Dejan-Panovski on Linuxize

Linux Pipes Explained: How to Use the | Operator

hello@linuxize.com (Linuxize) — Thu, 11 Jun 2026 09:40:00 +0200

A pipe in Linux is a one-way channel that connects the standard output of one process to the standard input of another. The shell builds the channel for you when you type a | character between two commands. The first command writes; the second command reads. Both run at the same time, and data flows between them through the kernel without ever touching disk.

The pipe is one of the oldest and most useful ideas in Unix. It is what makes a small command such as grep or sort feel like part of a much larger toolbox. Knowing how pipes behave, where they fit in a shell pipeline, and when to reach for related tools such as xargs and process substitution makes shell work more effective.

This guide explains how to build pipelines, handle errors and exit statuses, and use related features such as named pipes and process substitution.

Pipe Syntax

The general syntax for a shell pipeline is:

txt
command1 | command2 [| command3 ...]

Each command passes its standard output to the standard input of the command on its right. A pipeline can contain two commands or a longer chain, and the shell runs all stages concurrently.

How a Pipe Works

A shell pipeline of the form cmd1 | cmd2 follows these steps:

The shell creates an anonymous pipe with the pipe(2) system call. The call returns two file descriptors: one for reading and one for writing.
The shell starts the commands and connects the first command’s standard output (file descriptor 1) to the write end of the pipe.
The second command reads from the pipe through its standard input (file descriptor 0), while the kernel handles the data flow between them.

Linux pipes have a limited in-kernel buffer. The default is commonly 16 memory pages, or 64 KiB on systems with 4 KiB pages, but applications should not rely on a fixed capacity. When the buffer fills, the writer waits until the reader consumes more data.

A First Example

The following pipeline generates three service names and filters them with grep:

Terminal
printf '%s\n' ssh.service NetworkManager cron.service | grep -i network

output

NetworkManager

printf writes one service name per line. The pipe sends those lines to grep, which prints the line containing network. The -i option makes the match case-insensitive.

The same pattern works with any command that writes to standard output and any command that reads from standard input.

Pipes Pass Data, Not Files

A pipe carries a stream of bytes, not a file name or command-line argument. The receiving command reads that stream from standard input.

For example, the following command sends the text /etc/hosts to wc. It does not ask wc to open that file:

Terminal
printf '%s\n' /etc/hosts | wc -l

output

The result is 1 because wc received one line of text. To count lines in the file, pass the path as an argument with wc -l /etc/hosts. Commands such as rm, mv, and stat also expect paths as arguments rather than reading them from standard input.

Combining Pipes with xargs

xargs reads items from standard input and turns them into arguments for another command. This example creates three empty files:

Terminal
printf '%s\0' report-1.txt report-2.txt report-3.txt | xargs -0 touch

The null character separates each name, and xargs -0 converts the three items into arguments for touch. The same null-delimited pattern safely handles spaces and newlines in file names.

Before deleting files found by find, print the matches and inspect them:

Terminal
find . -type f -name '*.log' -mtime +30 -print

When the list is correct, use -print0 with xargs -0. The -r option prevents GNU xargs from running rm when no files match:

Terminal
find . -type f -name '*.log' -mtime +30 -print0 | xargs -0 -r rm --

The -- marker prevents a path beginning with a hyphen from being interpreted as an rm option.

Reading the Exit Status of a Pipeline

Bash returns the exit status of the last command in a pipeline by default. A failure in an earlier stage can therefore go unnoticed:

Terminal
grep something /missing/file 2>/dev/null | wc -l
echo "$?"

output

0
0

grep failed because the file did not exist, but wc -l succeeded, so the pipeline status was 0. Enable pipefail when the script must detect failures in any stage:

Terminal
set -o pipefail
grep something /missing/file 2>/dev/null | wc -l
echo "$?"

output

0
2

With pipefail enabled, the pipeline returns the status of the rightmost command that failed, or 0 if every command succeeded.

To inspect every stage individually, use the PIPESTATUS array:

Terminal
ls /missing 2>/dev/null | grep foo
echo "${PIPESTATUS[@]}"

output

2 1

PIPESTATUS[0] is ls and PIPESTATUS[1] is grep.

Pipes and Standard Error

A pipe only carries standard output (file descriptor 1). Standard error (file descriptor 2) goes straight to the terminal:

Terminal
ls /missing | wc -l

output

ls: cannot access '/missing': No such file or directory
0

The error message bypassed the pipe. To send errors through the same pipe, redirect standard error to standard output with 2>&1 before the pipe:

Terminal
ls /missing 2>&1 | tee log.txt

The tee command writes the redirected error stream to log.txt and displays it in the terminal. Bash also provides |& as shorthand for 2>&1 |:

Terminal
ls /missing |& tee log.txt

For more redirection patterns and details about ordering, see how to redirect stderr to stdout .

Named Pipes (FIFOs)

The | operator creates an anonymous pipe that vanishes when the pipeline ends. A named pipe lives on the filesystem and lets unrelated processes share data. Create one with mkfifo:

Terminal
mkfifo /tmp/linuxize-pipe

In the first terminal, start the reader:

Terminal
cat /tmp/linuxize-pipe

In a second terminal, write to the FIFO:

Terminal
printf '%s\n' "hello" > /tmp/linuxize-pipe

output

hello

The first terminal prints hello. Opening a FIFO normally blocks until the other end connects, so start the reader and writer in separate terminals. Named pipes are useful for communication between scripts and processes that do not share a parent.

Remove the FIFO when finished:

Terminal
rm /tmp/linuxize-pipe

Process Substitution

When a command expects one or more file paths instead of standard input, process substitution can expose command output through a file-like path:

Terminal
diff <(printf '%s\n' alpha beta) <(printf '%s\n' alpha gamma)

diff receives two generated paths as arguments and compares the output from both printf commands. Bash implements those paths with /dev/fd entries or named pipes, depending on the operating system.

The reverse form, >(command), provides a file-like destination. The following pipeline saves a compressed copy while continuing to filter the original stream:

Terminal
some_command | tee >(gzip > out.gz) | grep error

Process substitution is available in Bash, ksh, and zsh, but it is not part of POSIX sh.

Useful Pipe-Based One-Liners

A handful of pipelines come up again and again in shell work:

Terminal
ps -eo pid,comm,%cpu --sort=-%cpu | head -n 6

ps sorts processes by CPU use, and head keeps the header plus the five busiest processes.

Terminal
awk '{print $1}' access.log | sort | uniq -c | sort -nr | head

This pipeline extracts client addresses from a common Nginx or Apache access log, counts duplicates, and prints the most frequent addresses first.

Terminal
du -h --max-depth=1 . 2>/dev/null | sort -h

The output shows disk use for the current directory and its immediate subdirectories, sorted from smallest to largest.

Each pipeline reads as a sentence: do this, then this, then this. The flow matches how the data moves between processes.

Quick Reference

Task	Command
Send output to another command	`command1 \| command2`
Build a multi-stage pipeline	`command1 \| command2 \| command3`
Pipe stdout and stderr in Bash	`command1 \|& command2`
Enable pipeline failure detection	`set -o pipefail`
Read every Bash pipeline status	`printf '%s\n' "${PIPESTATUS[@]}"`
Convert null-delimited input to arguments	`command1 \| xargs -0 command2`
Save and continue a stream	`command1 \| tee file \| command2`
Create a named pipe	`mkfifo /tmp/name`
Compare generated output as files	`diff <(command1) <(command2)`

Troubleshooting

A variable set in a pipeline is empty afterward
In Bash, each command in a multi-command pipeline normally runs in its own subshell. Variables set there do not survive in the parent shell:

Terminal
echo "data" | read x
printf '<%s>\n' "$x"

output

<>

Use a here-string or redirect process substitution into read so it runs in the current shell:

Terminal
read -r x <<< "data"
printf '<%s>\n' "$x"

output

<data>

A command reports a broken pipe
A writer receives SIGPIPE when the reader closes early, which often happens when head has collected enough lines. This can be expected, but do not hide all errors with a broad 2>/dev/null. Check the individual statuses with PIPESTATUS, especially when pipefail is enabled.

The next command ignores piped file names
Tools such as rm, mv, and stat expect paths as arguments. Use xargs -0 with null-delimited input, and preview destructive operations before running them.

Output appears in delayed batches
Some programs use larger output buffers when writing to a pipe instead of a terminal. GNU grep supports --line-buffered, and GNU stdbuf -oL command can request line-buffered output from programs that use standard C streams. These options are not portable to every Unix system or effective with every command.

Conclusion

Linux pipes let you connect focused commands without intermediate files. Use pipefail when every stage must succeed, xargs when a command needs arguments, and process substitution or named pipes when a simple pipeline does not fit the task.

How to Deploy a Node.js Application on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Wed, 10 Jun 2026 09:30:00 +0200

Running node app.js on a developer laptop is one thing; getting the same code to stay up on a production server, restart after a crash, survive a reboot, and answer requests on standard HTTPS ports is another. A working Node.js deployment on Ubuntu 26.04 has three moving parts: the runtime, a process manager that keeps the app alive, and a reverse proxy that handles TLS and routes traffic to the application.

This guide explains how to deploy a Node.js application on Ubuntu 26.04 using PM2 as the process manager and Nginx as the reverse proxy, with a Let’s Encrypt certificate in front.

Prerequisites

Before starting you need:

Ubuntu 26.04 with a user that has sudo privileges
A domain name with an A record pointing at the server’s public IP
Ports 80 and 443 open in the firewall

We will use example.com and an app that listens on port 3000. Substitute your real values.

Step 1: Install Node.js

Ubuntu 26.04 includes Node.js in its repositories, but NodeSource makes it easier to install a specific upstream LTS release. The commands below install Node.js 24.x, the current LTS line at publication time.

Install the required packages and import the NodeSource signing key:

Terminal
sudo apt update
sudo apt install -y ca-certificates curl gnupg
sudo mkdir -p /etc/apt/keyrings
curl -fsSL https://deb.nodesource.com/gpgkey/nodesource-repo.gpg.key | \
 sudo gpg --dearmor --yes -o /etc/apt/keyrings/nodesource.gpg

Add the Node.js 24.x repository:

Terminal
NODE_MAJOR=24
echo "deb [signed-by=/etc/apt/keyrings/nodesource.gpg] https://deb.nodesource.com/node_$NODE_MAJOR.x nodistro main" | \
 sudo tee /etc/apt/sources.list.d/nodesource.list

Update the package index and install Node.js:

Terminal
sudo apt update
sudo apt install -y nodejs

Confirm both binaries are in place:

Terminal
node --version
npm --version

output

v24.16.0
11.16.0

The exact patch versions will change as Node.js and npm updates are released. For other installation methods, see our guide on installing Node.js and npm on Ubuntu 26.04 .

Step 2: Prepare a Deploy User and Directory

Production apps should run as a non-root account that owns only its own files. Create a dedicated user:

Terminal
sudo adduser --system --group --home /var/www/app --shell /bin/bash app

The --system flag creates an account with password login disabled, which is appropriate for a service account. Administrators can still run deployment commands as this user through sudo.

Set up the deployment directory:

Terminal
sudo mkdir -p /var/www/app
sudo chown -R app:app /var/www/app

Step 3: Get the Application onto the Server

Most deployments pull the code from Git. Clone the repository as the app user:

Terminal
sudo apt install -y git
sudo -H -u app git clone https://github.com/example/myapp.git /var/www/app

Install dependencies inside that directory:

Terminal
sudo -H -u app bash -c 'cd /var/www/app && npm ci --omit=dev'

npm ci is the right command for deploys: it reads package-lock.json and refuses to fall back when the lock file is out of sync. --omit=dev skips development-only dependencies, which keeps the production install smaller.

If the application has a build step that depends on development packages, install all dependencies first, build the project, and then remove development-only packages:

Terminal
sudo -H -u app bash -c \
 'cd /var/www/app && npm ci && npm run build && npm prune --omit=dev'

For private repositories, configure an SSH deploy key or a short-lived access token for the app account. Do not store repository credentials in the application directory.

For a quick test without a real repository, write a minimal Express app instead:

Terminal
sudo -H -u app bash -c 'cd /var/www/app && npm init -y && npm install express'
sudo -H -u app nano /var/www/app/server.js

/var/www/app/server.jsjs
const express = require("express");
const app = express();
const port = 3000;

app.get("/", (req, res) => {
 res.send("Hello from Node.js on Ubuntu 26.04");
});

app.listen(port, "127.0.0.1", () => {
 console.log(`App listening on http://127.0.0.1:${port}`);
});

Notice that the listen call binds to 127.0.0.1, not 0.0.0.0. The reverse proxy will reach the app over loopback, and binding to localhost keeps the application off the public network entirely.

