Buy me a Koffee
Linux Commands Cheat Sheet
180+ Linux commands for file operations, text processing, process management, networking, permissions, disk, systemd, and package management. Includes a Distro Rosetta Stone. Verified against man pages.
Everything runs in your browser. No commands or data are sent to any server.
New to Linux? Start with these
5 essential commands to get you started. The full reference is right below.
List files and directories
ls -la List files and directories in the current directory.
Change the current directory
cd /path/to/directory Change the current working directory.
Search for text inside files
grep -r "search term" /path Search for text inside files.
Change file permissions
chmod 755 filename Change file permissions.
List all running processes
ps aux List all running processes with their CPU and memory usage.
List files and directories
ls -la ↓ Click command to explain
-l Long format showing permissions, size, and date -a Shows hidden files starting with a dot -h Human readable file sizes -t Sorts by modification time, newest first -r Reverses sort order When to use this
List files and directories in the current directory.
Gotcha
ls -la is the most useful combination, showing all files including hidden ones in long format with permissions and sizes.
Change the current directory
cd /path/to/directory ↓ Click command to explain
cd (no arguments) Goes to the home directory cd - Goes back to the previous directory cd .. Goes up one level When to use this
Change the current working directory.
Gotcha
cd - is one of the most useful shortcuts for switching between two directories quickly.
Search for text inside files
grep -r "search term" /path ↓ Click command to explain
-r Recursive search through directories -i Case insensitive -n Shows line numbers -l Shows only filenames with matches -v Inverts to show lines that do not match -E Enables extended regex When to use this
Search for text inside files.
Gotcha
Always quote your search term to prevent the shell from interpreting special characters.
Change file permissions
chmod 755 filename ↓ Click command to explain
-R Applies recursively to all files and subdirectories u+x Adds execute permission for the owner a-w Removes write permission for everyone When to use this
Change file permissions.
Gotcha
755 means the owner can read, write, and execute, while group and others can read and execute but not write. Never use 777 on files that will be executed or that contain sensitive data.
List all running processes
ps aux ↓ Click command to explain
a Shows processes from all users u Shows user-oriented format with CPU and memory x Shows processes without a controlling terminal When to use this
List all running processes with their CPU and memory usage.
Gotcha
ps aux is a snapshot in time. Use top or htop for a live updating view.
Print the current directory path
pwd When to use this
Print the full path of the current working directory.
Create a new directory
mkdir -p /path/to/new/directory ↓ Click command to explain
-p Creates all parent directories in the path if they do not exist When to use this
Create a new directory.
Gotcha
Without -p, mkdir fails if the parent directory does not exist.
Copy files or directories
cp -r source/ destination/ ↓ Click command to explain
-r Copies directories recursively -p Preserves file timestamps and permissions -i Prompts before overwriting -v Verbose, shows each file being copied When to use this
Copy files or directories.
Gotcha
cp overwrites the destination without warning unless you use -i.
Move or rename files and directories
mv oldname newname ↓ Click command to explain
-i Prompts before overwriting -v Verbose, shows what is being moved When to use this
Move or rename files and directories.
Gotcha
mv overwrites the destination file without warning, and there is no recycle bin on Linux.
Delete files or directories
rm -rf /path/to/directory ↓ Click command to explain
-r Removes directories and their contents recursively -f Forces deletion without prompting -i Prompts before each deletion -v Verbose, shows each file deleted When to use this
Delete files or directories.
Gotcha
rm -rf is permanent with no undo and no trash. Triple check the path before running it, especially as root.
Create an empty file or update its timestamp
touch filename.txt ↓ Click command to explain
When to use this
Create an empty file or update the timestamp of an existing file.
Display the contents of a file
cat filename.txt ↓ Click command to explain
-n Shows line numbers -A Shows non-printing characters When to use this
Display the contents of a file.
Gotcha
cat is not good for large files. Use less or tail instead.
View a file one page at a time
less filename.txt ↓ Click command to explain
When to use this
View a file one page at a time with the ability to scroll up and down.
Gotcha
Press q to quit, use slash to search within the file, and press n to find the next match.
Show the first lines of a file
head -n 20 filename.txt ↓ Click command to explain
-n Sets how many lines to show, default is 10 When to use this
Show the first lines of a file.
Show the last lines of a file or follow it
tail -f /var/log/nginx/access.log ↓ Click command to explain
-n Sets how many lines to show -f Follows the file and prints new lines as they are written When to use this
Show the last lines of a file or stream new log lines in real time.
Gotcha
tail -f is one of the most used commands for watching log files during debugging.
Search for files by name, type, size, or time
find /path -name "*.log" -mtime +7 ↓ Click command to explain
-name Matches by filename -type f Finds only files -type d Finds only directories -mtime +7 Finds files modified more than 7 days ago -size +100M Finds files larger than 100MB -exec Runs a command on each result When to use this
Search for files by name, type, size, or modification time.
Gotcha
find searches recursively by default. Always test with -ls or -print before using -exec rm to delete found files.
Create a symbolic link
ln -s /path/to/original /path/to/link ↓ Click command to explain
When to use this
Create a symbolic link to a file or directory.
Gotcha
The order is source first, then link name. Reversing these creates a broken symlink.
Check how much space a directory uses
du -sh /path/to/directory ↓ Click command to explain
-s Summarizes total size instead of listing each file -h Human readable sizes When to use this
Check how much disk space a directory is using.
Count lines, words, or bytes in a file
wc -l filename.txt ↓ Click command to explain
-l Counts lines -w Counts words -c Counts bytes When to use this
Count lines, words, or bytes in a file.
Compare two files
diff file1.txt file2.txt ↓ Click command to explain
-u Unified format, shows context lines -r Compares directories recursively -i Ignores case differences When to use this
Compare two files line by line and show the differences.
Create or extract compressed archives
tar -czf archive.tar.gz /path/to/directory ↓ Click command to explain
-c Creates an archive -x Extracts an archive -z Compresses with gzip -j Compresses with bzip2 -v Verbose, shows files being processed -f Specifies the archive filename When to use this
Create or extract compressed archives.
