The core discipline in this manual is simple: collect evidence before you mutate anything. Every recipe begins with read-only inspection, previews or validates the intended change, applies it narrowly and reversibly, and verifies from an independent vantage before the rollback safety net is dismantled. That ordering is not stylistic — it follows directly from how Linux failure modes work: a permission denial may be a parent directory's search bit, an ACL mask, an SELinux label, or an AppArmor profile (getfacl(1)); a "down" service may be reachable but TLS-broken, or listening on loopback only (ss(8)); a "full" disk may be inodes, deleted-but-open files, or hidden data under a mount point (df(1)). Guessing at any of those with a mutating command is how outages become data loss. This edition covers Ubuntu/Debian, Fedora/RHEL/AlmaLinux, and Arch Linux, states distribution and init-system differences explicitly instead of assuming them, and marks every operation as read-only, mutating, or high-risk — with the warning before the command. Every factual claim carries a citation to the project, distribution, or standards documentation it came from, and everything here was checked against those sources on 2026-10-10; version-dependent behavior is flagged rather than presented as perpetual truth.
How to use this manual
Each chapter below is designed to become one website page; the PAGE comments in this source mark the split points. Chapters are modular on purpose: the networking chapter does not require the storage chapter, and an administrator who needs one recipe can link straight to the relevant page.
Conventions used throughout
- Privilege is labeled. Commands needing elevated privilege are marked [root] and assume
sudofor interactive work; anything that works as a normal user is unmarked. - Mutation class is labeled. [READ-ONLY] commands change nothing; [MUTATING] commands change system state; [HIGH-RISK] commands can cause data loss, lockout, or prolonged outage. This inspection/mutation split is the manual's spine — diagnosis should never require a change.
- Portability is labeled. [POSIX sh] marks syntax valid in any POSIX shell (POSIX Shell & Utilities); [Bash] marks Bash-only features (arrays,
[[ ]], process substitution, brace expansion,pipefail) (Bash Reference Manual); [GNU] marks GNU-only options such asfind -print0,xargs -0,du -h,du -d, andcp -a(GNU Coreutils: Standards conformance); [systemd], [Debian/Ubuntu], [Fedora/RHEL/AlmaLinux], [Arch] mark platform-dependent workflows. - Warnings precede commands. For any high-risk operation, five callouts appear first: what it changes; what can be lost or locked out; preflight checks; a recoverable rollback; and a positive success check. "Be careful" is not an acceptable substitute where tool documentation describes irreversible loss (cryptsetup(8)).
- Citations are inline.
([Source](URL))links sit beside the claims they support, so a reader can verify any statement in one click. - Placeholders are never literal. Device names such as
/dev/sdXin examples must be replaced after positive identification of the target (serial/WWN, size, mount state) — see the storage chapter's identity discipline (lsblk(8)).
Currency and verification
All commands, options, and cited behaviors were checked on 2026-10-10 against the linked official documentation. Nothing here claims perpetual currency: package-manager major versions, service unit names, default security modules, and man-page option sets change between releases. Where the research could not fetch a page (systemd upstream returned HTTP 418 to automated retrieval; Red Hat's SELinux and RHEL 9 networking portals returned access denials; some Ubuntu Server pages are behind an interactive wall), the canonical URLs are still cited and the affected material is flagged for re-verification before being turned into release-specific site procedures. When in doubt on a host, the installed man page and command --help are authoritative for that host's actual version.