Step 4: Install PM2 and Run the App

PM2 is a Node.js process manager that handles restarts, logs, and clustering. Install it globally:

Terminal
sudo npm install -g pm2

Configure any required environment variables before starting the process. Keep API keys, database passwords, and other secrets outside the Git repository, and add local .env files to .gitignore.

Start the application under PM2 as the app user:

Terminal
sudo -H -u app pm2 start /var/www/app/server.js --name myapp --time

output

[PM2] Starting /var/www/app/server.js in fork_mode (1 instance)
[PM2] Done.
┌─────┬────────┬─────────────┬─────────┬─────────┬──────────┬────────┐
│ id │ name │ namespace │ version │ mode │ pid │ uptime │
├─────┼────────┼─────────────┼─────────┼─────────┼──────────┼────────┤
│ 0 │ myapp │ default │ 1.0.0 │ fork │ 12345 │ 0s │
└─────┴────────┴─────────────┴─────────┴─────────┴──────────┴────────┘

Verify the app responds on loopback:

Terminal
curl http://127.0.0.1:3000

output

Hello from Node.js on Ubuntu 26.04

To make PM2 start the app at boot, generate the systemd unit and freeze the process list:

Terminal
sudo env PATH=$PATH:/usr/bin pm2 startup systemd -u app --hp /var/www/app
sudo -H -u app pm2 save

The first command writes and enables pm2-app.service; the second saves the current process list so PM2 knows what to start. Confirm the unit is enabled:

Terminal
sudo systemctl status pm2-app

Step 5: Install and Configure Nginx

Install Nginx:

Terminal
sudo apt install nginx

Create a server block that proxies requests to the Node.js app:

Terminal
sudo nano /etc/nginx/sites-available/example.com

/etc/nginx/sites-available/example.comnginx
server {
 listen 80;
 listen [::]:80;

 server_name example.com www.example.com;

 location / {
 proxy_pass http://127.0.0.1:3000;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 }
}

The headers preserve the original host, client IP, and protocol for the application. If the app uses WebSockets, add the upgrade settings from the Nginx reverse proxy guide .

Enable the site and test the configuration:

Terminal
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Open the firewall:

Terminal
sudo ufw allow 'Nginx Full'

Visit http://example.com and confirm the page renders. Requests now travel from the browser to Nginx on port 80, then to Node.js on loopback port 3000.

Step 6: Add HTTPS with Certbot

Install Certbot and the Nginx plugin:

Terminal
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com

Certbot rewrites the server block to terminate TLS, adds an HTTP-to-HTTPS redirect, and registers a renewal timer. Verify:

Terminal
curl -I https://example.com
sudo certbot renew --dry-run

The first command should return a successful HTTP status over HTTPS. The renewal dry run confirms that Certbot can renew the certificate before it expires.

Step 7: Manage the App with PM2

Once the deployment is live, the day-to-day operations all go through PM2:

Terminal
sudo -H -u app pm2 ls
sudo -H -u app pm2 logs myapp
sudo -H -u app pm2 restart myapp
sudo -H -u app pm2 stop myapp

PM2 writes application output under /var/www/app/.pm2/logs. Install the log rotation module so those files do not grow without limit:

Terminal
sudo -H -u app pm2 install pm2-logrotate
sudo -H -u app pm2 set pm2-logrotate:max_size 10M
sudo -H -u app pm2 set pm2-logrotate:retain 7

To deploy a new version, pull only fast-forward changes, install dependencies, and restart the process:

Terminal
sudo -H -u app bash -c \
 'cd /var/www/app && git pull --ff-only && npm ci --omit=dev'
sudo -H -u app pm2 restart myapp --update-env
sudo -H -u app pm2 save

This guide starts the app in fork mode, so pm2 restart briefly interrupts requests. Zero-downtime pm2 reload requires cluster mode with at least two instances:

Terminal
sudo -H -u app pm2 delete myapp
sudo -H -u app pm2 start /var/www/app/server.js --name myapp -i 2 --time
sudo -H -u app pm2 save
sudo -H -u app pm2 reload myapp

Cluster mode works well for stateless HTTP applications. Apps that keep sessions, scheduled jobs, or WebSocket state in memory need an external store or additional coordination before running multiple instances.

Troubleshooting

502 Bad Gateway from Nginx
The Node.js app is not running, not listening on the expected port, or bound to the wrong address. Check sudo -H -u app pm2 ls and confirm the process is online, then run sudo ss -ltnp | grep 3000 to confirm it is listening on loopback.

PM2 does not start at boot
The systemd unit was not enabled, or pm2 save was skipped. Check sudo systemctl status pm2-app, re-run the startup command, and then run sudo -H -u app pm2 save.

Certbot cannot validate the domain
Confirm that the domain’s A and AAAA records point to this server, port 80 is reachable, and sudo ufw status shows Nginx Full allowed. If an incorrect AAAA record points elsewhere, Let’s Encrypt validation can fail even when the A record is correct.

FAQ

Why use Nginx in front of Node.js?
Nginx handles the public ports and TLS certificate while the Node.js process stays on an unprivileged local port. It also gives you one place for request limits, static files, access logs, and routing several applications by domain.

Can I run multiple Node.js apps on the same server?
Yes. Give each app its own port, its own PM2 entry, and its own Nginx server block. The reverse proxy routes by hostname so each app gets the requests for its domain only.

Should I use PM2 or systemd directly?
Both work. PM2 adds Node.js-specific process controls, clustering, and reloads, while systemd is simpler when you only need to supervise one process. In this setup, systemd starts PM2 at boot and PM2 manages the application.

Conclusion

A production Node.js deployment on Ubuntu 26.04 uses PM2 to keep the application running and Nginx to handle public HTTP and HTTPS traffic. Keep the app bound to loopback, rotate its logs, and test the update procedure before the server carries production traffic.

For related setup, see our guides on installing Node.js on Ubuntu 26.04 and configuring Nginx as a reverse proxy .

Bash Array Operations: Length, Search, Slice, and Reverse

hello@linuxize.com (Linuxize) — Tue, 09 Jun 2026 10:10:00 +0200

Once you know how to declare a Bash array, the next tasks are usually finding its length, checking whether it contains a value, extracting a slice, or changing the element order. Bash supports all of these operations, but the expansion syntax can be difficult to remember.

This guide covers the indexed-array operations you will use most often in scripts. For array declaration, element access, and associative arrays, start with the Bash arrays guide .

Sample Array

The examples use the following array:

Terminal
fruits=("apple" "banana" "dragon fruit" "date" "elderberry")

Each quoted value is one element, including dragon fruit, and the indices run from 0 through 4.

Get the Array Length

Use ${#name[@]} to get the number of elements:

Terminal
echo "${#fruits[@]}"

output

The result is 5 because the array contains five elements. ${#name[*]} returns the same count, but @ is the safer default for other array operations because it preserves individual elements when quoted.

To get the character length of one element, include its index:

Terminal
echo "${#fruits[1]}"

output

This counts the six characters in banana, not the number of array elements.

Check If an Array Contains a Value

Bash does not have a built-in contains operator. The reliable approach is to loop over the elements and compare each one with the target value:

sh
contains() {
 local target=$1
 shift

 local element
 for element in "$@"; do
 if [[ $element == "$target" ]]; then
 return 0
 fi
 done

 return 1
}

if contains "dragon fruit" "${fruits[@]}"; then
 echo "found"
else
 echo "not found"
fi

output

found

The function returns status 0 when it finds an exact match and status 1 otherwise. Passing "${fruits[@]}" keeps values containing spaces intact.

Avoid joining the array into one string and testing it with a regular expression. That shortcut can report false matches when a search term appears inside another element or when elements contain the chosen separator.

Slice an Array

Array slicing uses the following expansion:

txt
${name[@]:offset:length}

offset selects where the slice starts, and length is the number of elements to return. This example takes three elements starting at index 1:

sh
slice=("${fruits[@]:1:3}")
printf '<%s>\n' "${slice[@]}"

output

<banana>
<dragon fruit>
<date>

Assigning the result to another array preserves the three values as separate elements.

A negative offset counts from the end. Add a space before the negative number so Bash does not parse :- as the default-value operator:

sh
last_two=("${fruits[@]: -2}")
printf '<%s>\n' "${last_two[@]}"

output

<date>
<elderberry>

Omit length to take every remaining element from the offset to the end.

Reverse an Array

Bash does not provide a reverse operator. The following loop reads the array indices from the end and appends each value to a new array:

sh
indices=("${!fruits[@]}")
reversed=()

for ((i=${#indices[@]} - 1; i >= 0; i--)); do
 reversed+=("${fruits[${indices[i]}]}")
done

printf '<%s>\n' "${reversed[@]}"

output

<elderberry>
<date>
<dragon fruit>
<banana>
<apple>

Using the actual index list makes this pattern work with both contiguous arrays and sparse arrays that have gaps between indices.

Tools such as rev and tac solve different problems. rev reverses characters on each input line, while tac reverses line order. Neither one operates directly on Bash array elements.

Iterate Over Values and Indices

When you only need the values, expand the array with "${name[@]}":

sh
for fruit in "${fruits[@]}"; do
 echo "$fruit"
done

Quoting the expansion ensures that dragon fruit remains one loop item.

When you need both the index and value, use ${!name[@]} to expand the index list:

sh
for i in "${!fruits[@]}"; do
 echo "$i: ${fruits[i]}"
done

output

0: apple
1: banana
2: dragon fruit
3: date
4: elderberry

Iterating over indices is useful when you need to update elements in place or preserve gaps in a sparse array.

Append and Prepend Elements

Append one or more elements with the += operator:

Terminal
fruits+=("fig" "grape")

The new values receive the next available indices at the end of the array.

To prepend a value, create a new array expansion with the new element first:

Terminal
fruits=("apricot" "${fruits[@]}")

This assignment rebuilds the array with contiguous indices starting at 0.

You can also assign a value at a specific index:

Terminal
fruits[10]="kiwi"

This creates a sparse array if indices 7 through 9 do not exist.

Remove Array Elements

Use unset with an index to remove one element:

Terminal
unset 'fruits[2]'

Quote the argument so the brackets are not treated as a filename pattern. The remaining elements keep their original indices, which leaves a gap where index 2 was removed.

To rebuild the array with contiguous indices, assign its current values back to it:

Terminal
fruits=("${fruits[@]}")

This preserves the values and renumbers them from 0.

To remove the entire array, pass only its name:

Terminal
unset fruits

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Task	Syntax
Number of elements	`${#arr[@]}`
Length of one element	`${#arr[index]}`
All values	`"${arr[@]}"`
All indices	`"${!arr[@]}"`
Slice	`"${arr[@]:offset:length}"`
Last two elements	`"${arr[@]: -2}"`
Append elements	`arr+=(x y)`
Prepend an element	`arr=(x "${arr[@]}")`
Set a specific index	`arr[index]=value`
Remove one element	`unset 'arr[index]'`
Reindex after removal	`arr=("${arr[@]}")`
Remove the array	`unset arr`

Common Pitfalls

Always use curly braces when accessing an indexed element. $fruits[1] expands $fruits and then prints the literal text [1], while ${fruits[1]} expands the element at index 1.

Inside double quotes, "${fruits[@]}" expands each element as a separate word. "${fruits[*]}" joins all elements into one string using the first character of IFS. Use the @ form for loops, function arguments, copies, and most other array operations.

Do not assume that array indices are contiguous after using unset or assigning a distant index. Iterate over "${!fruits[@]}" when the actual index values matter.

Conclusion

Bash array expansions cover length checks, slices, index iteration, and most everyday updates. Use quoted @ expansions to preserve element boundaries, and iterate over the real index list when an array may contain gaps.

pnpm Command: Install and Manage Node.js Packages

hello@linuxize.com (Linuxize) — Mon, 08 Jun 2026 10:30:00 +0200

Large Node.js projects can consume a surprising amount of disk space when every project keeps its own copies of the same packages. pnpm addresses this by storing package files in a shared content-addressable store and linking them into each project. It uses the npm registry and works with the same package.json files while providing stricter dependency handling and built-in workspace support.

This guide explains how to install pnpm on Linux, macOS, and Windows, then use it to create projects, install and update packages, run scripts, migrate from npm, and work across a monorepo.

Syntax

The general form of the command is:

txt
pnpm <command> [options]

Most pnpm commands have direct npm equivalents. For example, pnpm install installs project dependencies, pnpm add records a new dependency, and pnpm run executes a script from package.json.

How pnpm Stores Packages

pnpm keeps package files in a shared store on your machine. Projects link to those files instead of copying the same package contents into every node_modules directory. If ten projects use the same package version, pnpm stores its files once.

The resulting node_modules layout also prevents packages from importing dependencies they did not declare. This stricter behavior helps expose missing dependency declarations that npm’s flat dependency layout can sometimes hide.

