Alternation #

Basic vs Extended Regular Expressions #

One Pattern, Three Tools #

Quick Reference #

Conclusion #

git worktree: Work on Multiple Branches at Once

How git worktree Works #

git worktree Syntax #

Add a Worktree for an Existing Branch #

Add a Worktree with a New Branch #

List All Worktrees #

Run Tests Across Branches in Parallel #

Remove a Worktree #

Prune Stale Worktree References #

Lock a Worktree #

Quick Reference #

Troubleshooting #

Conclusion #

killall Command in Linux: Kill Processes by Name

Installing killall #

killall Syntax #

Killing a Process by Name #

Sending a Specific Signal #

Matching Names Case-Insensitively #

Matching with Regular Expressions #

Killing Processes Owned by a User #

Confirming Each Kill Interactively #

Filtering by Process Age #

Waiting for Processes to Die #

killall vs kill vs pkill #

Common Options #

Quick Reference #

Troubleshooting #

Conclusion #

AWS CLI Cheatsheet

Installation and Setup #

Profiles and Authentication #

Common Options #

Output Formatting and Queries #

S3 Buckets and Objects #

EC2 Instances #

Security Groups and Key Pairs #

EBS Volumes and Snapshots #

IAM Users and Roles #

Systems Manager and Secrets #

CloudWatch Logs and Alarms #

Lambda Functions #

ECR Container Images #

aws s3 Commands: cp, sync, ls, and rm Examples

Prerequisites #

Listing Buckets and Objects #

Uploading and Downloading Files with cp #

Copying Directories #

Streaming to and from S3 #

Moving and Renaming Objects with mv #

Synchronizing Directories with sync #

Deleting Objects with rm #

Creating and Removing Buckets #

Generating Temporary Download Links #

Quick Reference #

FAQ #

Conclusion #

How to Install and Configure the AWS CLI on Linux

Installing AWS CLI Version 2 #

Configuring AWS CLI Authentication #

Signing In with AWS Console Credentials #

Configuring IAM Identity Center #

Configuring an IAM Access Key #

Verifying the Configuration #

Working with Named Profiles #

Running Your First Commands #

Enabling Command Completion #

Troubleshooting #

What a Regular Expression Is

Literal Characters and Metacharacters

Anchors and Word Boundaries

Character Classes: Matching Sets

The Dot and Quantifiers: Matching Repetition

Grouping and Alternation

Basic vs Extended Regular Expressions

One Pattern, Three Tools

Quick Reference

Conclusion

How git worktree Works

git worktree Syntax

Add a Worktree for an Existing Branch

Add a Worktree with a New Branch

List All Worktrees

Run Tests Across Branches in Parallel

Remove a Worktree

Prune Stale Worktree References

Lock a Worktree

Quick Reference

Troubleshooting

Conclusion

Installing killall

killall Syntax

Killing a Process by Name

Sending a Specific Signal

Matching Names Case-Insensitively

Matching with Regular Expressions

Killing Processes Owned by a User

Confirming Each Kill Interactively

Filtering by Process Age

Waiting for Processes to Die

killall vs kill vs pkill

Common Options

Quick Reference

Troubleshooting

Conclusion

Installation and Setup

Profiles and Authentication

Common Options

Output Formatting and Queries

S3 Buckets and Objects

EC2 Instances

Security Groups and Key Pairs

EBS Volumes and Snapshots

IAM Users and Roles

Systems Manager and Secrets

CloudWatch Logs and Alarms

Lambda Functions

ECR Container Images

Prerequisites

Listing Buckets and Objects

Uploading and Downloading Files with cp

Copying Directories

Streaming to and from S3

Moving and Renaming Objects with mv

Synchronizing Directories with sync

Deleting Objects with rm

Creating and Removing Buckets

Generating Temporary Download Links

Quick Reference

FAQ

Conclusion

Installing AWS CLI Version 2

Configuring AWS CLI Authentication

Signing In with AWS Console Credentials

Configuring IAM Identity Center

Configuring an IAM Access Key

Verifying the Configuration

Working with Named Profiles

Running Your First Commands

Enabling Command Completion

Troubleshooting

Conclusion

Quick Reference

Prerequisites

Step 1: Prepare the System

Step 2: Install containerd

Step 3: Add the Kubernetes apt Repository

Step 4: Install kubelet, kubeadm, and kubectl