Linux & server commands
Search across basics, Docker, Kubernetes, networking, and troubleshooting. Each row includes a short description and a realistic example you can copy.
Shell & navigation
Everyday bash/zsh commands for moving around and inspecting files.
| Command | What it does | Example | |
|---|---|---|---|
pwd | Print working directory | pwd | |
cd | Change directory | cd /var/log && cd ~ | |
ls | List files — sizes, hidden, sort | ls -lah --sort=size | |
tree | Directory tree (install tree) | tree -L 2 -d /etc | |
mkdir / rmdir | Create or remove empty dir | mkdir -p projects/app/{src,test} | |
cp | Copy files — recursive, preserve attrs | cp -a backup/. /restore/ | |
mv | Move or rename | mv old.txt archive/new.txt | |
rm | Remove — force, recursive (careful) | rm -rf build_tmp/ | |
touch | Create empty file or bump mtime | touch app.log && ls -l app.log | |
cat / less / more | Read file — less is interactive | less +F /var/log/syslog | |
head / tail | First or last lines — follow log | tail -n 100 -f /var/log/nginx/access.log | |
wc | Count lines, words, bytes | wc -l *.csv | |
history | Past commands — rerun by number | history | grep docker !42 | |
which / type / command -v | Where binary lives | which python3; type -a ls | |
alias | Shell shortcuts | alias ll='ls -alh' | |
diff / cmp | Compare files or dirs | diff -u old.conf new.conf cmp -s bin1 bin2 | |
paste / join | Merge lines side-by-side or on key | paste a.txt b.txt join -t: file1 file2 |
View files — line numbers & readable layout
Beyond raw cat: show code and configs with line numbers, paging, wrapping control, or syntax highlighting — without opening a full IDE.
| Command | What it does | Example | |
|---|---|---|---|
cat -n / cat -b | Print file with line numbers (-n all lines, -b non-blank only) | cat -n src/app.tsx cat -b ~/.bashrc | head -40 | |
nl | Number lines — widths and sections for readable dumps | nl -ba nginx.conf | less nl -v10 -i10 log.txt # start at 10, step 10 | |
less -N | Page through file with line numbers (toggle N inside less too) | less -N /etc/ssh/sshd_config less -NS long.csv # -S = chop long lines horizontally | |
bat / batcat | Syntax-highlighted cat — line numbers, themes (install bat) | bat package.json bat -n main.go bat --theme=GitHub --wrap=never README.md | |
vim / vi | Editor — show line numbers; jump by line for quick inspection | vim +"set number" config.yml :set nu :set relativenumber :42 # jump to line 42 :set nowrap | |
fold / fmt | Wrap long lines for readable terminal width | fold -w 80 wide.txt fmt -w 72 memo.txt | |
grep -n | Show line numbers when searching (pairs well with code review) | grep -n "function " src/*.ts grep -nR "TODO" . --include='*.go' |
grep, sed, awk & pipelines
Search logs and configs, extract columns, and chain commands — essential for developers and platform engineers.
| Command | What it does | Example | |
|---|---|---|---|
grep | Pattern search — recursive, line numbers, ignore case, invert match | grep -Rni 'ERROR' /var/log/myapp grep -E '50[0-9]|timeout' access.log grep -v '^#' /etc/nginx/nginx.conf | |
grep -E / egrep | Extended regex (alternation, groups) | grep -E '(Failed|Invalid)' auth.log | |
grep -o | Print only matching part (extract tokens) | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' log.txt | |
rg (ripgrep) | Very fast recursive search — respects .gitignore (install ripgrep) | rg 'TODO|FIXME' src/ rg -l 'import react' --type ts rg -n --hidden 'password' | |
sed | Stream editor — substitute, delete lines, print range | sed -i.bak 's/api\.old/api.new/g' *.yaml sed -n '100,200p' huge.log sed '/^$/d' file.txt # drop blank lines | |
awk | Column/text processing — fields, sums, filters | awk '{print $1,$NF}' access.log
awk -F: '$3>=1000 {print $1}' /etc/passwd
awk '{sum+=$1} END {print sum}' nums.txt | |
xargs | Build command lines from stdin — parallel with -P | find . -name '*.log' -mtime +7 | xargs gzip
kubectl get pods -o name | xargs -I{} kubectl logs {} --tail=5
xargs -a urls.txt -P4 curl -s -o /dev/null -w '%{url_effective}\n' | |
cut | Extract columns (often with logs) | cut -d' ' -f1,7 access.log cut -c1-80 wide.txt | |
tr | Translate/delete characters | cat file | tr '[:upper:]' '[:lower:]' tr -d '\r' < win.txt > unix.txt | |
sort / uniq | Sort lines; count duplicates (uniq needs sorted input) | sort -t: -k3 -n /etc/passwd sort ips.txt | uniq -c | sort -rn | |
tee | Split stdout to file + terminal (audit pipelines) | kubectl apply -f app.yaml 2>&1 | tee apply.log ./deploy.sh | tee >(grep -i error >&2) |
Users, groups & permissions
chmod/chown and sudo patterns you see on real servers.