You still commit package.json and the pnpm-lock.yaml lockfile to version control. The shared store and generated node_modules directory should not be committed.

Install pnpm

pnpm 11 requires Node.js 22.13 or newer when you install it through npm or Corepack. Check your current version first:

Terminal
node --version

If you need a newer release, follow our guide to install Node.js and npm on Ubuntu 26.04 , or use a Node.js version manager on other systems.

Install with Corepack

Corepack manages package-manager versions and can select the pnpm release recorded in a project’s package.json. Update Corepack first to avoid outdated signature data:

Terminal
npm install --global corepack@latest

Enable the pnpm shim:

Terminal
corepack enable pnpm

Pin pnpm for the current project:

Terminal
corepack use pnpm@latest-11

This adds a packageManager entry with an exact pnpm version to package.json, which helps contributors and CI jobs use the same release.

Install with npm

If you prefer a regular global package, install the current pnpm 11 release with:

Terminal
npm install --global pnpm@latest-11

This method requires a compatible Node.js version. It does not automatically enforce a project-specific pnpm version.

Install the Standalone Version

The standalone installer does not require Node.js to be present. On Linux, macOS, and other POSIX systems, run:

Terminal
curl -fsSL https://get.pnpm.io/install.sh | sh -

Warning

Piping a remote script into a shell runs code from the network as your user. Review the script before running it on a production system, or download it first and inspect the local file.

On Windows PowerShell, use:

powershell
Invoke-WebRequest https://get.pnpm.io/install.ps1 -UseBasicParsing | Invoke-Expression

Open a new terminal after the installer finishes, then verify the command:

Terminal
pnpm --version

output

11.5.2

Initialize a Project

Create a directory and initialize a package.json file:

Terminal
mkdir example-app
cd example-app
pnpm init

pnpm prompts for package metadata and writes the result to package.json. If you already have a project created with npm, pnpm can use its existing package.json without any conversion.

Install Packages

Add a runtime dependency with pnpm add:

Terminal
pnpm add express

pnpm installs the package, records it under dependencies in package.json, and creates or updates pnpm-lock.yaml.

Add development tools with -D (short for --save-dev):

Terminal
pnpm add -D eslint

To install a specific package version, append it after @:

Terminal
pnpm add express@5.1.0

When you clone an existing pnpm project, install everything declared in its package files with:

Terminal
pnpm install

For CI or another reproducible environment, prevent changes to the lockfile:

Terminal
pnpm install --frozen-lockfile

The command fails when package.json and pnpm-lock.yaml do not agree instead of resolving a new dependency tree.

Install Global Packages

Install a command-line tool globally with -g:

Terminal
pnpm add -g http-server

If pnpm reports that it cannot find a global binary directory, run:

Terminal
pnpm setup

Open a new terminal so the updated PATH takes effect, then repeat the global install. Keep application dependencies local to each project and reserve global installs for commands you need across projects.

Update and Inspect Packages

Check which dependencies have newer versions available:

Terminal
pnpm outdated

Update dependencies within the version ranges in package.json:

Terminal
pnpm update

To update one package to its latest published release and change its declared range, run:

Terminal
pnpm update express --latest

List the direct dependencies in the current project with:

Terminal
pnpm list --depth 0

When you need to understand why a package is present, use:

Terminal
pnpm why express

Remove Packages

Remove a dependency from node_modules, package.json, and the lockfile with:

Terminal
pnpm remove express

For a globally installed package, add -g:

Terminal
pnpm remove -g http-server

Run Scripts and Package Binaries

pnpm reads the scripts section of package.json just like npm. Given this file:

package.jsonjson
{
 "scripts": {
 "start": "node index.js",
 "lint": "eslint ."
 }
}

Run a named script with:

Terminal
pnpm run lint

You can omit run when the script name does not conflict with a pnpm command:

Terminal
pnpm start

Use pnpm exec to run a binary installed in the current project:

Terminal
pnpm exec eslint .

For a one-off package that you do not want to add as a dependency, use pnpm dlx:

Terminal
pnpm dlx create-vite@latest my-app

pnpm exec runs an existing local dependency, while pnpm dlx fetches a package temporarily and runs its command.

Migrate a Project from npm

From a project containing package-lock.json, generate a pnpm lockfile with:

Terminal
pnpm import

The command reads the npm lockfile and creates pnpm-lock.yaml. Install the imported dependency tree next:

Terminal
pnpm install

Run the project’s tests and build before removing package-lock.json. Commit pnpm-lock.yaml, and update CI commands from npm ci to pnpm install --frozen-lockfile.

If the repository records its package manager, set the current pnpm version with:

Terminal
corepack use pnpm@latest

Use pnpm Workspaces

A pnpm workspace groups multiple packages in one repository. Define its package locations in pnpm-workspace.yaml at the repository root:

pnpm-workspace.yamlyaml
packages:
 - "apps/*"
 - "packages/*"

Install dependencies for every workspace package from the root:

Terminal
pnpm install

Run a script recursively across all packages that define it:

Terminal
pnpm --recursive run build

Use --filter when a command should target one package:

Terminal
pnpm --filter web-app add zod
pnpm --filter web-app run test

Filters can select packages by name, directory, dependency relationship, or changed files, which makes them useful in larger monorepos and CI jobs.

Quick Reference

Task	Command
Check pnpm version	`pnpm --version`
Initialize a project	`pnpm init`
Install project dependencies	`pnpm install`
Install from an unchanged lockfile	`pnpm install --frozen-lockfile`
Add a dependency	`pnpm add <pkg>`
Add a development dependency	`pnpm add -D <pkg>`
Add a global package	`pnpm add -g <pkg>`
Show outdated packages	`pnpm outdated`
Update packages	`pnpm update`
Update one package to latest	`pnpm update <pkg> --latest`
Remove a package	`pnpm remove <pkg>`
Run a script	`pnpm run <script>`
Run a local package binary	`pnpm exec <command>`
Run a package temporarily	`pnpm dlx <pkg>`
List direct dependencies	`pnpm list --depth 0`
Explain an installed package	`pnpm why <pkg>`
Import an npm lockfile	`pnpm import`
Run a command in all workspaces	`pnpm --recursive <command>`
Target one workspace package	`pnpm --filter <name> <command>`

Troubleshooting

pnpm: command not found after installation
Open a new terminal so your shell reloads its PATH. For a standalone or global setup, run pnpm setup, restart the terminal, and check again with pnpm --version.

ERR_PNPM_UNSUPPORTED_ENGINE
The installed pnpm or one of the project packages requires a different Node.js version. pnpm 11 installed through npm or Corepack requires Node.js 22.13 or newer. Upgrade Node.js or use the standalone pnpm installer.

A package import worked with npm but fails with pnpm
The code may rely on a transitive dependency that is not declared in its own package.json. Add the missing package as a direct dependency instead of relying on npm’s flatter node_modules layout.

ERR_PNPM_OUTDATED_LOCKFILE in CI
The committed pnpm-lock.yaml does not match package.json. Run pnpm install locally, review and commit the updated lockfile, then rerun pnpm install --frozen-lockfile in CI.

Conclusion

pnpm uses the familiar npm package ecosystem while reducing duplicate package storage and enforcing clearer dependency declarations. If you are comparing workflows, see the npm command guide for the equivalent npm commands and lockfile behavior.

How to Install Ansible on Ubuntu 26.04 and Write Your First Playbook

hello@linuxize.com (Linuxize) — Sun, 07 Jun 2026 09:40:00 +0200

When you manage more than a handful of servers, running the same commands on each one over SSH stops scaling. Ansible solves that by describing the desired state of your infrastructure in YAML files, then applying that state across many hosts in parallel. There is no agent to install on the targets and no central server to maintain; Ansible only needs SSH access and Python on the managed hosts.

This guide explains how to install Ansible on Ubuntu 26.04, set up an inventory of remote hosts, run ad hoc commands, and write a small playbook that installs and starts Nginx on every host in a group.

Quick Reference

Task	Command
Install Ansible (apt)	`sudo apt install ansible`
Show version	`ansible --version`
Ping all hosts	`ansible all -m ping`
Run an ad hoc command	`ansible web -a "uptime"`
Run a playbook	`ansible-playbook site.yml`
Check an established playbook	`ansible-playbook --check --diff site.yml`
Limit to one host	`ansible-playbook site.yml --limit web1`
List inventory hosts	`ansible-inventory --list`
Edit a vault file	`ansible-vault edit secrets.yml`
Install a collection	`ansible-galaxy collection install community.general`

Prerequisites

Before installing Ansible, make sure you have:

A control node running Ubuntu 26.04 with a user with sudo privileges . This is the machine where you run the ansible commands.
One or more managed hosts you can reach over SSH from the control node. Ansible runs on the managed hosts using the Python interpreter that ships with Ubuntu, so no extra setup is required there.
SSH key-based authentication from the control node to each managed host. Password authentication works but is slower and limits automation.

Step 1: Install Ansible

Ansible is available in the Ubuntu 26.04 repositories. The ansible package installs ansible-core plus a curated set of community collections:

Terminal
sudo apt update
sudo apt install ansible

Confirm the install and the Python version Ansible is using:

Terminal
ansible --version

The output shows the Ansible version, the Python interpreter path, and the location of the default config file:

output

ansible [core 2.20.x]
config file = /etc/ansible/ansible.cfg
configured module search path = ['/home/user/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
ansible python module location = /usr/lib/python3/dist-packages/ansible
python version = 3.14.x

Ubuntu 26.04 provides the Ansible 13 community package with ansible-core 2.20. The exact patch versions may be newer after regular package updates.

If you need a release that is newer than the Ubuntu package, install Ansible in an isolated environment with pipx. This avoids changing packages in the system Python environment:

Terminal
sudo apt install pipx
pipx ensurepath
pipx install --include-deps ansible

Start a new shell after pipx ensurepath if the ansible command is not immediately available. The Ansible PPA does not currently publish an Ubuntu 26.04 package, so do not use it for this release.

Step 2: Create an Inventory File

The inventory is the list of hosts Ansible can talk to. Create a working directory for your project and a small inventory:

Terminal
mkdir -p ~/ansible-demo
cd ~/ansible-demo
nano inventory.ini

Add the following content. Replace the IP addresses with your own:

ini
[web]
web1 ansible_host=192.168.1.21
web2 ansible_host=192.168.1.22

[db]
db1 ansible_host=192.168.1.31

[all:vars]
ansible_user=ubuntu
ansible_python_interpreter=/usr/bin/python3

The [web] and [db] sections define groups. Each entry is a host alias followed by connection variables. The [all:vars] block sets defaults for every host. Set ansible_user to the SSH user on the managed hosts (often ubuntu on cloud images or your own user on a private fleet).

Tell Ansible to use this inventory by default by creating a project-level config:

Terminal
nano ansible.cfg

Add:

ini
[defaults]
inventory = ./inventory.ini

Ansible keeps SSH host-key checking enabled by default. Before the first Ansible run, connect to each server with SSH, verify its fingerprint, and accept the key:

Terminal
ssh ubuntu@192.168.1.21

Repeat this for each managed host. Verifying host keys protects the control node from connecting to an impersonated server.

Step 3: Test the Connection

Use the ping module to confirm Ansible can reach every host in the inventory. Despite the name, this module does not use ICMP; it logs in over SSH and runs a tiny Python module on the target:

Terminal
ansible all -m ping

A successful run prints a green pong for each host:

output

web1 | SUCCESS => {
"ansible_facts": {
"discovered_interpreter_python": "/usr/bin/python3"
},
"changed": false,
"ping": "pong"
}

If you see UNREACHABLE, check the SSH key, the user name in ansible_user, and basic connectivity with ssh ubuntu@192.168.1.21.

You can scope commands to a group instead of all. For example, list disk usage on every web host:

Terminal
ansible web -a "df -h /"

The -a flag runs an ad hoc command using the default command module. Use -m shell instead when the command relies on pipes, redirection, or shell expansion.

Step 4: Write Your First Playbook

A playbook is a YAML file that describes the desired state of your hosts. Create one that installs Nginx and makes sure the service is running on every web host:

Terminal
nano site.yml

Add the following content:

yaml
- name: Configure web servers
 hosts: web
 become: true
 tasks:
 - name: Install Nginx
 ansible.builtin.apt:
 name: nginx
 state: present
 update_cache: true

 - name: Ensure Nginx is running and enabled
 ansible.builtin.service:
 name: nginx
 state: started
 enabled: true

 - name: Deploy a custom landing page
 ansible.builtin.copy:
 content: "<h1>Managed by Ansible</h1>\n"
 dest: /var/www/html/index.html
 owner: root
 group: root
 mode: "0644"

The play targets the web group and uses become: true so each task runs as root through sudo. The three tasks install the nginx package, make sure the service is started and enabled at boot, and replace the default index page with a small marker.

