linux-kernel-systemd-internals
Provides patterns for Linux kernel architecture, the systemd init subsystem, and advanced server administration based on systemd for Linux SysAdmins (David Both) and Understanding Linux Kernel Development. Covers unit management (.service, .socket, .timer, .mount), cgroups v2, journald, namespaces, kernel networking (Netfilter, eBPF, sockets), and sysctl performance tuning.
Informations de source
- Dépôt
- dandgabr/Coacus
- Dernière activité de la source
- 28 septembre 2026 à 14:03
- Langue détectée de SKILL.md
- anglais
- Étoiles
- 4
- Forks
- 3
Options d'installation
Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.
Vérifiez les fichiers source
Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.
Explorateur de fichiers
5 fichiersAffichage de SKILL.md
SKILL.md
Instructions source · Aperçu en lecture seule- name
- linux-kernel-systemd-internals
- description
- Provides patterns for Linux kernel architecture, the systemd init subsystem, and advanced server administration based on systemd for Linux SysAdmins (David Both) and Understanding Linux Kernel Development. Covers unit management (.service, .socket, .timer, .mount), cgroups v2, journald, namespaces, kernel networking (Netfilter, eBPF, sockets), and sysctl performance tuning.
# Linux Kernel, systemd, and Advanced System Administration
This skill establishes the standards and practices for Linux operating-system engineering, service management through **systemd**, resource control with **cgroups v2**, and network/kernel tuning documented by **David Both**, **Lincoln Boucher**, and **Christian Benvenuti**.
---
## 🐧 1. systemd Architecture and Unit Types
```
┌─────────────────────────────────────────────────────────────┐
│ systemd (PID 1) │
├──────────────┬──────────────┬──────────────┬────────────────┤
│ .service │ .socket │ .timer │ .mount │
│ (Daemons and │ (Network │ (Precise │ (Mount │
│ Processes) │ Activation) │ Scheduling) │ Points) │
└──────────────┴──────────────┴──────────────┴────────────────┘
```
### Anatomy of a Secure Service (`/etc/systemd/system/myapp.service`)
```ini
[Unit]
Description=High-Availability Microservice Platform
After=network.target postgresql.service
Requires=postgresql.service
[Service]
Type=notify
ExecStart=/usr/local/bin/myapp --config /etc/myapp/config.yaml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s
# Hardening and Security Isolation
User=appuser
Group=appgroup
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictRealtime=true
MemoryMax=2G
CPUQuota=200%
[Install]
WantedBy=multi-user.target
```
---
## ⚙️ 2. Kernel Performance Tuning (`/etc/sysctl.d/99-custom.conf`)
| Sysctl Parameter | Recommended Value | Purpose |
| :--- | :--- | :--- |
| `net.core.somaxconn` | `65535` | Increases the size of the pending-connection queue for the TCP listener. |
| `net.ipv4.tcp_max_syn_backlog` | `65535` | Protects against traffic spikes and SYN floods. |
| `net.ipv4.ip_local_port_range` | `1024 65535` | Expands the ephemeral port range for outbound connections. |
| `vm.swappiness` | `10` | Avoids aggressive swap use, preserving RAM for cache. |
| `fs.file-max` | `2097152` | Global limit of open file descriptors. |
Voir sur GitHub