Gotcha
Remember the flags with the phrase create czf, extract xzf. The f flag must come last because it takes the filename as the next argument.
Sync files between local and remote directories
rsync -avz /source/ user@host:/destination/ ↓ Click command to explain
-a Archive mode, preserves permissions, timestamps, and symlinks -v Verbose -z Compresses during transfer --delete Removes files from destination that no longer exist in source --dry-run Previews without making changes When to use this
Sync files between local and remote directories efficiently.
Gotcha
The trailing slash on the source directory matters. With a slash, rsync copies the contents of the directory. Without a slash, it copies the directory itself.
Pass piped input as arguments to another command
find . -name "*.log" | xargs rm ↓ Click command to explain
-I Replaces a placeholder string with each input line -n Sets how many arguments to pass per command invocation -P Sets parallel processes When to use this
Pipe the output of one command as arguments to another command.
Gotcha
If filenames contain spaces, use find with -print0 and xargs with -0 to handle them correctly.
Determine a file's type
file unknown-file ↓ Click command to explain
When to use this
Determine the type of a file based on its content, not just its extension.
Show detailed file metadata
stat filename.txt ↓ Click command to explain
When to use this
Show detailed file metadata including size, permissions, inode, and all three timestamps.
Remove an empty directory
rmdir empty-directory ↓ Click command to explain
-p Removes a directory and its empty parent directories When to use this
Remove an empty directory.
Gotcha
rmdir only works on empty directories. Use rm -r for directories that still contain files.
Extract the filename from a path
basename /path/to/file.txt ↓ Click command to explain
When to use this
Extract just the filename from a full path, useful in shell scripts.
Extract the directory from a path
dirname /path/to/file.txt ↓ Click command to explain
When to use this
Extract just the directory portion from a full path, useful in shell scripts.
Resolve a symlink to its real target
readlink -f symlink-name ↓ Click command to explain
-f Resolves the link and every parent directory to an absolute path When to use this
Show the real target path that a symbolic link points to.
Gotcha
readlink -f is the most reliable way to resolve a chain of nested symlinks down to the real file.
Change permissions with symbolic notation
chmod u+x script.sh ↓ Click command to explain
u Owner g Group o Others a All + Adds permission - Removes permission = Sets exact permission When to use this
Add execute permission to a script for the owner using symbolic notation.
Gotcha
Symbolic notation is easier to read and less error prone than octal for making targeted changes like adding execute for the owner only.
Change permissions with octal notation
chmod 644 filename.txt ↓ Click command to explain
When to use this
Set permissions using octal notation, where 644 means the owner can read and write, the group can read only, and others can read only.
Gotcha
Common octal values to remember are 644 for files, 755 for directories and scripts, and 600 for private key files. 777 should almost never be used.
Change the owner and group of a file
chown user:group filename.txt ↓ Click command to explain
-R Applies recursively to all files and subdirectories When to use this
Change the owner and group of a file.
Gotcha
chown requires root or sudo unless you own the file. chown -R is one of the commands that can cause widespread permission problems if run on the wrong directory.
Change the group ownership of a file
chgrp groupname filename.txt ↓ Click command to explain
-R Applies recursively When to use this
Change only the group ownership of a file without changing the owner.
Set the default permission mask
umask 022 ↓ Click command to explain
When to use this
Set the default permission mask for new files and directories in the current shell session.
Gotcha
umask subtracts from the maximum permissions, so 022 means new files get 644 and new directories get 755.
Run a command with elevated privileges
sudo command ↓ Click command to explain
-u Runs as a different user -i Opens an interactive root shell -s Opens a shell as root When to use this
Run a command with superuser or another user's privileges.
Gotcha
Never run sudo rm -rf / and be extremely careful with sudo rm -rf on any path.
Switch to another user account
su - username ↓ Click command to explain
- Loads the target user's full environment; without it you keep your current environment When to use this
Switch to another user account.
Gotcha
su - with the hyphen is almost always what you want, because without it you keep the current user's PATH, which can cause confusing command-not-found errors.
Change a user account password
passwd username ↓ Click command to explain
When to use this
Change a user account password.
Show a user's ID and group memberships
id username ↓ Click command to explain
When to use this
Show the user ID, group ID, and all group memberships for a user.
List a user's group memberships
groups username ↓ Click command to explain
When to use this
List all groups a user belongs to.
Create a new user account
useradd -m -s /bin/bash username ↓ Click command to explain
-m Creates a home directory -s Sets the login shell -G Adds to supplementary groups When to use this
Create a new user account.
Gotcha
useradd without -m does not create a home directory, which causes login issues. Always use -m for interactive users.
Safely edit the sudoers file
visudo When to use this
Safely edit the sudoers file with syntax validation to grant or modify sudo permissions.
Gotcha
Never edit /etc/sudoers directly with a regular editor. A syntax error in sudoers can lock you out of sudo on the entire system. visudo validates syntax before saving.
View a file's access control list
getfacl filename.txt ↓ Click command to explain
When to use this
View the access control list of a file for permissions that go beyond the standard owner, group, and other model.
Grant a specific user permissions on a file
setfacl -m u:username:rwx filename.txt ↓ Click command to explain
-m Modifies the ACL by adding or changing an entry -x Removes an entry from the ACL When to use this
Grant a specific user or group permissions on a file without changing its primary owner or group.
Gotcha
ACLs let you grant extra users access without adding them to the file's group, useful when the standard owner and group model is not flexible enough.
Set special filesystem attributes
chattr +i filename.txt ↓ Click command to explain
+i Makes a file immutable so it cannot be deleted, modified, or renamed even by root -i Removes the immutable attribute When to use this
Set special filesystem attributes on a file, such as making it immutable to protect against accidental deletion.
Gotcha
An immutable file cannot be deleted even with sudo rm until the immutable attribute is removed with chattr -i first, which confuses people who forget they set it.
Search for lines containing a pattern
grep "error" /var/log/app.log ↓ Click command to explain
-i Case insensitive -n Shows line numbers -v Inverts match -c Counts matching lines -l Shows only filenames When to use this
Search for lines containing a pattern in a file.