Step 5: Run the Playbook

Check the YAML and playbook structure before changing the managed hosts:

Terminal
ansible-playbook --syntax-check site.yml

When the syntax check passes, run the playbook:

Terminal
ansible-playbook site.yml

The output ends with a per-host summary that looks like this:

output

PLAY RECAP *********************************************************************
web1 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0
web2 : ok=4 changed=3 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0

The changed=3 count means Ansible applied three of the four tasks (the gather facts task counts as ok only). Run the playbook in check mode after the initial configuration:

Terminal
ansible-playbook --check --diff site.yml

The check should report changed=0 because the hosts already match the playbook. Check mode is a simulation, and some modules do not fully support it, so review its output before relying on it for production changes.

Open http://<web_host_ip> in a browser and you should see the custom landing page.

Step 6: Use ansible-vault for Secrets

Most playbooks reference passwords or API tokens. ansible-vault encrypts variable files at rest so you can keep them in version control:

Terminal
ansible-vault create secrets.yml

Set a strong password when prompted. Add encrypted variables to the file, for example:

yaml
db_password: "s3cret-value"

Warning

The example above uses a placeholder password. Replace it with a real strong value, do not commit unencrypted credentials, and store the vault password in a password manager or in a file referenced by --vault-password-file outside the repository.

Reference the vault file from a play with vars_files and run the playbook with --ask-vault-pass or --vault-password-file:

yaml
- name: Configure web servers
 hosts: web
 become: true
 vars_files:
 - secrets.yml

Run the playbook and enter the vault password when prompted:

Terminal
ansible-playbook site.yml --ask-vault-pass

Ansible Vault protects data at rest. Use no_log: true on tasks that may print decrypted secrets, and never commit a vault password file to version control.

Troubleshooting

UNREACHABLE errors on every host
Ansible cannot SSH into the targets. Run ssh ansible_user@host manually to confirm the key, the user, and the network path. Check that ansible_user in the inventory matches the user that owns the authorized SSH key.

sudo: a password is required
The remote user requires a password for sudo and you did not pass one. Run the play with --ask-become-pass or configure passwordless sudo for the deploy user on the managed hosts.

Tasks fail with Could not find python interpreter
The discovery process picked the wrong path. Set ansible_python_interpreter=/usr/bin/python3 in the inventory [all:vars] block to pin it to the Ubuntu default.

Host key verification failed
The server key is missing from ~/.ssh/known_hosts, or it changed since the previous connection. Connect with SSH and verify the fingerprint. If the server was rebuilt, remove only its stale entry with ssh-keygen -R 192.168.1.21, then reconnect and verify the new key.

Playbook reports changed on every run for the same task
A task is not idempotent. Re-check the module you used. For example, prefer ansible.builtin.copy or ansible.builtin.template over command: echo ... > file, because shell redirection always reports changed.

FAQ

What is the difference between Ansible and ansible-core?
ansible-core is the engine and the small set of built-in modules. The ansible package adds a curated bundle of community collections on top of ansible-core. Most users install ansible and pull additional collections with ansible-galaxy as needed.

Do I need to install anything on the managed hosts?
Only Python and an SSH server, both of which ship by default on Ubuntu. See How to Install Python on Ubuntu 26.04 if you need to confirm the interpreter is present.

Can I run Ansible against the local machine?
Yes. Add a localhost ansible_connection=local entry to the inventory, or run a playbook with ansible-playbook -i localhost, -c local site.yml. The trailing comma after localhost tells Ansible to treat the value as an inline inventory rather than a file path.

How do I structure a real project?
Split logic into roles under a roles/ directory, group host variables under group_vars/, and host-specific values under host_vars/. Keep site.yml short and import roles per group. The Ansible documentation calls this layout a “best-practices project”.

Next Steps

You now have a working Ansible setup on Ubuntu 26.04 and a first playbook that configures a group of web servers. From here you can break tasks into roles, parameterize plays with variables and templates, and add CI to run ansible-playbook --check on every push. You can also use the same inventory and roles to prepare hosts before you install Docker on Ubuntu 26.04 .

Ansible Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 07 Jun 2026 00:00:00 +0200

Install & Verify

Set up Ansible on the control node. See the full Ansible install guide .

Command	Description
`sudo apt install ansible`	Install on Ubuntu, Debian, and derivatives
`sudo dnf install ansible`	Install on Fedora, RHEL, and derivatives
`pipx install --include-deps ansible`	Install latest in an isolated environment
`ansible --version`	Show version and config file path
`ansible-config dump`	Show all active configuration settings
`ansible-config dump --only-changed`	Show only non-default settings

Inventory

Define and inspect the hosts Ansible manages.

Command	Description
`ansible-inventory --list`	Show the full inventory as JSON
`ansible-inventory --graph`	Show groups and hosts as a tree
`ansible all --list-hosts`	List every host in the inventory
`ansible web --list-hosts`	List hosts in the `web` group
`ansible -i inventory.ini all -m ping`	Use a specific inventory file
`ansible -i 'host,' all -m ping`	Use an inline inventory (note the comma)

Inventory File (INI)

Basic structure of a static inventory.ini file.

Syntax	Description
`[web]`	Define a host group
`web1 ansible_host=192.168.1.21`	Host alias with connection address
`[all:vars]`	Variables applied to every host
`ansible_user=ubuntu`	SSH user for the connection
`ansible_python_interpreter=/usr/bin/python3`	Pin the remote Python path
`[prod:children]`	Group made up of other groups

Ad Hoc Commands

Run a single module against hosts without a playbook.

Command	Description
`ansible all -m ping`	Test SSH and Python on every host
`ansible web -a "uptime"`	Run a command (default `command` module)
`ansible web -m shell -a "ps aux \| grep nginx"`	Use the shell module for pipes and redirection
`ansible web -b -m apt -a "name=nginx state=present"`	Install a package as root (`-b` = become)
`ansible web -m service -a "name=nginx state=restarted" -b`	Restart a service
`ansible web -m copy -a "src=a.conf dest=/etc/a.conf" -b`	Copy a file to the hosts
`ansible web -m setup`	Gather and print all host facts

Running Playbooks

Apply a playbook with ansible-playbook .

Command	Description
`ansible-playbook site.yml`	Run a playbook
`ansible-playbook --syntax-check site.yml`	Validate YAML and structure only
`ansible-playbook --check --diff site.yml`	Dry run and show would-be changes
`ansible-playbook site.yml --limit web1`	Run against a single host
`ansible-playbook site.yml --tags deploy`	Run only tasks with a tag
`ansible-playbook site.yml --skip-tags slow`	Skip tasks with a tag
`ansible-playbook site.yml --start-at-task "name"`	Begin at a named task
`ansible-playbook site.yml -e "var=value"`	Pass an extra variable
`ansible-playbook site.yml -K`	Prompt for the become (sudo) password

Common Modules

Frequently used built-in modules in tasks.

Module	Description
`ansible.builtin.apt`	Manage packages on Debian-based systems
`ansible.builtin.dnf`	Manage packages on RHEL-based systems
`ansible.builtin.service`	Start, stop, enable, and restart services
`ansible.builtin.copy`	Copy a file to managed hosts
`ansible.builtin.template`	Render a Jinja2 template to a file
`ansible.builtin.file`	Set path state, owner, group, and mode
`ansible.builtin.lineinfile`	Ensure a line is present in a file
`ansible.builtin.user`	Create and manage user accounts
`ansible.builtin.git`	Check out a Git repository
`ansible.builtin.systemd_service`	Manage systemd units directly

Playbook Keywords

Core directives used inside a play or task.

Keyword	Description
`hosts:`	Target group or host pattern for the play
`become: true`	Run tasks with privilege escalation (sudo)
`vars:`	Define variables for the play
`vars_files:`	Load variables from external files
`tasks:`	List of tasks to run in order
`handlers:`	Tasks triggered by `notify`
`notify:`	Trigger a handler when a task changes
`when:`	Run a task only if a condition is true
`loop:`	Repeat a task over a list
`register:`	Save a task result to a variable

Ansible Vault

Encrypt secrets so they are safe to commit.

Command	Description
`ansible-vault create secrets.yml`	Create a new encrypted file
`ansible-vault edit secrets.yml`	Edit an encrypted file
`ansible-vault view secrets.yml`	View without editing
`ansible-vault encrypt vars.yml`	Encrypt an existing plaintext file
`ansible-vault decrypt vars.yml`	Decrypt a file back to plaintext
`ansible-vault rekey secrets.yml`	Change the vault password
`ansible-playbook site.yml --ask-vault-pass`	Prompt for the vault password at run
`ansible-playbook site.yml --vault-password-file .pass`	Read the vault password from a file

Galaxy & Collections

Install and manage roles and collections.

Command	Description
`ansible-galaxy collection install community.general`	Install a collection
`ansible-galaxy collection list`	List installed collections
`ansible-galaxy role install geerlingguy.nginx`	Install a role from Galaxy
`ansible-galaxy role list`	List installed roles
`ansible-galaxy install -r requirements.yml`	Install from a requirements file
`ansible-galaxy init my_role`	Scaffold a new role directory

OpenSSL Cheatsheet

hello@linuxize.com (Linuxize) — Sat, 06 Jun 2026 10:40:00 +0200

Version and Help

Check the installed OpenSSL version and find command help.

Command	Description
`openssl version`	Show OpenSSL version
`openssl version -a`	Show build details and paths
`openssl help`	List available commands
`openssl req -help`	Show help for the req command
`openssl x509 -help`	Show help for certificate inspection

Private Keys

Generate RSA and elliptic-curve private keys.

Command	Description
`openssl genrsa -out private.key 2048`	Generate RSA private key
`openssl genrsa -out private.key 4096`	Generate larger RSA key
`openssl genrsa -aes256 -out private.key 2048`	Generate encrypted RSA key
`openssl rsa -in encrypted.key -out plain.key`	Remove key passphrase
`openssl ecparam -name prime256v1 -genkey -noout -out ec.key`	Generate EC private key
`chmod 600 private.key`	Restrict private key permissions

Certificate Signing Requests

Create CSRs for certificate authorities.

Command	Description
`openssl req -new -newkey rsa:2048 -noenc -keyout domain.key -out domain.csr`	Generate key and CSR
`openssl req -new -key domain.key -out domain.csr`	Create CSR from existing key
`openssl req -new -newkey rsa:2048 -noenc -keyout domain.key -out domain.csr -subj "/CN=example.com"`	Non-interactive CSR
`openssl req -new -key domain.key -out domain.csr -addext "subjectAltName=DNS:example.com,DNS:www.example.com"`	CSR with SAN names
`openssl req -in domain.csr -noout -text`	Inspect CSR contents
`openssl req -in domain.csr -noout -subject`	Print CSR subject

Self-Signed Certificates

Create local and internal certificates.

Command	Description
`openssl req -x509 -newkey rsa:2048 -noenc -keyout selfsigned.key -out selfsigned.crt -days 365`	Generate self-signed certificate
`openssl req -x509 -new -key domain.key -out domain.crt -days 365`	Self-sign with existing key
`openssl req -x509 -newkey rsa:2048 -noenc -keyout localhost.key -out localhost.crt -days 365 -subj "/CN=localhost" -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"`	Localhost certificate with SAN
`openssl x509 -in selfsigned.crt -noout -text`	Inspect certificate
`openssl x509 -in selfsigned.crt -noout -dates`	Show validity dates

Certificate Inspection

Read certificate fields without opening a browser.

Command	Description
`openssl x509 -in cert.crt -noout -text`	Show full certificate details
`openssl x509 -in cert.crt -noout -subject`	Show subject
`openssl x509 -in cert.crt -noout -issuer`	Show issuer
`openssl x509 -in cert.crt -noout -dates`	Show notBefore and notAfter
`openssl x509 -in cert.crt -noout -serial`	Show serial number
`openssl x509 -in cert.crt -noout -fingerprint -sha256`	Show SHA-256 fingerprint

Match Key, CSR, and Certificate

Confirm that files belong together before deployment.

Command	Description
`openssl rsa -in domain.key -noout -modulus \| openssl md5`	Hash RSA key modulus
`openssl x509 -in domain.crt -noout -modulus \| openssl md5`	Hash certificate modulus
`openssl req -in domain.csr -noout -modulus \| openssl md5`	Hash CSR modulus
`openssl pkey -in private.key -pubout -outform pem`	Extract public key from private key
`openssl x509 -in domain.crt -pubkey -noout`	Extract public key from certificate

Format Conversion

Convert certificates between common encodings and bundles.

