linux-kernel-systemd-internals
Provides patterns for Linux kernel architecture, the systemd init subsystem, and advanced server administration based on systemd for Linux SysAdmins (David Both) and Understanding Linux Kernel Development. Covers unit management (.service, .socket, .timer, .mount), cgroups v2, journald, namespaces, kernel networking (Netfilter, eBPF, sockets), and sysctl performance tuning.
来源信息
- 仓库
- dandgabr/Coacus
- 最近来源活动
- 2026年9月28日 14:03
- 检测到的 SKILL.md 语言
- 英语
- 星标
- 4
- 分支
- 3
安装方式
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
检查来源文件
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
文件资源管理器
5 个文件正在显示 SKILL.md
SKILL.md
来源说明 · 只读预览- name
- linux-kernel-systemd-internals
- description
- Provides patterns for Linux kernel architecture, the systemd init subsystem, and advanced server administration based on systemd for Linux SysAdmins (David Both) and Understanding Linux Kernel Development. Covers unit management (.service, .socket, .timer, .mount), cgroups v2, journald, namespaces, kernel networking (Netfilter, eBPF, sockets), and sysctl performance tuning.
# Linux Kernel, systemd, and Advanced System Administration
This skill establishes the standards and practices for Linux operating-system engineering, service management through **systemd**, resource control with **cgroups v2**, and network/kernel tuning documented by **David Both**, **Lincoln Boucher**, and **Christian Benvenuti**.
---
## 🐧 1. systemd Architecture and Unit Types
```
┌─────────────────────────────────────────────────────────────┐
│ systemd (PID 1) │
├──────────────┬──────────────┬──────────────┬────────────────┤
│ .service │ .socket │ .timer │ .mount │
│ (Daemons and │ (Network │ (Precise │ (Mount │
│ Processes) │ Activation) │ Scheduling) │ Points) │
└──────────────┴──────────────┴──────────────┴────────────────┘
```
### Anatomy of a Secure Service (`/etc/systemd/system/myapp.service`)
```ini
[Unit]
Description=High-Availability Microservice Platform
After=network.target postgresql.service
Requires=postgresql.service
[Service]
Type=notify
ExecStart=/usr/local/bin/myapp --config /etc/myapp/config.yaml
ExecReload=/bin/kill -HUP $MAINPID
Restart=on-failure
RestartSec=5s
# Hardening and Security Isolation
User=appuser
Group=appgroup
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
RestrictRealtime=true
MemoryMax=2G
CPUQuota=200%
[Install]
WantedBy=multi-user.target
```
---
## ⚙️ 2. Kernel Performance Tuning (`/etc/sysctl.d/99-custom.conf`)
| Sysctl Parameter | Recommended Value | Purpose |
| :--- | :--- | :--- |
| `net.core.somaxconn` | `65535` | Increases the size of the pending-connection queue for the TCP listener. |
| `net.ipv4.tcp_max_syn_backlog` | `65535` | Protects against traffic spikes and SYN floods. |
| `net.ipv4.ip_local_port_range` | `1024 65535` | Expands the ephemeral port range for outbound connections. |
| `vm.swappiness` | `10` | Avoids aggressive swap use, preserving RAM for cache. |
| `fs.file-max` | `2097152` | Global limit of open file descriptors. |
在 GitHub 查看