Search using regex alternation
grep -E "error|warning|critical" /var/log/app.log ↓ Click command to explain
-E Enables extended regex -P Enables Perl-compatible regex When to use this
Search for multiple patterns using regex alternation.
Search recursively by file type
grep -r "TODO" --include="*.py" /path/to/project ↓ Click command to explain
--include Filters to specific file types --exclude Excludes file types When to use this
Search for a pattern across all files of a specific type in a directory tree.
Extract columns from delimited text
awk '{print $1, $3}' filename.txt ↓ Click command to explain
-F Sets the field separator -v Assigns a variable When to use this
Extract specific columns from a space or delimiter separated file.
Gotcha
awk counts fields starting from 1, not 0. $0 is the entire line, and $NF is the last field.
Filter rows with a condition in awk
awk '$3 > 100 {print $1, $3}' data.txt ↓ Click command to explain
When to use this
Filter rows based on a condition and print specific columns.
Find and replace text in a file
sed -i 's/old/new/g' filename.txt ↓ Click command to explain
-i Edits the file in place g Replaces all occurrences on each line, not just the first -e Allows multiple expressions When to use this
Find and replace text in a file in place.
Gotcha
Always test without -i first to see what sed would change before editing the file in place.
Delete lines matching a pattern
sed -i '/pattern/d' filename.txt ↓ Click command to explain
When to use this
Delete all lines matching a pattern from a file.
Extract a column from a delimited file
cut -d: -f1 /etc/passwd ↓ Click command to explain
-d Sets the delimiter -f Sets which field or fields to extract -c Extracts by character position When to use this
Extract a specific column from a delimited file.
Gotcha
cut is simpler than awk for simple column extraction but cannot handle variable whitespace as a delimiter.
Sort lines in a file
sort -k2 -n filename.txt ↓ Click command to explain
-n Numeric sort -r Reverse order -k Sorts by a specific column -u Removes duplicate lines -t Sets the field separator When to use this
Sort lines in a file alphabetically or numerically.
Gotcha
sort without -n sorts lexicographically, so 10 comes before 2. Always use -n for numeric sorting.
Count or deduplicate repeated lines
sort file.txt | uniq -c | sort -rn ↓ Click command to explain
-c Prefixes lines with occurrence count -d Shows only duplicate lines -u Shows only unique lines When to use this
Count or deduplicate repeated lines.
Gotcha
uniq only removes adjacent duplicate lines. Always sort first before piping to uniq.
Translate or delete characters in text
tr 'a-z' 'A-Z' < filename.txt ↓ Click command to explain
-d Deletes specified characters -s Squeezes repeated characters into one When to use this
Translate or delete characters in text.
Pipe output to a file and stdout at once
command | tee output.txt ↓ Click command to explain
-a Appends to the file instead of overwriting When to use this
Pipe output to both a file and stdout simultaneously so you can see it and save it at the same time.
Parse and extract values from JSON
jq '.key.nested' data.json ↓ Click command to explain
-r Raw output without quotes -c Compact output on one line -s Slurps multiple JSON inputs into an array When to use this
Parse and extract values from JSON files or API responses on the command line.
Gotcha
jq must be installed separately on most systems with apt install jq or brew install jq.
Extract a range of lines from a file
head -n 100 large.log | tail -n 10 ↓ Click command to explain
When to use this
Extract lines 91 through 100 from a file by combining head and tail.
Format delimited text into aligned columns
column -t -s, data.csv ↓ Click command to explain
-t Creates a table -s Sets the separator character When to use this
Format a comma or tab separated file into aligned columns for readable terminal output.
Merge files line by line
paste file1.txt file2.txt ↓ Click command to explain
-d Sets the delimiter between merged columns When to use this
Merge two files line by line side by side.
Extract text strings from a binary file
strings binary-file | grep -i password ↓ Click command to explain
When to use this
Extract printable text strings from a binary file.
Display a hexadecimal dump of a file
xxd filename | head ↓ Click command to explain
When to use this
Display a hexadecimal dump of a file for binary inspection.
Substitute environment variables in a template
envsubst < template.yaml > output.yaml ↓ Click command to explain
When to use this
Substitute environment variable references in a template file with their actual values.
Gotcha
Only replaces variables that are already exported in the current shell environment.
Encode or decode base64 text
echo -n "value" | base64 ↓ Click command to explain
-d Decodes instead of encoding When to use this
Encode text to base64 or decode base64 to text.
Gotcha
Always use echo -n to avoid encoding a trailing newline character, which changes the output.
Add line numbers to text
nl filename.txt ↓ Click command to explain
-b a Numbers every line including blank ones When to use this
Add line numbers to a file's output, similar to cat -n but with more formatting control.
Compare two sorted files
comm -12 sorted1.txt sorted2.txt ↓ Click command to explain
-1 Suppresses lines unique to the first file -2 Suppresses lines unique to the second file -3 Suppresses lines common to both files When to use this
Compare two sorted files and show lines that are unique to each or common to both.
Gotcha
comm requires both input files to already be sorted, or the comparison produces incorrect results.
Reverse the characters in each line
echo "hello" | rev ↓ Click command to explain
When to use this
Reverse the characters in each line of text.
Wrap long lines to a fixed width
fold -w 80 longline.txt ↓ Click command to explain
-w Sets the maximum line width before wrapping When to use this
Wrap long lines of text to a fixed width, useful for formatting output for terminals or fixed-width displays.
List running processes with resource usage
ps aux ↓ Click command to explain
When to use this
List all running processes with user, CPU, and memory information.
Gotcha
ps aux is a snapshot. Combine it with grep to find a specific process, like ps aux | grep nginx.
Monitor processes in real time
top 1 Press 1 to show individual CPUs M Press M to sort by memory P Press P to sort by CPU k Press k to kill a process by PID q Press q to quit When to use this
Monitor system processes and resource usage in real time.
Gotcha
htop is a more user-friendly alternative if it is installed.
Terminate a process by PID
kill -9 PID ↓ Click command to explain
-9 Sends SIGKILL, which cannot be caught or ignored -15 Sends SIGTERM, which allows graceful shutdown -HUP Sends SIGHUP, which reloads configuration for many daemons When to use this
Terminate a process by its PID.