Command	Description
`openssl x509 -in cert.pem -outform der -out cert.der`	Convert PEM certificate to DER
`openssl x509 -in cert.der -inform der -out cert.pem`	Convert DER certificate to PEM
`openssl pkcs12 -export -out bundle.pfx -inkey domain.key -in domain.crt`	Create PKCS#12 bundle
`openssl pkcs12 -in bundle.pfx -out bundle.pem -noenc`	Extract PEM from PKCS#12
`openssl rsa -in private.key -outform der -out private.der`	Convert RSA key to DER

TLS Connection Testing

Debug live TLS services with s_client.

Command	Description
`openssl s_client -connect example.com:443 -servername example.com`	Test HTTPS with SNI
`openssl s_client -connect mail.example.com:993 -servername mail.example.com`	Test IMAPS TLS
`openssl s_client -starttls smtp -connect mail.example.com:587 -servername mail.example.com`	Test SMTP STARTTLS
`echo \| openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \| openssl x509 -noout -dates`	Show remote certificate dates
`openssl s_client -connect example.com:443 -tls1_3`	Force TLS 1.3
`openssl s_client -connect example.com:443 -showcerts`	Show certificate chain

Random Data and Hashes

Generate tokens and verify file digests.

Command	Description
`openssl rand -base64 32`	Generate base64 token
`openssl rand -hex 32`	Generate hex token
`openssl dgst -sha256 file.iso`	SHA-256 file hash
`openssl dgst -sha512 file.iso`	SHA-512 file hash
`openssl dgst -sha256 -binary file.iso \| openssl base64`	Base64-encoded binary digest

Use these references for certificate workflows.

Guide	Description
OpenSSL Command Guide	Full OpenSSL tutorial with examples
Create a Self-Signed SSL Certificate	Step-by-step self-signed certificate guide
What is an SSL Certificate?	SSL/TLS certificate concepts
dig Command	Check DNS before certificate testing

How to Use OpenSSL: Generate Keys, Certificates, and Test TLS

hello@linuxize.com (Linuxize) — Sat, 06 Jun 2026 09:25:00 +0200

Sooner or later, working with web servers, mail servers, or APIs means dealing with TLS certificates. You may need a private key for a new service, a certificate signing request to send to a certificate authority, a quick self-signed certificate for a test environment, or a way to confirm what a remote server is actually presenting. OpenSSL covers all of this from a single command-line tool.

OpenSSL is the de facto toolkit for the TLS and SSL protocols on Linux. It ships with almost every distribution and exposes dozens of subcommands for key generation, certificate handling, encoding conversions, and connection testing.

This guide explains how to use openssl to generate keys, create and inspect certificates, convert between formats, and test live TLS connections.

Syntax

OpenSSL works through subcommands, each with its own options:

txt
openssl command [ command_options ] [ arguments ]

For example, openssl genrsa generates an RSA key, while openssl x509 works with X.509 certificates. You can list every available subcommand with:

Terminal
openssl help

Check which version is installed before you start, since option defaults change between major releases:

Terminal
openssl version

output

OpenSSL 3.5.5 27 Jan 2026

OpenSSL 3.x is the current series on modern distributions. The examples below work on the 3.x line.

Generate a Private Key

Most certificate work starts with a private key. To create a 2048-bit RSA key, run:

Terminal
openssl genrsa -out private.key 2048

This writes an unencrypted key to private.key. A 2048-bit key is the practical minimum today; use 4096 bits when you want a wider safety margin and do not mind the small performance cost.

To protect the key with a passphrase, add a cipher option such as -aes256:

Terminal
openssl genrsa -aes256 -out private.key 2048

OpenSSL prompts you for the passphrase and encrypts the key on disk. The service that uses the key will then ask for that passphrase on startup.

Elliptic-curve keys are smaller and faster than RSA at equivalent security. To generate one on the widely supported prime256v1 curve:

Terminal
openssl ecparam -name prime256v1 -genkey -noout -out ec-private.key

Warning

A private key is a secret. Keep its permissions tight (chmod 600 private.key), never commit it to version control, and add key files to your .gitignore. Anyone who has the key can impersonate your service.

Create a Certificate Signing Request

A certificate signing request (CSR) bundles your public key and identifying details so a certificate authority can issue a signed certificate. Generate a key and CSR together:

Terminal
openssl req -new -newkey rsa:2048 -noenc -keyout domain.key -out domain.csr

OpenSSL prompts for the subject fields. The Common Name (CN) should match the primary domain you are securing, for example example.com. The -noenc option leaves the key unencrypted so a service can read it without a passphrase prompt.

To skip the interactive prompts, pass the subject inline and add Subject Alternative Name (SAN) entries for each hostname the certificate should cover:

Terminal
openssl req -new -newkey rsa:2048 -noenc \
 -keyout domain.key -out domain.csr \
 -subj "/C=US/ST=California/L=San Francisco/O=Example Inc/CN=example.com" \
 -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

Inspect the finished CSR to confirm the details before sending it off:

Terminal
openssl req -in domain.csr -noout -text

The output lists the subject, public key, and any requested extensions.

Create a Self-Signed Certificate

For local development, internal tools, or testing, a self-signed certificate avoids the need for a CA. Generate a key and certificate valid for one year in a single command:

Terminal
openssl req -x509 -newkey rsa:2048 -noenc \
 -keyout selfsigned.key -out selfsigned.crt \
 -days 365 \
 -subj "/CN=localhost" \
 -addext "subjectAltName=DNS:localhost,IP:127.0.0.1"

The -x509 option tells req to output a certificate instead of a request, and -days 365 sets the validity period. Browsers will warn that the certificate is not trusted, which is expected for self-signed certificates. For a fuller walkthrough, see our guide on creating a self-signed SSL certificate .

When you need a browser-trusted certificate for a public site, use a CA such as Let’s Encrypt instead.

Inspect a Certificate

To read the contents of a certificate in human-readable form:

Terminal
openssl x509 -in selfsigned.crt -noout -text

This prints the issuer, subject, validity dates, public key, and extensions. When you only need specific fields, target them directly. To see just the validity window:

Terminal
openssl x509 -in selfsigned.crt -noout -dates

output

notBefore=Jan 1 08:00:00 2026 GMT
notAfter=Jan 1 08:00:00 2027 GMT

To print the subject and issuer:

Terminal
openssl x509 -in selfsigned.crt -noout -subject -issuer

For a self-signed certificate, the subject and issuer are the same.

Verify Key, Certificate, and CSR Match

When deploying a certificate, the private key, certificate, and CSR must all share the same public key. A mismatch is a common cause of services that refuse to start. Compare their modulus hashes:

Terminal
openssl rsa -in domain.key -noout -modulus | openssl md5
openssl x509 -in domain.crt -noout -modulus | openssl md5
openssl req -in domain.csr -noout -modulus | openssl md5

All three commands must print the same hash. If one differs, the files do not belong together.

Convert Certificate Formats

Different platforms expect different encodings. OpenSSL converts between them.

Convert a PEM certificate to DER (binary), often required by Java or Windows tools:

Terminal
openssl x509 -in cert.pem -outform der -out cert.der

Convert DER back to PEM:

Terminal
openssl x509 -in cert.der -inform der -outform pem -out cert.pem

Bundle a certificate and private key into a PKCS#12 file (.pfx or .p12), the format many Windows services and load balancers expect:

Terminal
openssl pkcs12 -export -out bundle.pfx -inkey domain.key -in domain.crt

OpenSSL asks for an export password that protects the bundle.

Test a TLS Connection

The s_client subcommand opens a TLS connection to a server and reports what it negotiated. This is the fastest way to debug a certificate that does not seem to work:

Terminal
openssl s_client -connect example.com:443

The output shows the certificate chain, the negotiated protocol and cipher, and the verification result. Press Ctrl+C or type Q to close the session.

When a server hosts several names on one IP, send the hostname with Server Name Indication so you get the right certificate:

Terminal
openssl s_client -connect example.com:443 -servername example.com

To check when a live certificate expires without scrolling through the full chain, pipe the output into x509:

Terminal
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
 | openssl x509 -noout -dates

The echo closes the connection immediately so the command returns instead of waiting for input. This is handy for verifying renewals after a certificate is reissued. If a hostname is not resolving as expected during testing, the dig command helps confirm the DNS records first.

Generate Random Data and Hashes

OpenSSL also doubles as a general crypto utility. Generate a random, URL-safe token:

Terminal
openssl rand -base64 32

Hash a file with SHA-256:

Terminal
openssl dgst -sha256 file.iso

These small helpers are useful for generating secrets or verifying downloads when no dedicated tool is at hand.

Quick Reference

For a printable quick reference, see the OpenSSL cheatsheet .

Task	Command
Show version	`openssl version`
Generate RSA key	`openssl genrsa -out private.key 2048`
Generate EC key	`openssl ecparam -name prime256v1 -genkey -noout -out ec.key`
Create CSR	`openssl req -new -newkey rsa:2048 -noenc -keyout d.key -out d.csr`
Self-signed cert	`openssl req -x509 -newkey rsa:2048 -noenc -keyout d.key -out d.crt -days 365`
Inspect cert	`openssl x509 -in cert.crt -noout -text`
Check expiry dates	`openssl x509 -in cert.crt -noout -dates`
PEM to DER	`openssl x509 -in cert.pem -outform der -out cert.der`
Export PKCS#12	`openssl pkcs12 -export -out b.pfx -inkey d.key -in d.crt`
Test TLS	`openssl s_client -connect host:443 -servername host`

Troubleshooting

unable to load Private Key
The key file is encrypted and OpenSSL expected an unencrypted one, or the file is corrupt. Add the passphrase when prompted, or regenerate the key with -noenc if the service cannot supply a passphrase.

verify error:num=18:self signed certificate
s_client is reporting that the chain ends in a self-signed certificate. This is normal for self-signed certificates and for testing. For a public site, install the full chain issued by your CA.

verify error:num=20:unable to get local issuer certificate
The server did not send the intermediate certificate. Concatenate your certificate and the CA intermediate into one file and serve that combined file.

Key and certificate modulus do not match
The certificate was not issued for this key. Re-check that you generated the CSR from the same key the CA signed, then compare modulus hashes as shown above.

FAQ

What is the difference between a CSR and a certificate?
A CSR contains your public key and identity details and is sent to a certificate authority. The CA returns a signed certificate. The CSR is the request; the certificate is the issued result.

Should I use RSA or elliptic-curve keys?
Elliptic-curve keys (such as prime256v1) are smaller and faster at equivalent security and are well supported. RSA 2048 remains a safe, widely compatible default. Either is fine for most servers.

How do I remove a passphrase from a key?
Run openssl rsa -in encrypted.key -out plain.key. OpenSSL prompts for the current passphrase and writes an unencrypted copy. Protect that file carefully, since it is no longer passphrase-protected.

Why does my self-signed certificate trigger browser warnings?
Browsers only trust certificates signed by a recognized authority. Self-signed certificates are not in that trust store, so the warning is expected. Use Let’s Encrypt for public sites.

Conclusion

OpenSSL handles the full lifecycle of TLS material: keys, requests, certificates, format conversions, and live connection testing. When you move from generating certificates to serving them, use a trusted CA and keep renewal on a schedule so certificates do not expire unnoticed.

npm Cheatsheet

hello@linuxize.com (Linuxize) — Fri, 05 Jun 2026 10:20:00 +0200

Project Setup

Create and inspect project metadata.

Command	Description
`npm init`	Create package.json interactively
`npm init -y`	Create package.json with defaults
`npm pkg get name`	Print package name
`npm pkg set scripts.start="node index.js"`	Add or update a script
`npm pkg delete scripts.old`	Remove a package.json field

Install Dependencies

Add project, development, and global packages.

Command	Description
`npm install`	Install project dependencies
`npm install package`	Install and save dependency
`npm install -D package`	Install development dependency
`npm install -g package`	Install global CLI package
`npm install package@1.2.3`	Install a specific version
`npm install package@latest`	Install latest published version
`npm install --no-save package`	Install without saving

Clean Installs

Reproduce dependency trees from lock files.

Command	Description
`npm ci`	Clean install from package-lock.json
`npm ci --omit=dev`	Install production dependencies only
`npm install --omit=dev`	Skip development dependencies
`npm install --package-lock-only`	Update lock file only
`npm install --ignore-scripts`	Install without lifecycle scripts

Versions and Updates

Check outdated packages and update dependency ranges.

Command	Description
`npm outdated`	Show packages with newer versions
`npm update`	Update within package.json ranges
`npm update package`	Update one package
`npm view package version`	Show latest package version
`npm view package versions`	List published versions
`npm version patch`	Bump package patch version
`npm version minor`	Bump package minor version

Remove and Clean

Uninstall packages and clear generated files.

Command	Description
`npm uninstall package`	Remove dependency
`npm uninstall -D package`	Remove development dependency
`npm uninstall -g package`	Remove global package
`npm prune`	Remove extraneous packages
`npm dedupe`	Reduce duplicate dependencies
`npm cache verify`	Verify npm cache
`npm cache clean --force`	Clear npm cache

Scripts and Execution

Run package scripts and one-off tools.

