linux-kernel-systemd-internals
Provides patterns for Linux kernel architecture, the systemd init subsystem, and advanced server administration based on systemd for Linux SysAdmins (David Both) and Understanding Linux Kernel Development. Covers unit management (.service, .socket, .timer, .mount), cgroups v2, journald, namespaces, kernel networking (Netfilter, eBPF, sockets), and sysctl performance tuning.
Datos de origen
- Repositorio
- dandgabr/Coacus
- Última actividad en el origen
- 28 de septiembre de 2026 a las 14:03
- Idioma detectado de SKILL.md
- inglés
- Estrellas
- 4
- Forks
- 3
Opciones de instalación
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Revisa los archivos de origen
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Explorador de archivos
5 archivosMostrando SKILL.md
SKILL.md
Instrucciones de origen · Vista previa de solo lectura- name
- linux-kernel-systemd-internals
- description
- Provides patterns for Linux kernel architecture, the systemd init subsystem, and advanced server administration based on systemd for Linux SysAdmins (David Both) and Understanding Linux Kernel Development. Covers unit management (.service, .socket, .timer, .mount), cgroups v2, journald, namespaces, kernel networking (Netfilter, eBPF, sockets), and sysctl performance tuning.
# Linux Kernel, systemd, and Advanced System Administration
This skill establishes the standards and practices for Linux operating-system engineering, service management through **systemd**, resource control with **cgroups v2**, and network/kernel tuning documented by **David Both**, **Lincoln Boucher**, and **Christian Benvenuti**.
---
## 🐧 1. systemd Architecture and Unit Types
```
┌─────────────────────────────────────────────────────────────┐
│ systemd (PID 1) │
├──────────────┬──────────────┬──────────────┬────────────────┤
│ .service │ .socket │ .timer │ .mount │
│ (Daemons and │ (Network │ (Precise │ (Mount │
│ Processes) │ Activation) │ Scheduling) │ Points) │
└──────────────┴──────────────┴──────────────┴────────────────┘
```
### Anatomy of a Secure Service (`/etc/systemd/system/myapp.service`)
```ini
[Unit]
Description=High-Availability Microservice Platform
After=network.target postgresql.service
Requires=postgresql.service
[Service]
Type=notify
ExecStart=/usr/local/bin/myapp --config /etc/myapp/config.yaml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s
# Hardening and Security Isolation
User=appuser
Group=appgroup
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictRealtime=true
MemoryMax=2G
CPUQuota=200%
[Install]
WantedBy=multi-user.target
```
---
## ⚙️ 2. Kernel Performance Tuning (`/etc/sysctl.d/99-custom.conf`)
| Sysctl Parameter | Recommended Value | Purpose |
| :--- | :--- | :--- |
| `net.core.somaxconn` | `65535` | Increases the size of the pending-connection queue for the TCP listener. |
| `net.ipv4.tcp_max_syn_backlog` | `65535` | Protects against traffic spikes and SYN floods. |
| `net.ipv4.ip_local_port_range` | `1024 65535` | Expands the ephemeral port range for outbound connections. |
| `vm.swappiness` | `10` | Avoids aggressive swap use, preserving RAM for cache. |
| `fs.file-max` | `2097152` | Global limit of open file descriptors. |
Ver en GitHub