Gotcha
Always try kill PID (SIGTERM) first and only use kill -9 if the process does not respond. SIGKILL prevents the process from cleaning up resources.
Terminate processes by name
killall nginx ↓ Click command to explain
-9 Sends SIGKILL -u Kills only processes owned by a specific user When to use this
Terminate all processes with a matching name.
Gotcha
killall matches by exact process name. pkill is more flexible and supports patterns.
Kill processes matching a pattern
pkill -f "python script.py" ↓ Click command to explain
-f Matches against the full command line including arguments -u Matches only processes owned by a user -9 Sends SIGKILL When to use this
Kill processes matching a name or pattern.
Find a process's PID by name
pgrep -a nginx ↓ Click command to explain
-a Shows the full command line -l Shows the process name alongside the PID -u Filters by user When to use this
Find the PID of a running process by name.
Run a command that survives logout
nohup ./script.sh > output.log 2>&1 & ↓ Click command to explain
When to use this
Run a command that continues after you log out by ignoring the HUP signal.
Gotcha
The & at the end runs the command in the background. Redirect both stdout and stderr with 2>&1 so you do not lose error messages.
List background jobs in the current shell
jobs When to use this
List all background jobs running in the current shell session.
Resume a suspended job in the background
bg %1 ↓ Click command to explain
When to use this
Resume a suspended background job.
Bring a background job to the foreground
fg %1 ↓ Click command to explain
When to use this
Bring a background job to the foreground.
Run a command with lower CPU priority
nice -n 10 command ↓ Click command to explain
-n Sets the priority from -20 (highest) to 19 (lowest); default niceness is 0 When to use this
Run a command with a lower CPU priority so it does not slow down other processes.
Gotcha
Only root can set a negative nice value to increase priority.
Change the priority of a running process
renice -n 15 -p PID ↓ Click command to explain
When to use this
Change the CPU scheduling priority of an already running process.
List open files and network connections
lsof -i :8080 ↓ Click command to explain
-i Filters by network connection -p Filters by PID -u Filters by user -c Filters by command name When to use this
List open files and network connections, most commonly used to find which process is using a specific port.
Gotcha
lsof -i :PORT is one of the fastest ways to find what is listening on a port.
Trace system calls made by a process
strace -p PID ↓ Click command to explain
-p Attaches to a running process -e trace Filters to specific system calls -o Writes output to a file When to use this
Trace system calls made by a running process to debug unexpected behavior.
Gotcha
strace adds significant overhead to the traced process. Do not use it on performance-sensitive production processes.
Run a command repeatedly at an interval
watch -n 2 "df -h" ↓ Click command to explain
-n Sets the refresh interval in seconds -d Highlights differences between updates When to use this
Run a command repeatedly at an interval and show updated output.
Show processes as a parent-child tree
pstree -p ↓ Click command to explain
-p Shows PIDs alongside each process When to use this
Show running processes as a tree, making it easy to see which process spawned which.
Report memory, CPU, and I/O statistics
vmstat 2 5 ↓ Click command to explain
When to use this
Report virtual memory, process, CPU, and I/O statistics at a regular interval, useful for spotting memory pressure or CPU bottlenecks.
Gotcha
The first line of vmstat output is an average since boot. Ignore it and look at the following lines for current activity.
Measure how long a command takes
time ./script.sh ↓ Click command to explain
When to use this
Measure how long a command takes to run, broken down into real, user, and system time.
Gotcha
real is wall clock time, user is CPU time spent in the process itself, and sys is CPU time spent in kernel calls on the process's behalf.
Make HTTP requests from the command line
curl -X POST https://api.example.com/endpoint -H "Content-Type: application/json" -d '{"key":"value"}' ↓ Click command to explain
-X Sets the HTTP method -H Adds a header -d Sends request body data -o Saves output to a file -I Shows only headers -s Silent mode -L Follows redirects --insecure Skips SSL verification When to use this
Make HTTP requests from the command line.
Gotcha
Always use -v to debug connection problems and see the full request and response headers.
Download files from the internet
wget https://example.com/file.tar.gz ↓ Click command to explain
-O Saves to a specific filename -q Quiet mode -r Recursive download --no-check-certificate Skips SSL verification When to use this
Download files from the internet.
Test basic network connectivity
ping -c 4 google.com ↓ Click command to explain
-c Sets the number of packets to send -i Sets the interval between packets When to use this
Test basic network connectivity to a host.
List listening ports and connections
netstat -tlnp ↓ Click command to explain
-t Shows TCP connections -u Shows UDP -l Shows listening sockets -n Shows numeric addresses instead of resolving hostnames -p Shows the process using the socket When to use this
List all listening ports and their associated processes.
Gotcha
netstat is deprecated on modern Linux. Use ss instead, which is faster and more feature-rich.
List listening ports, the modern netstat replacement
ss -tlnp ↓ Click command to explain
-t TCP -u UDP -l Listening only -n Numeric -p Shows process When to use this
List listening ports and connections, the modern replacement for netstat.
Show IP addresses on network interfaces
ip addr show ↓ Click command to explain
show Displays all interfaces ip addr show eth0 Shows a specific interface When to use this
Show IP addresses assigned to all network interfaces.
Gotcha
ifconfig is deprecated. Use ip addr instead.
Display the routing table
ip route show ↓ Click command to explain
When to use this
Display the routing table.
Query DNS records for a domain
dig google.com A ↓ Click command to explain
A Queries the A record MX Queries mail records TXT Queries text records @8.8.8.8 Queries a specific DNS server +short Shows only the answer When to use this
Query DNS records for a domain.
Gotcha
dig is more detailed than nslookup and is the preferred tool for DNS troubleshooting.
Resolve a hostname to an IP address
nslookup google.com ↓ Click command to explain
When to use this
Query DNS to resolve a hostname to an IP address.
Gotcha
nslookup is simpler than dig but less feature-rich. Use dig for detailed DNS troubleshooting.