Command	Description
`npm run`	List available scripts
`npm run script`	Run a named script
`npm start`	Run the start script
`npm test`	Run the test script
`npm run build -- --watch`	Pass args to script
`npx package`	Run package binary once
`npm create vite@latest app`	Run create package

Inspect Packages

List dependencies and package metadata.

Command	Description
`npm list`	List direct dependencies
`npm list --all`	List full dependency tree
`npm list -g --depth=0`	List global packages
`npm explain package`	Explain why package is installed
`npm root`	Show local node_modules path
`npm root -g`	Show global node_modules path

Configuration

View and change npm settings.

Command	Description
`npm config list`	Show current config
`npm config get prefix`	Show global install prefix
`npm config set prefix ~/.npm-global`	Set global install prefix
`npm config get registry`	Show registry URL
`npm config set registry url`	Set registry URL
`npm whoami`	Show logged-in npm user
`npm login`	Log in to npm registry

Security and Audit

Check dependency risks and funding metadata.

Command	Description
`npm audit`	Scan dependencies for advisories
`npm audit fix`	Apply compatible security fixes
`npm audit --omit=dev`	Audit production dependencies
`npm fund`	Show funding links
`npm doctor`	Check npm environment
`npm ping`	Test registry connection

Use these references for Node.js and package workflows.

Guide	Description
`npm Command`	Full npm tutorial with examples
`Install Node.js on Ubuntu 26.04`	Install Node.js and npm
`Install Yarn on Ubuntu 20.04`	Alternative package manager

npm Command: Install and Manage Node.js Packages

hello@linuxize.com (Linuxize) — Fri, 05 Jun 2026 09:30:00 +0200

When you start or clone a Node.js project, one of the first things you usually do is install its packages. npm is the default package manager that ships with Node.js, and it is the command you use to add, update, remove, and run project dependencies. It reads and writes the package.json file that records what your project needs.

This guide walks through the npm commands you will use most often: starting a project, installing local and global packages, pinning versions, updating and removing dependencies, and running project scripts.

Syntax

The general form of the command is:

txt
npm <command> [args] [options]

npm ships with Node.js, so installing Node.js installs npm too. If you have not set up Node.js yet, see our guide on installing Node.js on Ubuntu 26.04 . Before we run package commands, confirm both tools are available:

Terminal
node --version
npm --version

output

v24.16.0
11.13.0

If npm reports a version, you are ready to go.

Initialize a Project

Every npm project centers on a package.json file. This file lists the project dependencies, scripts, package name, version, and other metadata. Create one in the current directory with:

Terminal
npm init

npm asks a series of questions (name, version, entry point, and so on) and writes your answers to package.json. To accept all the defaults without prompts, add the -y flag:

Terminal
npm init -y

This is the usual starting point for a new project. Once package.json exists, later npm install commands have a file where they can record dependencies.

Install Packages

To add a package to your project, run npm install with the package name:

Terminal
npm install express

This downloads express into a node_modules directory and records it under dependencies in package.json. npm also creates or updates package-lock.json, which records the exact versions that were installed.

For tools you only need while developing, such as test runners or linters, save them as development dependencies with -D (short for --save-dev):

Terminal
npm install -D eslint

These land under devDependencies and are skipped when a project is installed for production with npm install --omit=dev.

When you clone an existing project, you do not install each package by hand. Run install with no arguments from the project directory:

Terminal
npm install

npm reads package.json and the lock file, installs the missing packages, and updates package-lock.json when dependency ranges need to be resolved. This is the command you usually run during local development.

For CI jobs, clean deploys, and other repeatable installs, use npm ci instead:

Terminal
npm ci

npm ci requires an existing package-lock.json, removes any current node_modules directory, and installs the exact dependency tree from the lock file without changing package.json or package-lock.json.

Install Global Packages

Some packages are command-line tools you may want available everywhere instead of tied to one project. Install them globally with -g:

Terminal
sudo npm install -g http-server

The tool is then on your PATH and can be run from any directory. Reserve global installs for command-line utilities. Project dependencies should stay local so each project controls its own versions.

Tip

Using sudo for global installs works but can create permission headaches. A cleaner approach is to manage Node.js with a version manager such as nvm, which installs global packages under your home directory and removes the need for sudo.

Install a Specific Version

When a project needs a specific package release, append @ and the version number:

Terminal
npm install express@4.18.2

You can also install by tag, such as npm install express@latest for the newest release or @next for a prerelease line. Pinning a specific version is useful when you need to match an application requirement or avoid a breaking change in a newer release.

Update and Inspect Packages

Before updating packages, check what is currently installed and what newer versions are available:

Terminal
npm outdated

output

Package Current Wanted Latest Location
express 4.18.0 4.18.2 4.19.2 node_modules/express

The Wanted column is the newest version allowed by the range in package.json, while Latest is the newest published. Update packages to the wanted versions with:

Terminal
npm update

If you want to move to a new major version beyond your declared range, install that version explicitly as shown above.

Remove Packages

When a dependency is no longer needed, uninstall it and remove it from package.json with:

Terminal
npm uninstall express

npm removes the package from node_modules and updates both package.json and the lock file. For a global package, add -g:

Terminal
sudo npm uninstall -g http-server

Run Scripts

The scripts section of package.json defines named commands for common project tasks. A typical file might include:

json
{
 "scripts": {
 "start": "node index.js",
 "test": "jest"
 }
}

Run a script with npm run followed by its name:

Terminal
npm run start

The start and test names are special and can be run without run, so npm start and npm test both work. Scripts are how most projects expose their build, test, lint, and development commands.

List Installed Packages

When you need to inspect what is installed in the current project, use:

Terminal
npm list

By default, recent npm versions show the top-level project and its direct dependencies. If you need to inspect the full nested tree, add --all:

Terminal
npm list --all

Add -g to list globally installed packages instead.

Run a Package Without Installing It

The npx command, bundled with npm, runs a package binary without a permanent global install. Use it when you need a one-off tool but do not want to add it to the project:

Terminal
npx prettier@latest --check .

npx downloads the package if needed, runs it, and does not leave a global install behind. For project scaffolding, many packages also support the npm create form. For example, to start a Vite React project, run:

Terminal
npm create vite@latest my-app -- --template react

Quick Reference

For a printable quick reference, see the npm cheatsheet .

Task	Command
Create package.json	`npm init -y`
Install a package	`npm install <pkg>`
Install as dev dependency	`npm install -D <pkg>`
Install all dependencies	`npm install`
Clean install from lock file	`npm ci`
Install globally	`npm install -g <pkg>`
Install a specific version	`npm install <pkg>@1.2.3`
Show outdated packages	`npm outdated`
Update packages	`npm update`
Remove a package	`npm uninstall <pkg>`
Run a script	`npm run <script>`
List installed packages	`npm list`
List full dependency tree	`npm list --all`
Run without installing	`npx <pkg>`

Troubleshooting

EACCES: permission denied during a global install
A global install is trying to write to a system directory your user cannot modify. Either prefix the command with sudo, or, better, manage Node.js with nvm so global packages install under your home directory without root permissions.

A script exits with an npm error
The script ran but one of the commands inside it exited with an error. Scroll up to the actual command output above the npm error block; the underlying tool, not npm, is usually reporting the failure.

Conflicting peer dependency errors on install
A package expects a different version of a shared dependency than what is installed. Resolve the version mismatch where possible, or, as a temporary measure, retry with npm install --legacy-peer-deps while you sort out the conflict.

FAQ

What is the difference between dependencies and devDependencies?
dependencies are packages your application needs to run. devDependencies are needed only during development, such as test frameworks and linters, and are installed with -D. Production installs can skip them with --omit=dev.

What does package-lock.json do?
It records the exact version of every installed package, including nested dependencies. Commit it to version control, then use npm ci when you need an exact lock-file install in CI or deployment.

What is the difference between npm and npx?
npm installs and manages packages, while npx runs a package’s executable, downloading it temporarily if it is not installed. Use npx for one-off commands and scaffolding tools.

How do I install a package without saving it to package.json?
Add the --no-save flag, for example npm install --no-save <pkg>. The package is installed into node_modules but the change is not recorded in package.json.

Conclusion

A small set of commands, npm install, npm ci, npm update, npm uninstall, and npm run, covers nearly all package work in a Node.js project. Keep package-lock.json committed, and use npm ci whenever repeatable installs matter. For a package manager that uses a shared content-addressable store and built-in workspace filtering, see the pnpm command guide .

Fix "sudo: command not found" on Linux

hello@linuxize.com (Linuxize) — Thu, 04 Jun 2026 09:35:00 +0200

You log in to a fresh server, try to install a package, and the shell answers with sudo: command not found. It is a confusing message, because sudo feels like a built-in part of Linux. In reality sudo is a regular package that some minimal images and container base layers skip, and it is also one of the first commands to disappear when your shell environment is broken.

This guide explains the three reasons the error shows up: sudo is not installed, your user is not allowed to run it, or your PATH no longer points to /usr/bin. Each case has a clean fix.

Quick Reference

What to check	Command	What to do
Is sudo installed?	`ls -l /usr/bin/sudo`	Install the `sudo` package as root if the file is missing
Is your user allowed to use sudo?	`groups username`	Add the user to `sudo` on Debian/Ubuntu or `wheel` on Fedora/RHEL/Arch
Is PATH broken?	`echo $PATH`	Restore `/usr/bin`, `/usr/sbin`, `/bin`, and `/sbin` in your shell startup file
Does sudo work by absolute path?	`/usr/bin/sudo whoami`	Fix the shell `PATH` if this works but `sudo whoami` fails

Confirm the Real Cause

Before installing anything, check whether the sudo binary exists on the system:

Terminal
ls -l /usr/bin/sudo

output

-rwsr-xr-x 1 root root 277936 Jan 17 09:42 /usr/bin/sudo

If the file is there with the SUID bit (s in the owner permissions), sudo is installed and the error is environmental. If the file is missing, you need to install the package as the root user. Pick the section below that matches your situation.

Install sudo on Debian, Ubuntu, and Derivatives

Minimal Debian installs and many Docker base images leave sudo out. Switch to the root account first, because without sudo you cannot escalate privileges from a normal user:

Terminal
su -

Enter the root password, then install the package with apt:

Terminal
apt update
apt install sudo

If su itself is rejected because root has no password (the default on Ubuntu desktop installs), boot into recovery mode or use a live USB to set a root password before retrying.

Install sudo on Fedora, RHEL, and Derivatives

On Fedora, RHEL, Rocky Linux, and AlmaLinux, switch to root and install with dnf:

Terminal
su -
dnf install sudo

On older Red Hat-family systems you may see yum referenced in tutorials; dnf is the current package manager and the right choice on every supported release.

Install sudo on Arch Linux

Arch ships a minimal base, and sudo is a separate package:

Terminal
su -
pacman -S sudo

Install sudo on Alpine Linux

Alpine, which is common inside containers, uses apk. Two options exist: the full sudo package, or the lighter doas replacement.

Terminal
su -
apk add sudo

If you only need privilege escalation inside a container and want to keep the image small, apk add doas followed by a one-line /etc/doas.conf is often enough.

Add Your User to the sudo Group

Installing the package is only half the job. By default, only users that belong to a specific administrative group can run sudo. The group name varies by distribution.

On Debian and Ubuntu, the group is sudo:

Terminal
usermod -aG sudo sara

On Fedora, RHEL, and Arch, the group is wheel:

Terminal
usermod -aG wheel sara

Group changes only take effect on a new login session. Log out and back in, then verify membership:

Terminal
groups sara

output

sara : sara sudo

The presence of sudo (or wheel) in the list confirms the user can now run privileged commands.

Fix a Broken PATH

If /usr/bin/sudo exists but the shell still reports “command not found”, the problem is your PATH . A typo in ~/.bashrc or ~/.zshrc can wipe out the standard directories. Check the current value:

Terminal
echo $PATH

output

/home/sara/bin:/home/sara/.local/bin

When /usr/bin and /usr/local/bin are missing, the shell cannot find any of the system binaries. Restore a sane PATH for the current session by calling sudo with its absolute path:

Terminal
/usr/bin/sudo apt update

That works as a one-off, but the durable fix is to repair the shell config. Open the file that broke the variable:

Terminal
nano ~/.bashrc

A safe baseline looks like this:

~/.bashrcsh
export PATH="$HOME/bin:$HOME/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

The key detail is keeping $PATH itself in any line that extends it. A line like export PATH=$HOME/bin (without :$PATH) overwrites everything else and is the most common cause of this failure.

Source the file and try again:

Terminal
source ~/.bashrc
sudo whoami

output

root

A root response confirms sudo is back on the path and working.