| Command | What it does | Example | |
|---|---|---|---|
chmod | Change mode (numeric or symbolic) | chmod 644 file.txt chmod u+x script.sh | |
chown | Change owner and group | sudo chown -R www-data:www-data /var/www | |
umask | Default permission mask for new files | umask 027 | |
sudo | Run as root — edit safely | sudo -u postgres psql sudo visudo | |
su | Switch user | su - deploy sudo su - | |
groups / id | Current user groups / UID | id groups $USER | |
passwd | Change password | passwd sudo passwd alice | |
getfacl / setfacl | ACLs beyond chmod | getfacl /shared setfacl -m u:bob:rwx /shared |
Processes & jobs
See what is running, stop runaway tasks, background work.
| Command | What it does | Example | |
|---|---|---|---|
ps | Process snapshot — often aux / ef | ps aux | grep nginx ps -ef --forest | |
top / htop | Live process monitor | htop -u $USER | |
pgrep / pidof | Find PID by name | pgrep -af node pidof sshd | |
kill / killall | Signal processes — TERM then KILL | kill -15 $PID kill -9 $PID # last resort | |
jobs / fg / bg | Shell background jobs | sleep 100 & jobs fg %1 | |
nohup | Survive logout | nohup ./long_job.sh >out.log 2>&1 & | |
nice / renice | CPU priority | nice -n 10 heavy_cmd sudo renice -n -5 -p $PID | |
timeout | Kill after duration | timeout 30s curl -v slow.api/health | |
watch | Re-run command periodically | watch -n2 'df -h /' | |
systemctl status | Check service state (systemd) | systemctl status nginx systemctl is-active docker | |
systemctl list-units | List units — failed, timers, running services | systemctl list-units --failed systemctl list-units --type=service --state=running systemctl list-timers | |
crontab | User cron jobs — edit or list | crontab -l crontab -e sudo crontab -l -u www-data |
Networking
Connectivity, DNS, HTTP — typical checks from a shell.
| Command | What it does | Example | |
|---|---|---|---|
curl | HTTP(S) client — headers, methods | curl -I https://example.com
curl -d '{}' -H 'Content-Type: application/json' URL | |
wget | Download files | wget -O file.zip https://cdn/file.zip | |
ssh / scp / sftp | Remote shell and copy | ssh user@host scp file user@host:/tmp/ | |
ping | ICMP reachability | ping -c 4 1.1.1.1 | |
traceroute / tracepath | Route hops | traceroute example.com | |
dig / nslookup / host | DNS lookup | dig +short A api.example.com host -t MX example.com | |
ss | Sockets — replacement for netstat | ss -tlnp ss -tan sport = :443 | |
netstat | Legacy socket listing | netstat -tulpn 2>/dev/null | grep LISTEN | |
nc (netcat) | TCP/UDP probe | nc -vz db.internal 5432 cat foo | nc host 1234 | |
iptables / nft | Firewall rules (root) | sudo iptables -L -n -v sudo nft list ruleset | |
ip / ifconfig | Interfaces & routes | ip addr show ip route ip link set eth0 up | |
mtr | Ping + traceroute combined | mtr -rwzbc 100 example.com | |
openssl s_client | TLS handshake & cert inspection — debug HTTPS | openssl s_client -connect api.example.com:443 -servername api.example.com </dev/null openssl s_client -showcerts -connect host:443 2>/dev/null | openssl x509 -noout -dates | |
whois | Domain / IP registration lookup | whois example.com whois 203.0.113.9 | |
resolvectl / systemd-resolve | DNS resolver status (systemd) | resolvectl status resolvectl query api.example.com |
Disk & memory
Space running out or RAM pressure — quick diagnostics.