Trace the network path to a host
traceroute google.com ↓ Click command to explain
-n Shows numeric IPs without reverse DNS lookup When to use this
Trace the network path to a host, showing each hop and its latency.
Gotcha
traceroute may be blocked by firewalls, which can make hops appear as asterisks rather than IP addresses.
Scan a host for open ports and services
nmap -sV -p 80,443 192.168.1.1 ↓ Click command to explain
-sV Detects service versions -p Specifies ports -A Enables OS detection and version detection -sn Ping scan only, without port scanning When to use this
Scan a host or network for open ports and running services.
Gotcha
Never run nmap against hosts you do not own or have permission to scan.
Connect to a remote machine securely
ssh user@hostname ↓ Click command to explain
-i Specifies a private key file -p Specifies a non-standard port -L Sets up local port forwarding -R Sets up remote port forwarding -N Does not execute a command, just sets up tunneling When to use this
Connect to a remote machine securely.
Copy files over SSH
scp -r user@host:/remote/path /local/path ↓ Click command to explain
-r Copies directories recursively -P Specifies a non-standard port -i Specifies a private key When to use this
Copy files to or from a remote machine over SSH.
Gotcha
scp is being deprecated in favor of rsync or sftp for most use cases.
Test if a port is open with netcat
nc -zv hostname 80 ↓ Click command to explain
-z Scan mode, tests if a port is open without sending data -v Verbose -l Listen mode -p Specifies port When to use this
Test if a specific port is open on a remote host.
Gotcha
nc -zv is one of the fastest ways to test port connectivity without curl or telnet.
View or modify firewall rules
iptables -L -n -v ↓ Click command to explain
-L Lists all rules -n Numeric output -v Verbose, shows packet and byte counts -A Appends a rule -D Deletes a rule -I Inserts a rule When to use this
View or modify Linux firewall rules.
Gotcha
iptables changes are not persistent across reboots by default. Use iptables-save and iptables-restore, or a tool like ufw or firewalld, to manage persistent rules.
Manage the Ubuntu firewall
ufw allow 80/tcp ↓ Click command to explain
allow Permits traffic deny Blocks traffic status Shows current rules enable Activates the firewall disable Deactivates it When to use this
Manage the Ubuntu uncomplicated firewall.
Gotcha
Always verify ufw allow 22 before enabling ufw on a remote SSH session, or you will lock yourself out.
Show the hostname or IP of this machine
hostname -I ↓ Click command to explain
-I Shows all IP addresses -f Shows the fully qualified domain name When to use this
Show the hostname or IP addresses of the current machine.
Get only the HTTP status code from a URL
curl -o /dev/null -s -w "%{http_code}" https://example.com ↓ Click command to explain
When to use this
Get only the HTTP status code from a URL for use in health check scripts.
Show network interface link status
ip link show ↓ Click command to explain
When to use this
Show the status of network interfaces at the link layer, including whether they are up or down.
Show the ARP cache
arp -a ↓ Click command to explain
-a Lists all entries in the ARP cache -d Deletes an entry from the ARP cache When to use this
Show the ARP cache mapping local network IP addresses to MAC addresses.
Gotcha
On modern systems ip neigh is the replacement for arp, in the same way ip addr replaced ifconfig.
Look up domain registration information
whois example.com ↓ Click command to explain
When to use this
Look up domain registration information including the registrar and expiration date.
Measure request latency with curl
curl -o /dev/null -s -w "%{time_total}\n" https://example.com ↓ Click command to explain
When to use this
Measure the total time a request takes, useful for basic latency checks against an endpoint.
Show disk space on mounted filesystems
df -h ↓ Click command to explain
-h Human readable sizes -T Shows the filesystem type -i Shows inode usage instead of block usage When to use this
Show available and used disk space on all mounted filesystems.
Gotcha
df shows filesystem usage while du shows directory usage. Use both to understand disk space problems.
Find the largest directories in root
du -sh /* 2>/dev/null | sort -rh | head -20 ↓ Click command to explain
When to use this
Find the top 20 largest directories in the root filesystem.
List block devices and partitions
lsblk -f Shows filesystem information -o Customizes output columns When to use this
List block devices including disks and partitions in a tree view.
Mount a filesystem
mount /dev/sdb1 /mnt/data ↓ Click command to explain
-t Specifies the filesystem type -o Sets mount options, like ro for read only When to use this
Mount a filesystem to make it accessible at a directory path.
Unmount a filesystem
umount /mnt/data ↓ Click command to explain
When to use this
Unmount a filesystem.
Gotcha
Unmounting fails if any process has open files on the filesystem. Use lsof +D /mnt/data to find them.
List or manage disk partitions
fdisk -l ↓ Click command to explain
-l Lists the partition table When to use this
List partition tables or manage disk partitions.
Gotcha
fdisk operations are destructive. Partition changes take effect only after writing with w. Use lsblk and df first to understand the current state.
Format a partition with a filesystem
mkfs.ext4 /dev/sdb1 ↓ Click command to explain
When to use this
Format a partition with a filesystem.
Gotcha
mkfs permanently erases all data on the partition. Double check the device name with lsblk before running.
Copy raw data between devices
dd if=/dev/sda of=/dev/sdb bs=64M status=progress ↓ Click command to explain
if Input file or device of Output file or device bs Block size status=progress Shows copy progress When to use this
Copy raw data between devices for disk cloning or creating disk images.
Gotcha
dd has no safety checks. A single typo swapping if and of can wipe your source disk.
Monitor disk I/O performance
iostat -x 2 ↓ Click command to explain
-x Shows extended statistics 2 Sets the refresh interval in seconds When to use this
Monitor disk I/O performance in real time.
Gotcha
iostat is part of the sysstat package and may need to be installed.
Interactively browse disk usage
ncdu /path/to/directory ↓ Click command to explain
When to use this
Interactive disk usage viewer that lets you navigate directories and find what is using space.
Gotcha
ncdu must be installed separately with apt install ncdu or similar.
Create a hard link
ln /path/to/file /path/to/hardlink ↓ Click command to explain
When to use this
Create a hard link to a file so both paths point to the same inode and data.