Troubleshooting

sara is not in the sudoers file. This incident will be reported.
The user exists but is not authorized. Switch to root and either add the user to the admin group (as shown above) or edit /etc/sudoers with visudo and add a line such as sara ALL=(ALL:ALL) ALL. Never edit /etc/sudoers directly; visudo validates syntax and prevents lockout.

No root password and no sudo
On Ubuntu, root is disabled by default. Boot into the GRUB recovery menu, drop to a root shell, and run passwd root to set a password. Then install sudo and add your user to the group as shown above.

sudo: /etc/sudo.conf is owned by uid 1000, should be 0
File ownership in /etc was changed by mistake. As root, restore it with chown root:root /etc/sudo.conf /etc/sudoers and chmod 440 /etc/sudoers.

FAQ

Why does sudo work in one shell but not another?
The two shells likely load different startup files. Compare echo $PATH in each, and check ~/.bashrc, ~/.bash_profile, ~/.profile, and ~/.zshrc for conflicting PATH assignments.

Does adding a user to the sudo group take effect right away?
No. Group membership is read at login. Log out and back in, or start a new login shell with su - sara to pick up the change.

Is doas a real replacement for sudo?
For single-user systems and most container images, yes. doas is smaller and configured through a much shorter file. Multi-user servers with detailed access rules are still better served by sudo.

Conclusion

The “command not found” message points to one of three problems: a missing package, a missing group membership, or a broken PATH. Walking through them in that order resolves the error on almost every Linux system.

For follow-up reading, see our guides on creating a sudo user and the sudo command reference .

Podman Cheatsheet

hello@linuxize.com (Linuxize) — Wed, 03 Jun 2026 14:15:00 +0200

Container Lifecycle

Create, start, stop, and remove containers.

Command	Description
`podman run image`	Create and start a container
`podman run -d image`	Run container in background
`podman run -it image sh`	Run with an interactive shell
`podman run --name web image`	Run with a custom name
`podman run -p 8080:80 image`	Map host port to container port
`podman run -v /host:/container image`	Bind mount a host path
`podman start container`	Start a stopped container
`podman stop container`	Gracefully stop a container
`podman restart container`	Restart a container
`podman rm container`	Remove a stopped container
`podman rm -f container`	Force remove a running container
`podman kill container`	Kill a container with SIGKILL
`podman pause container`	Pause a running container
`podman unpause container`	Resume a paused container

Container Inspection

List containers, inspect state, and watch resource use.

Command	Description
`podman ps`	List running containers
`podman ps -a`	List all containers
`podman ps -q`	Show only container IDs
`podman inspect container`	Show detailed JSON info
`podman inspect --format '{{.State.Status}}' container`	Print one field
`podman top container`	List processes in a container
`podman stats`	Show live resource usage
`podman stats --no-stream`	Print one usage snapshot
`podman port container`	Show port mappings
`podman diff container`	Show filesystem changes

Logs

Read and follow container logs.

Command	Description
`podman logs container`	View container logs
`podman logs -f container`	Follow live logs
`podman logs --tail 50 container`	Show the last 50 lines
`podman logs -t container`	Add timestamps
`podman logs --since 10m container`	Show recent logs
`podman logs --until 2026-06-03T12:00:00 container`	Stop at a time
`journalctl --user -u name.service`	View logs for a user service
`sudo journalctl -u name.service`	View logs for a system service

Images and Builds

Pull, build, tag, and manage images. Podman accepts Dockerfiles and Containerfiles.

Command	Description
`podman pull image:tag`	Pull image from a registry
`podman pull docker.io/library/nginx`	Pull with a full image name
`podman push image:tag`	Push image to a registry
`podman build -t name .`	Build image from Dockerfile
`podman build -f Containerfile .`	Build with a custom file
`podman images`	List local images
`podman rmi image`	Remove an image
`podman tag source target:tag`	Tag an image
`podman save image > image.tar`	Save image to tar archive
`podman load < image.tar`	Load image from tar archive
`podman history image`	Show image layer history

Exec and Copy

Run commands inside containers and copy files.

Command	Description
`podman exec -it container sh`	Open shell in container
`podman exec -it container bash`	Open Bash if installed
`podman exec container command`	Run command in container
`podman exec -u root container command`	Run as a specific user
`podman cp ./file container:/path/`	Copy file into container
`podman cp container:/path/file ./`	Copy file from container
`podman attach container`	Attach to main process
`podman wait container`	Wait for container to stop

Volumes

Manage persistent container data.

Command	Description
`podman volume create data`	Create a named volume
`podman volume ls`	List volumes
`podman volume inspect data`	Show volume details
`podman volume rm data`	Remove a volume
`podman volume prune`	Remove unused volumes
`podman run -v data:/data image`	Mount named volume
`podman run -v /host:/data image`	Bind mount host directory
`podman run -v /host:/data:Z image`	Bind mount with SELinux relabeling
`podman run --tmpfs /tmp image`	Mount tmpfs in a container

Networks

Create networks and connect containers.

Command	Description
`podman network create net`	Create a network
`podman network ls`	List networks
`podman network inspect net`	Show network details
`podman network rm net`	Remove a network
`podman network connect net container`	Connect container to network
`podman network disconnect net container`	Disconnect from network
`podman run --network net image`	Run container on network
`podman run --network host image`	Use host networking
`podman run --network none image`	Disable networking

Pods

Run groups of containers that share a network namespace.

Command	Description
`podman pod create --name app`	Create a pod
`podman pod create --name app -p 8080:80`	Create pod with port mapping
`podman run --pod app image`	Run container in pod
`podman pod ps`	List pods
`podman ps --pod`	Show containers with pod info
`podman pod inspect app`	Show pod details
`podman pod stop app`	Stop all containers in pod
`podman pod start app`	Start pod containers
`podman pod rm app`	Remove a stopped pod
`podman pod rm -f app`	Force remove a pod

Rootless and systemd

Inspect rootless mode and manage Podman with systemd.

Command	Description
`podman info`	Show Podman host configuration
`podman info --format '{{.Host.Security.Rootless}}'`	Check if rootless
`podman system migrate`	Apply user namespace changes
`systemctl --user enable --now podman.socket`	Start user Podman socket
`sudo systemctl enable --now podman.socket`	Start system Podman socket
`sudo loginctl enable-linger $USER`	Keep user services after logout
`systemctl --user daemon-reload`	Reload user units
`systemctl --user status name.service`	Check user service
`sudo systemctl status name.service`	Check system service
`podman auto-update`	Update containers with auto-update labels

Compose

Run Compose projects with Podman.

Command	Description
`podman compose up`	Start Compose project
`podman compose up -d`	Start in background
`podman compose down`	Stop and remove services
`podman compose ps`	List Compose services
`podman compose logs`	View Compose logs
`podman compose exec service sh`	Shell into a service
`podman-compose up -d`	Use podman-compose directly
`export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock`	Point Docker Compose at Podman
`docker compose up -d`	Run Docker Compose against Podman socket

System and Cleanup

Check disk usage and remove unused data.

Command	Description
`podman system df`	Show storage usage
`podman system prune`	Remove unused data
`podman system prune --volumes`	Also remove unused volumes
`podman image prune`	Remove dangling images
`podman image prune -a`	Remove unused images
`podman container prune`	Remove stopped containers
`podman volume prune`	Remove unused volumes
`podman network prune`	Remove unused networks
`podman system reset`	Remove all Podman storage

Authenticate and work with container registries.

Command	Description
`podman login docker.io`	Log in to Docker Hub
`podman login registry.example.com`	Log in to private registry
`podman logout docker.io`	Log out from registry
`podman search term`	Search configured registries
`podman pull user/image:tag`	Pull image from registry
`podman push user/image:tag`	Push image to registry
`podman tag image registry/user/image:tag`	Tag image for registry
`podman manifest create name`	Create manifest list
`podman manifest push name destination`	Push manifest list

Docker Compatibility

Use Podman with Docker-style commands and tooling.

Command	Description
`sudo apt install podman-docker`	Install Docker-compatible wrapper
`docker ps`	Run Podman through Docker wrapper
`alias docker=podman`	Add shell alias
`podman --remote ps`	Use remote Podman client
`podman system service --time=0`	Start API service manually
`podman info --format '{{.Host.RemoteSocket.Path}}'`	Show remote socket path
`podman run -d -p 8080:80 nginx`	Docker-like run command

Podman vs Docker: Differences and Migration Guide

hello@linuxize.com (Linuxize) — Wed, 03 Jun 2026 12:40:00 +0200

For most of the last decade, “containers on Linux” meant Docker. The CLI, the image format, the workflow, and the muscle memory all came from one tool. Podman entered the picture as a drop-in alternative built around a different architecture: no daemon, rootless by default, and tighter integration with systemd.

The two tools build and run OCI containers from the same images, expose nearly identical commands, and target the same workloads. The differences start to matter when you look at how containers are started, who owns them, how they run at boot, and what your existing tooling expects. This guide walks through how Podman and Docker compare in practice, and what a realistic migration looks like for a server already running Docker.

Quick Reference

For a printable quick reference, see the Podman cheatsheet .

Aspect	Docker	Podman
Architecture	Long-lived `dockerd` daemon	Daemonless, runs containers directly
Default privileges	Root, with rootless as opt-in	Rootless by default
systemd integration	Manual unit or restart policy	First-class via Quadlet `.container` files
Pods	Not available	Native, Kubernetes-style pods
Image build backend	Docker builder and BuildKit	Buildah
Compose	Docker Compose	`podman compose`, `podman-compose`, or Compose over the Podman socket
Default network backend	`bridge` (`docker0`)	`netavark` (rootless uses `pasta` or `slirp4netns`)
Image and CLI format	OCI images, `docker` CLI	OCI images, `podman` CLI plus `docker` alias

Same Image Format, Same CLI Surface

Both Podman and Docker work with OCI-compliant images and containers. Anything you pull from Docker Hub, quay.io, or a private registry runs the same way in either tool. The high-level commands also match:

Terminal
podman run -d -p 8080:80 --name web nginx
podman ps
podman stop web
podman rm web

Swap podman for docker in those lines and the result is the same. Podman ships a docker alias as part of its package on most distributions, so existing scripts that call docker ... continue to work without changes:

Terminal
sudo apt install podman-docker
docker ps

For everyday commands, Podman is intentionally close to Docker. If your workflow is mostly run, ps, logs, exec, and build, the commands will feel familiar. The larger differences sit underneath.

Daemon vs Daemonless

Docker runs a long-lived background daemon (dockerd) that manages container state on the host. The docker CLI is a client that talks to that daemon over a Unix socket. If the daemon is unavailable, you cannot create, stop, inspect, or attach to containers through the Docker CLI. Existing containers can keep running when Docker is configured with live restore, but the daemon is still the control plane for normal operations.

Podman has no daemon. When you run podman run, the CLI spawns the container directly using runc or crun as the OCI runtime, and exits. The container’s parent is your shell or whatever supervisor you choose, not a privileged background process.

This has a few practical consequences:

There is no long-running container daemon to restart for ordinary CLI use. Updating Podman does not stop containers that are already running.
Each container can be owned by a regular user account. The container’s processes show up in that user’s process tree, not under a root daemon.
Tools that expect a Docker socket need an explicit Podman socket service if you want API compatibility.

For the Podman socket, you enable a user or system service:

Terminal
systemctl --user enable --now podman.socket

The socket exposes a Docker-compatible REST API at $XDG_RUNTIME_DIR/podman/podman.sock, which lets tools like docker-compose or CI runners talk to Podman as if it were Docker.

Rootless Containers

Both tools support rootless containers, but the defaults differ. Docker historically runs as root, with rootless mode available as an opt-in setup that requires extra packages and a per-user installation. Podman is designed around rootless use. A regular user can pull images, build, and run containers without sudo as soon as the user namespace prerequisites are in place.

To run a container as a regular user with Podman:

Terminal
podman run -d -p 8080:80 --name web nginx

The container’s processes run as a UID inside a user namespace mapped to the invoking user on the host. From the host’s perspective, the container is owned by your user, not root, which limits the blast radius of a container escape and removes the need for the user to be in a docker group (which is effectively equivalent to giving root).

For most developer workstations and many production scenarios, rootless Podman is enough. Workloads that need privileged ports below 1024 or specific kernel features still benefit from a rootful install, but the default for new users is unprivileged.

systemd Integration and Quadlet

Docker treats containers as something separate from system services. To run a containerized app at boot, you usually rely on docker-compose with a restart policy, a separate process supervisor, or a hand-written systemd unit that calls docker run.

Podman integrates with systemd as a first-class option. Containers can be generated into systemd unit files, and modern Podman supports Quadlet, a declarative format that turns a small .container file into a fully managed systemd service.