| Command | What it does | Example | |
|---|---|---|---|
df | Filesystem space | df -h df -h /var | |
du | Directory sizes | du -sh * sudo du -xh /var | sort -rh | head | |
lsblk / blkid | Block devices & UUIDs | lsblk -f sudo blkid | |
mount / umount | Attach filesystems | mount | column -t sudo mount /dev/sdb1 /mnt | |
free | RAM and swap | free -h watch -n1 free -h | |
/proc/meminfo | Detailed memory stats | grep -E 'Mem|Swap' /proc/meminfo | |
sync | Flush writes before unplug/remount | sync && sudo umount /usb | |
find … -mtime / -size | Large or old files | find /var/log -type f -size +100M find . -mtime +30 | |
ncdu | Interactive disk usage browser (install ncdu) | ncdu / ncdu -x /var | |
iotop | Per-process disk IO (install iotop) | sudo iotop -oPa # only active, accum, all processes |
Logs & debugging
When something breaks on the server — follow the trail.
| Command | What it does | Example | |
|---|---|---|---|
journalctl | systemd logs — boot, unit, follow | journalctl -u nginx -f --since '1 hour ago' journalctl -b -p err | |
dmesg | Kernel ring buffer — hardware / OOM | dmesg -T | tail -50 dmesg | grep -i oom | |
strace | Syscall trace (slow, noisy) | strace -p $PID -f -e trace=network | |
lsof | List open files, ports, memory-mapped libs — find who listens on a port | sudo lsof -iTCP:443 -sTCP:LISTEN sudo lsof -i :8080 sudo lsof -p $PID sudo lsof +D /var/log 2>/dev/null | head | |
fuser | Report PIDs using file, socket, or filesystem | sudo fuser -v 443/tcp sudo fuser -km /mnt/stale # kill holders — careful | |
perf | Linux profiler — CPU hotspots (needs perf package) | sudo perf top -p $PID sudo perf record -g -p $PID sleep 15 && sudo perf report | |
gdb | Attach to running process — stack traces | sudo gdb -p $PID -batch -ex 'thread apply all bt' -ex q | |
tcpdump | Packet capture | sudo tcpdump -i any port 443 -nn -c 20 | |
sar / iostat / vmstat | Historical CPU, IO, memory | iostat -xz 1 vmstat 1 5 | |
ss -s | Socket summary stats | ss -s | |
uptime / w | Load average & who is logged in | uptime w | |
last / lastb | Login history / failed logins | last -10 sudo lastb | head |
Docker
Containers — images, runs, compose, cleanup.
| Command | What it does | Example | |
|---|---|---|---|
docker ps | Running containers — all & sizes | docker ps -a docker ps -s | |
docker images | Local images | docker images docker image prune -a | |
docker pull / push / build | Registry & Dockerfile build | docker build -t myapp:1 . docker push registry/myapp:1 | |
docker run | Start container — ports, env, detach | docker run -d -p 8080:80 --name web nginx docker run -it --rm alpine sh | |
docker exec | Shell inside running container | docker exec -it web bash | |
docker logs | Stdout/stderr — follow | docker logs -f --tail 100 web | |
docker inspect | Full JSON metadata | docker inspect -f '{{.NetworkSettings.IPAddress}}' web | |
docker stats | Live CPU/mem per container | docker stats --no-stream | |
docker compose | Multi-service stacks | docker compose up -d docker compose logs -f api | |
docker network / volume | Networks & named volumes | docker network ls docker volume prune | |
docker system prune | Remove unused data — careful | docker system df docker system prune -a |
Kubernetes (kubectl)
Minimum kubectl you need to inspect and fix clusters.