Gotcha
Hard links cannot cross filesystem boundaries and cannot link to directories. Use symlinks for those cases.
Check inode usage across filesystems
df -i ↓ Click command to explain
When to use this
Check inode usage across filesystems, because running out of inodes prevents creating new files even when disk space is available.
Gotcha
A full inode table is a common cause of mysterious no space left on device errors when df -h shows space remaining.
Show block device UUIDs and filesystem types
blkid When to use this
Show the UUID and filesystem type of every block device, useful when writing entries for /etc/fstab.
Gotcha
Use the UUID from blkid instead of a device name like /dev/sdb1 in /etc/fstab, since device names can shift after a reboot but UUIDs stay stable.
Show or enable swap space
swapon --show ↓ Click command to explain
--show Lists active swap devices and their usage -a Enables all swap devices listed in /etc/fstab When to use this
Show or enable swap space on the system.
View or modify GPT and MBR partition tables
parted /dev/sdb print ↓ Click command to explain
When to use this
View or modify disk partition tables, including support for GPT partitions that fdisk historically struggled with.
Gotcha
parted can apply changes immediately without a separate write step, unlike fdisk. Double check every command before confirming.
Show the kernel version and architecture
uname -a ↓ Click command to explain
-a Shows all information -r Shows only the kernel version -m Shows the machine hardware architecture When to use this
Show the Linux kernel version and system architecture.
Show system uptime and load average
uptime When to use this
Show how long the system has been running and the current load averages.
Gotcha
Load average above the number of CPU cores means the system is overloaded.
Show memory and swap usage
free -h ↓ Click command to explain
-h Human readable -m Shows in megabytes -g Shows in gigabytes When to use this
Show total, used, and available memory and swap.
Gotcha
Linux aggressively uses free memory for disk caching, which makes the used memory number look high. The available column is the real indicator of free memory.
Show CPU architecture information
lscpu When to use this
Display CPU architecture information including number of cores, threads, and clock speed.
List all environment variables
env When to use this
List all environment variables in the current shell.
Gotcha
Use env | grep VARIABLE_NAME to find a specific variable.
Print a single environment variable's value
printenv PATH ↓ Click command to explain
When to use this
Print the value of a specific environment variable.
View and search previous commands
history | grep "kubectl" ↓ Click command to explain
When to use this
View previously run commands and search them for a specific command.
Gotcha
history stores commands in ~/.bash_history, which is written when the shell exits. Commands from a current session may not appear until logout.
Show who is logged in
who When to use this
Show who is currently logged in to the system.
Show recent login and logout events
last -n 20 ↓ Click command to explain
-n Limits output to the most recent entries When to use this
Show the last 20 login and logout events.
View kernel messages
dmesg -T | tail -50 ↓ Click command to explain
-T Shows human readable timestamps -l Filters by log level When to use this
View kernel messages, especially for diagnosing hardware errors, OOM kills, and disk errors.
Gotcha
dmesg -T | grep -i error is one of the first commands to run when diagnosing hardware problems.
List loaded kernel modules
lsmod When to use this
List kernel modules currently loaded into the running kernel.
List PCI devices
lspci -v Verbose, shows more details per device -k Shows the kernel driver in use for each device When to use this
List PCI devices such as network cards, GPUs, and storage controllers detected by the kernel.
List connected USB devices
lsusb When to use this
List USB devices currently connected to the system.
Check a service's current status
systemctl status nginx ↓ Click command to explain
When to use this
Check the current status of a service, including whether it is running and the last few log lines.
Gotcha
This is the first command to run when a service is not working as expected.
Start a service
systemctl start nginx ↓ Click command to explain
When to use this
Start a service.
Stop a running service
systemctl stop nginx ↓ Click command to explain
When to use this
Stop a running service.
Restart a service
systemctl restart nginx ↓ Click command to explain
When to use this
Stop and start a service to apply configuration changes.
Gotcha
Use reload instead of restart when possible, since reload applies new configuration without dropping existing connections.
Reload a service's configuration
systemctl reload nginx ↓ Click command to explain
When to use this
Reload a service configuration without stopping and restarting it.
Gotcha
Not all services support reload. If the service does not support it, systemctl reload fails with an error.
Enable a service to start at boot
systemctl enable nginx ↓ Click command to explain
--now Enables and immediately starts the service When to use this
Configure a service to start automatically at boot.
Gotcha
enable does not start the service immediately. Use --now to enable and start in one command.
Disable a service from starting at boot
systemctl disable nginx ↓ Click command to explain
When to use this
Prevent a service from starting automatically at boot.
List failed services
systemctl list-units --type=service --state=failed ↓ Click command to explain
When to use this
List all failed services so you can identify what is broken.
View and follow a service's logs
journalctl -u nginx -f ↓ Click command to explain
-u Filters by service unit -f Follows new log entries in real time -n Shows the last N lines --since Filters by time -p Filters by priority level When to use this
View and follow logs from a specific service.
Gotcha
journalctl -u servicename -n 100 --no-pager is the fastest way to see the last 100 lines of a service log without scrolling through a pager.
View logs from a specific time range
journalctl --since "2026-07-08 10:00:00" --until "2026-07-08 11:00:00" ↓ Click command to explain
When to use this
View logs from a specific time range during incident investigation.
Reload the systemd manager configuration
systemctl daemon-reload ↓ Click command to explain
When to use this
Reload the systemd manager configuration after adding or modifying unit files.
Gotcha
Always run daemon-reload after creating or editing a .service file in /etc/systemd/system before starting or restarting the service.
Display a service's unit file
systemctl cat nginx ↓ Click command to explain
When to use this
Display the content of a service unit file.
Create a drop-in override for a service
systemctl edit nginx ↓ Click command to explain
When to use this
Create a drop-in override file for a service unit without modifying the original unit file.
Gotcha
Edits made here go into an override.conf file that takes precedence over the original unit. Run daemon-reload after editing.
Show system time, timezone, and NTP status
timedatectl When to use this
Show the current system time, timezone, and NTP synchronization status.
Gotcha
Clock skew causes mysterious authentication failures in distributed systems, especially with Kubernetes and AWS. Check timedatectl first.
View or change the system hostname
hostnamectl set-hostname new-hostname ↓ Click command to explain
When to use this
View or permanently change the system hostname.
Check if a service is enabled at boot
systemctl is-enabled nginx ↓ Click command to explain
When to use this
Check whether a service is enabled to start at boot without opening the full status output.
List systemd timers
systemctl list-timers ↓ Click command to explain
When to use this
List all systemd timers, the modern systemd-native replacement for cron jobs, along with when each will next run.
Update and upgrade packages on Debian-based systems
apt update && apt upgrade -y ↓ Click command to explain
When to use this
Update the package index and upgrade all installed packages on Ubuntu or Debian.
Gotcha
Always run apt update before apt install to ensure you get the latest version of the package.
Install a package on Ubuntu or Debian
apt install -y nginx ↓ Click command to explain
-y Automatically answers yes to all prompts When to use this
Install a package on Ubuntu or Debian.
Remove a package on Ubuntu or Debian
apt remove nginx ↓ Click command to explain
--purge Also removes configuration files When to use this
Remove a package while keeping its configuration files.
Gotcha
Use --purge if you want a completely clean removal including config files.
Install a package on RHEL, CentOS, or Fedora
dnf install -y nginx ↓ Click command to explain
When to use this
Install a package on RHEL, CentOS, or Fedora.
Gotcha
dnf replaced yum as the default package manager on RHEL 8 and later. yum still works as an alias on most systems.
Install a package on Alpine Linux
apk add --no-cache nginx ↓ Click command to explain
--no-cache Installs without using the local cache, useful in Docker builds to keep image size small When to use this
Install a package on Alpine Linux.
Gotcha
Always use --no-cache in Dockerfile RUN instructions to avoid leaving the cache in the image layer.
Install a snap package on Ubuntu
snap install code --classic ↓ Click command to explain
--classic Allows the snap to access the filesystem like a traditional package When to use this
Install a snap package on Ubuntu.
Gotcha
snap packages run in a sandbox, so some applications need --classic to access the filesystem normally.
Install a Python package
pip install --break-system-packages package-name ↓ Click command to explain
When to use this
Install a Python package.
Gotcha
On modern systems, pip install without --break-system-packages or a virtual environment fails with an externally-managed-environment error.
Show the full path of a command
which terraform ↓ Click command to explain
When to use this
Show the full path of an executable command.
Gotcha
If which returns nothing, the command is not in your PATH. Check if the package is installed or if the binary path needs to be added to PATH.
Locate a command's binary, source, and man page
whereis nginx ↓ Click command to explain
When to use this
Locate the binary, source, and man page for a command.
Display the manual page for a command
man grep ↓ Click command to explain
When to use this
Display the manual page for a command.
Gotcha
Press q to quit, use slash to search within the man page, and man man shows the manual for the man command itself.
List packages with an available upgrade
apt list --upgradable ↓ Click command to explain
When to use this
See which installed packages have a newer version available without actually upgrading anything.
Install a local .deb package file
dpkg -i package.deb ↓ Click command to explain
-i Installs a local .deb package file -r Removes a package When to use this
Install a package directly from a local .deb file instead of a repository, common for third-party software not available in apt.
Gotcha
dpkg -i does not resolve dependencies automatically. If it fails with a dependency error, run apt install -f immediately after to fix it.
Find the largest files on the filesystem
find / -type f -size +100M 2>/dev/null | sort -rh | head -20 ↓ Click command to explain
When to use this
Find the 20 largest files on the entire filesystem.
Gotcha
2>/dev/null suppresses permission errors.
Find all log files containing an error
grep -r "ERROR" /var/log/ --include="*.log" -l 2>/dev/null ↓ Click command to explain
When to use this
Find all log files containing the word ERROR.
Count errors per timestamp to find spikes
grep "ERROR" app.log | awk '{print $1, $2}' | sort | uniq -c | sort -rn ↓ Click command to explain
When to use this
Count how many errors occurred per timestamp to find error spikes.
Watch a log in real time filtered to errors
tail -f /var/log/syslog | grep --line-buffered "error" ↓ Click command to explain
--line-buffered Flushes output after each line so grep does not buffer when piped When to use this
Watch a log file in real time and show only error lines.
Gotcha
Without --line-buffered, grep may not print matches immediately when piped from tail -f.
Extract and count the top IPs from an access log
grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' access.log | sort | uniq -c | sort -rn | head -20 ↓ Click command to explain
When to use this
Extract and count the top 20 IP addresses from a web server access log.
Check if a port is in use and by which process
ss -tlnp | grep :8080 ↓ Click command to explain
When to use this
Check if a specific port is already in use and which process is using it.
Kill whatever process is listening on a port
kill $(lsof -t -i:8080) ↓ Click command to explain
When to use this
Kill whatever process is listening on port 8080.
Find the largest directories in /var
du -h --max-depth=1 /var | sort -rh | head -10 ↓ Click command to explain
When to use this
Find the top 10 largest directories in /var.
Monitor connection counts in real time
watch -n 1 "ss -s" ↓ Click command to explain
When to use this
Monitor TCP connection counts in real time.
Replace a string across multiple files
find . -name "*.yaml" -exec sed -i 's/old-image/new-image/g' {} + ↓ Click command to explain
When to use this
Replace a string across multiple files of a specific type.
Gotcha
Test with grep first using grep -r "old-image" --include="*.yaml" to see what will be changed.
Generate a secure random password
openssl rand -base64 32 ↓ Click command to explain
When to use this
Generate a cryptographically secure random password.
Check when an SSL certificate expires
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates ↓ Click command to explain
When to use this
Check when an SSL certificate expires without installing any extra tools.
Ping continuously with a timestamp on each line
ping google.com | while read line; do echo "$(date): $line"; done ↓ Click command to explain
When to use this
Ping a host continuously and prefix each line with a timestamp for logging.
Compress log files older than 30 days
find /var/log -name "*.log" -mtime +30 -exec gzip {} \; ↓ Click command to explain
When to use this
Compress log files older than 30 days to save disk space.