| Command | What it does | Example | |
|---|---|---|---|
kubectl get | List resources — wide, all namespaces | kubectl get pods -A kubectl get nodes -o wide | |
kubectl describe | Events & reasons for failures | kubectl describe pod mypod -n prod | |
kubectl logs | Pod logs — previous crash | kubectl logs deploy/api -f --tail=200 kubectl logs pod/x -p | |
kubectl exec | Shell in pod | kubectl exec -it mypod -n prod -- /bin/sh | |
kubectl apply | Declarative apply | kubectl apply -f manifest.yaml kubectl apply -k overlays/dev | |
kubectl delete | Remove resources | kubectl delete pod stuck-pod --force --grace-period=0 | |
kubectl port-forward | Local tunnel to pod/service | kubectl port-forward svc/grafana 3000:3000 | |
kubectl rollout | Deployments — status, undo | kubectl rollout status deploy/api kubectl rollout undo deploy/api | |
kubectl config | Contexts & kubeconfig | kubectl config use-context staging kubectl config get-contexts | |
kubectl top | Metrics (needs metrics-server) | kubectl top pods kubectl top nodes | |
kubectl get events | Cluster events stream | kubectl get events -n prod --sort-by=.lastTimestamp | |
helm | Kubernetes packages — releases & upgrades (install Helm) | helm list -A helm upgrade --install mychart ./chart -n prod helm rollback myrelease 1 -n prod |
Packages (apt / yum / rpm)
Install and inspect software on Debian/Ubuntu, RHEL/CentOS/Fedora, and SuSE-style systems.
| Command | What it does | Example | |
|---|---|---|---|
apt / apt-get | Debian/Ubuntu packages — update index, install, search | sudo apt update && sudo apt upgrade -y sudo apt install -y nginx curl apt-cache search postgres | |
dpkg / apt-file | Inspect .deb packages — which file belongs to which package | dpkg -l | grep nginx dpkg -L nginx sudo apt-file search bin/jpegtran | |
yum / dnf | RHEL/CentOS/Fedora packages — install, group list | sudo dnf install -y git sudo dnf upgrade --refresh sudo yum repolist all | |
rpm | RPM query — list files, verify, last install | rpm -qa | grep kernel rpm -ql nginx rpm -qi bash rpm -qf /usr/bin/python3 | |
snap / flatpak | Universal packages — sandboxed apps | snap list sudo snap install kubectl --classic flatpak remote-ls | head |
Archives & rsync
Ship configs, logs, and artifacts — tarball, compress, and incremental sync.
| Command | What it does | Example | |
|---|---|---|---|
tar | Tape archive — create/extract .tar, combine with gzip/xz | tar czf backup.tgz /etc/nginx tar xzf release.tar.gz tar tvf backup.tar | head | |
gzip / gunzip / zcat | Compress single files — gzip keeps timestamp | gzip -k big.log zcat access.log.gz | head | |
zip / unzip | PKZIP archives — common on Windows exchanges | zip -r dist.zip build/ unzip -l archive.zip | |
rsync | Incremental copy — deploys, backups, preserve perms | rsync -avz ./site/ user@host:/var/www/ rsync -av --delete src/ backup/src/ rsync -e ssh -avz data/ backup-host:/data/ |
Git, env & shells
Version control quick hits and environment inspection for CI/CD and debugging.
| Command | What it does | Example | |
|---|---|---|---|
git | Clone, diff, history — daily workflow | git clone https://github.com/org/repo.git git status git log -3 --oneline git diff --stat origin/main | |
env / printenv | Show environment variables | env | sort printenv PATH export MY_VAR=test | |
ssh-keygen / ssh-agent | Keys for Git & SSH | ssh-keygen -t ed25519 -C 'you@company.com' eval $(ssh-agent) && ssh-add ~/.ssh/id_ed25519 |
AWS CLI & Terraform
Identity checks and infra workflows when cloud CLIs are installed on the bastion or CI runner.
| Command | What it does | Example | |
|---|---|---|---|
aws | AWS CLI — STS identity, EC2, S3, CloudWatch logs tail | aws sts get-caller-identity aws configure list aws ec2 describe-instances --filters Name=tag:Env,Values=prod --query ... aws logs tail /ecs/my-service --since 10m --follow | |
terraform | Plan and apply infrastructure as code | terraform fmt -recursive terraform init terraform plan -out=tfplan terraform apply tfplan | |
jq | JSON filter — pipe kubectl/aws output | kubectl get pods -o json | jq '.items[].metadata.name' aws ec2 describe-instances | jq '.Reservations[].Instances[].InstanceId' |