Gotcha
Test with find /var/log -name "*.log" -mtime +30 -ls first to see what will be compressed.
Show environment variables of a running process
cat /proc/PID/environ | tr '\0' '\n' ↓ Click command to explain
When to use this
Show all environment variables of a running process, including ones set at launch that are not visible in the current shell.
Gotcha
Replace PID with the actual process ID from ps aux. This is useful for debugging applications that read config from environment variables.
Check root disk usage percentage in a script
df -h / | awk 'NR==2 {print $5}' ↓ Click command to explain
When to use this
Get just the percentage of disk space used on the root filesystem, useful as a pre-deploy safety check in a script.
Stream a directory to a remote host over SSH
tar -czf - /path/to/dir | ssh user@host 'tar -xzf - -C /destination' ↓ Click command to explain
When to use this
Copy a directory to a remote host by streaming a tar archive over SSH without creating a temporary file on either end.
Fetch JSON from an API and extract a field
curl -s https://api.example.com/status | jq -r '.status' ↓ Click command to explain
When to use this
Fetch JSON from an API and extract a single field with jq, a common pattern for health checks and CI scripts.
Recursively fix permissions on a web directory
find /var/www -type f -exec chmod 644 {} \; -o -type d -exec chmod 755 {} \; ↓ Click command to explain
When to use this
Recursively fix permissions on a web directory, setting files to 644 and directories to 755 in one pass.
Gotcha
Test the find expression with -print instead of -exec first to confirm it matches exactly the files and directories you expect.
Reference Tools
The same operation across Ubuntu/Debian, RHEL/CentOS/Fedora, and Alpine. Commands that work on one distro silently fail on another. This table shows you why.
| Operation | Ubuntu/Debian | RHEL/CentOS/Fedora | Alpine |
|---|---|---|---|
| Update package index | apt update | dnf check-update | apk update |
| Install a package | apt install nginx | dnf install nginx | apk add nginx |
| Remove a package | apt remove nginx | dnf remove nginx | apk del nginx |
| Search for a package | apt search nginx | dnf search nginx | apk search nginx |
| List installed packages | dpkg -l | rpm -qa | apk list --installed |
| Show package info | apt show nginx | dnf info nginx | apk info nginx |
| Upgrade all packages | apt upgrade | dnf upgrade | apk upgrade |
| Start a service | systemctl start nginx | systemctl start nginx | rc-service nginx start |
| Enable service on boot | systemctl enable nginx | systemctl enable nginx | rc-update add nginx default |
| Check service status | systemctl status nginx | systemctl status nginx | rc-service nginx status |
| View system logs | journalctl -f | journalctl -f | tail -f /var/log/messages |
| Find which package owns a file | dpkg -S /usr/bin/nginx | rpm -qf /usr/bin/nginx | apk info --who-owns /usr/bin/nginx |
| Add a user | useradd -m username | useradd -m username | adduser -D username |
| Install security updates only | apt upgrade --with-new-pkgs | dnf update --security | apk upgrade --available |
| Clean package cache | apt clean | dnf clean all | apk cache clean |
Alpine uses musl libc not glibc
Many Linux binaries compiled for glibc will not run on Alpine without recompilation. This is the most common reason a Docker image works locally but fails in a container built on Alpine.
Alpine does not have bash by default
Alpine uses ash as the default shell. Scripts starting with #!/bin/bash will fail. Either install bash with apk add bash or rewrite scripts to use #!/bin/sh.
RHEL and CentOS have SELinux enabled by default
Many commands that work on Ubuntu fail silently on RHEL because SELinux is blocking them. Run ausearch -m avc -ts recent to see SELinux denials before assuming the command is wrong.
Alpine uses OpenRC not systemd
All systemctl commands fail on Alpine by default because Alpine uses OpenRC for service management. Use rc-service and rc-update instead.
Frequently Asked Questions
Linux commands are the small, single-purpose programs that make up the command line interface almost every server, container, and CI pipeline runs on. Instead of one large tool that does everything, Linux follows the Unix philosophy of many small programs, each doing one job well, that you combine with pipes to build exactly the workflow you need. A command like grep only searches text, sort only orders lines, and awk only extracts fields, but chained together with the pipe character they can turn a raw log file into a ranked list of the most common errors in a single line. Learning these commands is really learning a small, composable toolkit rather than memorizing a fixed list of features.
The reason Linux commands show up in daily DevOps work so constantly is that almost every layer of modern infrastructure, from the container a service runs in to the CI runner that builds it to the virtual machine hosting a database, is Linux underneath. Debugging a slow container means running ps, top, and du inside it. Debugging a networking issue means reaching for ss, curl, and dig. Debugging a permissions error means reading the output of ls -la and running chmod or chown to fix it. These commands are not a specialized skill reserved for system administrators anymore, they are the baseline literacy every engineer touching servers, containers, or CI pipelines needs, in the same way SQL is baseline literacy for anyone touching a database.
The two mental models that unlock most of Linux are the permission system and the process model. Every file has an owner, a group, and a set of read, write, and execute permissions for the owner, the group, and everyone else, and almost every confusing permission error traces back to one of those three categories not having the access it needs. Every running program is a process with a unique process ID, a parent process that spawned it, and a set of open files and network connections you can inspect with tools like ps, lsof, and pstree. Once you can read chmod 755 as owner read write execute, group and others read execute, and once you understand that a process id is just a number you can target with kill, most of the Linux command line stops feeling like memorized incantations and starts feeling predictable.
Three mistakes account for most of the trouble engineers run into with Linux commands. The first is running rm -rf or dd with a typo in the path, since neither command asks for confirmation and both can destroy data permanently in seconds, which is why testing destructive one-liners with a safer flag like -i or a dry run first is worth the extra step. The second is assuming a command that works on Ubuntu will work identically on every distro, when in reality the package manager, the default shell, and even basic service management differ completely between Debian-based, RHEL-based, and Alpine-based systems. The third is forgetting that permission and ownership problems are usually the real cause of a mysterious failure, so running ls -la and id before assuming a tool itself is broken saves far more time than it costs.