A minimal Quadlet file at ~/.config/containers/systemd/web.container:

~/.config/containers/systemd/web.containerini
[Unit]
Description=Nginx Web

[Container]
Image=docker.io/library/nginx:latest
PublishPort=8080:80

[Install]
WantedBy=default.target

After reloading the user daemon, the container becomes a normal systemd unit:

Terminal
systemctl --user daemon-reload
systemctl --user start web
systemctl --user status web

You get journald logs, restart policies, dependencies on other units, and timers, all without writing a wrapper script. This is one of the strongest practical reasons to pick Podman on a Linux server.

Compose Workflows

Docker Compose is a major part of how teams use Docker. Multi-container apps live in a docker-compose.yml file and run with a single command. Podman supports the same workflow in a few ways.

The most direct option on current Podman releases is the Compose provider exposed through podman compose. Depending on your distribution, that command may call docker-compose, Docker Compose v2, or podman-compose behind the scenes:

Terminal
podman compose up -d

Another option is podman-compose, a Python implementation of the Compose spec that runs against the Podman CLI:

Terminal
podman-compose up -d

The most compatible path for existing Compose projects is often to enable the Podman socket and run the regular Docker Compose binary against it. This is useful when a project depends on Compose features that podman-compose does not fully match:

Terminal
systemctl --user enable --now podman.socket
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock
docker compose up -d

For new projects, Quadlet often replaces Compose entirely on Podman. Each service becomes a .container file, networks become .network files, and systemd takes over orchestration.

Pods

Podman’s name comes from the feature that Docker does not have: pods. A pod is a group of containers that share a network namespace and (optionally) other namespaces, similar to a Kubernetes pod. You create a pod and add containers to it:

Terminal
podman pod create --name app -p 8080:80
podman run -d --pod app --name web nginx
podman run -d --pod app --name cache redis

Both containers share localhost and the host port mapping, so web can reach Redis at 127.0.0.1:6379 without any custom network setup. This is useful when you are testing services that expect to share localhost, and it also matches the way Kubernetes groups containers inside a pod.

Docker does not have a direct equivalent. Multi-container patterns in Docker rely on user-defined networks or Compose stacks.

Networking Differences

Both tools provide bridge networks, host networking, and DNS resolution between containers in the same user-defined network. The default network drivers differ.

Docker uses its own bridge driver by default, with docker0 on the host.
Podman uses netavark on current releases, with legacy CNI still present on older systems. Rootless containers use pasta or slirp4netns for userspace networking.

For straightforward workloads (publish ports, talk to upstream services, attach to a user network), the experience is the same. The differences show up when you need advanced DNS behavior, IPv6 inside containers, or specific MAC/IP assignments, where the two stacks diverge.

Building Images

Both tools build images from a Dockerfile (Podman calls it a Containerfile, but accepts both). The build commands match:

Terminal
podman build -t myapp:1.0 .

Podman delegates builds to buildah under the hood, while Docker has its own builder (and BuildKit for advanced features). For day-to-day builds the difference is invisible. For advanced cases (multi-platform builds, cache mounts, secret mounts), BuildKit has more features today, though Buildah has been catching up steadily.

If you build a lot of images and use BuildKit-specific syntax (# syntax=docker/dockerfile:1.4), test those Dockerfiles with Podman before assuming a clean migration.

Performance and Resource Use

For application workloads, performance is dominated by the workload itself, not the runtime. Both tools use the same kernel features (cgroups, namespaces, overlay filesystems) and run containers as regular Linux processes.

Two areas where you may notice a difference:

Startup overhead is similar; both spawn a runtime and a container process. Podman has no daemon to wait on, but the per-container cost is comparable.
Memory footprint for the runtime itself favors Podman on a host with many idle containers, because there is no long-running daemon keeping connections and state in memory.

For most users, performance is not the deciding factor between the two tools.

A Practical Migration Path

A realistic Docker-to-Podman migration on an existing server does not need to be all-or-nothing. A common path:

Install Podman alongside Docker. They can coexist on the same host because each tool manages its own state directory.
Terminal
```
sudo apt install podman
```
Pull and run one non-critical container as your user with Podman:
Terminal
```
podman run -d -p 9000:80 --name test nginx
curl http://localhost:9000
```
Move one Compose stack to either podman compose, podman-compose, or the Podman socket with Docker Compose. Confirm the app behaves the same.
Convert the most stable services to Quadlet units so systemd takes over restart, logging, and boot ordering. This is usually where the operational win shows up.
Once every workload runs cleanly under Podman, stop and disable the Docker service, then remove the package.
Terminal
```
sudo systemctl disable --now docker
sudo apt remove docker-ce docker-ce-cli containerd.io
```

Plan for storage migration. Docker and Podman do not share the same image store. The simplest path is to export your important images with docker save and import them with podman load:

Terminal
docker save myapp:1.0 | podman load

For data volumes, treat them like any other host directory: bind-mount the same path from both runtimes during the transition, then point only Podman at it once you cut over.

When to Stay on Docker

Docker is still the right tool when:

Your CI, hosting platform, or orchestrator assumes Docker (Docker Desktop, certain managed runners, some Kubernetes ingress workflows).
Your team relies on advanced BuildKit features that Buildah does not match in your workflow.
You use Docker Swarm or third-party tooling that talks only to the Docker daemon.
You want a single supported product across Linux, macOS, and Windows, with a consistent GUI.

When to Switch to Podman

Podman is the better fit when:

You run containers on a Linux server and want them managed as systemd units.
You want rootless containers by default, with no docker group equivalent.
You target Kubernetes in production and want local pods that map to the same concepts.
You prefer a daemonless architecture for upgrades, restarts, and security boundaries.
You are on a distribution where Podman is the default container engine, such as Fedora, RHEL, or CentOS Stream.

Conclusion

Podman and Docker overlap heavily on the CLI surface and image format, so adopting Podman is rarely a rewrite. The main reasons to choose Podman are the daemonless architecture, rootless defaults, and clean systemd lifecycle. On a new Linux server, Podman is often the simpler choice for long-running services. On an existing Docker host, move one workload at a time and use Quadlet when you are ready for systemd to manage the container. If you have not installed Podman yet, the Podman on Ubuntu guide is the next step.

pip vs apt: Installing Python Packages on Linux

hello@linuxize.com (Linuxize) — Tue, 02 Jun 2026 14:15:00 +0200

When you need a Python package on Ubuntu or Debian, the right install command is not always obvious. Some packages come from the distribution through apt, while others come from the Python Package Index through pip. They solve different problems, and mixing them in the wrong place can break system tools or leave projects with conflicting dependencies.

This guide explains when to use apt, when to use pip, and why Python virtual environments are the safest default for application dependencies.

Quick Decision Guide

Situation	Use
Installing a system CLI tool maintained by Ubuntu or Debian	`apt`
Installing Python libraries for a project	`pip` inside a virtual environment
Installing a package that is not in the apt repositories	`pip` inside a virtual environment
Installing a newer package version than the distribution provides	`pip` inside a virtual environment
Installing a Python CLI tool for your user account	`pipx`
Installing a dependency required by another apt package	`apt`

What Each Tool Does

apt installs packages from the distribution repositories. Python packages distributed through apt, such as python3-requests or python3-numpy, are tested against the Python version and system libraries in that Ubuntu or Debian release. They install system-wide and integrate with the distribution dependency resolver.

pip installs packages from the Python Package Index (PyPI). PyPI has more packages and newer versions than most distribution repositories. pip does not coordinate with apt, so it does not know which Python packages the operating system installed or depends on.

When to Use apt

Use apt for:

System tools that happen to be written in Python, such as cloud-init, ansible, or certbot. These packages are maintained as system components and expect the system Python.
Python packages required by other apt packages. If you install a Python-based CLI tool with apt and it lists python3-yaml as a dependency, apt handles that automatically.
Servers or containers where you want reproducible, distribution-tested versions and do not need the latest upstream release.

Install a Python package from the Ubuntu or Debian repositories with apt:

Terminal
sudo apt install python3-requests

The package name usually includes the python3- prefix. After installation, the package is available to the system Python interpreter and to other packages installed through apt.

When to Use pip

Use pip for:

Application dependencies inside a virtual environment.
Packages not available in the distribution repositories.
Packages where you need a specific or newer version than apt provides.

Install a package with pip inside a virtual environment:

Terminal
pip install requests

In this case the PyPI package name is requests, while the equivalent apt package is named python3-requests. That naming difference is normal.

Why sudo pip install Is Risky

Running sudo pip install can place packages on the system Python import path, alongside or ahead of packages managed by apt. This creates two problems:

pip can replace, downgrade, or shadow packages that system tools depend on.
On Ubuntu 23.04 and later, and Debian 12 and later, pip refuses to install into the system Python by default and raises an externally-managed-environment error. This restriction is intentional.

The error message looks like:

output

error: externally-managed-environment
× This environment is externally managed
╰─> To install Python packages system-wide, try apt install
python3-xyz, where xyz is the package you are trying to
install.

The right response to this error is to use a virtual environment, not to override the restriction with --break-system-packages.

Use Virtual Environments for Projects

A virtual environment is an isolated Python installation with its own site-packages. Installing packages inside it does not affect the system Python or any other environment:

Terminal
python3 -m venv myenv
source myenv/bin/activate
pip install requests flask gunicorn

On Ubuntu and Debian, install venv support first if the python3 -m venv command is not available:

Terminal
sudo apt install python3-venv

After activate, pip and python point to the virtual environment. Packages install there instead of system-wide. Deactivate with:

Terminal
deactivate

Virtual environments are the standard practice for any Python application or project. Create one per project, add it to .gitignore, and install dependencies from a requirements.txt:

Terminal
pip install -r requirements.txt

For a fuller walkthrough, see our guide to creating Python virtual environments .

Use pipx for User CLI Tools

If you want a Python command-line tool available in your user account, use pipx instead of installing it into the system Python or a shared user site-packages directory. pipx creates a small private virtual environment for each tool and exposes the command on your PATH.

Install pipx and then install a tool:

Terminal
sudo apt install pipx
pipx install httpie

This is a good fit for tools such as httpie, black, ruff, and poetry, where you want the command available everywhere but do not want the package mixed into a project environment.

You may still see older guides recommend pip install --user. That installs packages under ~/.local/, but all user-level packages share the same location and can conflict with each other. On externally managed Python installations, pip install --user can also be rejected for the same reason as a system install. Use pipx for standalone CLI tools and a virtual environment for project libraries.

Where to Install pip Itself

On Ubuntu and Debian, the distribution package for pip is python3-pip:

Terminal
sudo apt install python3-pip

This gives you the pip command, but it does not mean you should install packages into the system Python. Treat it as the installer you use inside virtual environments. For detailed setup instructions, see How to Install Python Pip on Ubuntu .

Conclusion

Use apt for Python packages that belong to the operating system, pip inside a virtual environment for project dependencies, and pipx for standalone Python CLI tools. If you see the externally-managed-environment error, create a virtual environment rather than overriding it with --break-system-packages.

dpkg Cheatsheet

hello@linuxize.com (Linuxize) — Mon, 01 Jun 2026 13:40:00 +0200

Install and Remove

Work with installed packages and local .deb files.

Command	Description
`sudo dpkg -i package.deb`	Install a local .deb file
`sudo dpkg -i *.deb`	Install multiple .deb files
`sudo dpkg -r package`	Remove package, keep config
`sudo dpkg -P package`	Purge package and config
`sudo dpkg --unpack package.deb`	Unpack without configuring

Query Installed Packages

List packages and inspect installed package metadata.

Command	Description
`dpkg -l`	List installed packages
`dpkg -l 'nginx*'`	Filter packages by pattern
`dpkg -s package`	Show package status
`dpkg --status package`	Same as `dpkg -s`
`dpkg-query -W package`	Show package and version

Package Files

Find installed files and file ownership.

Command	Description
`dpkg -L package`	List files installed by package
`dpkg -S /path/to/file`	Find package owning a file
`dpkg -S '*/bin/curl'`	Search ownership by pattern
`dpkg -L package \| less`	Browse long file lists
`dpkg -V package`	Verify installed package files

Inspect deb Files

Read package archives before installing them.

Command	Description
`dpkg --info package.deb`	Show .deb metadata
`dpkg -I package.deb`	Same as `dpkg --info`
`dpkg --contents package.deb`	List files in .deb
`dpkg -c package.deb`	Same as `dpkg --contents`
`dpkg-deb -f package.deb Version`	Print package version field

Extract deb Files

Unpack archive contents without installing.

Command	Description
`dpkg -x package.deb /tmp/extract`	Extract package files
`dpkg -X package.deb /tmp/extract`	Extract with details
`dpkg -e package.deb /tmp/control`	Extract control files
`dpkg-deb --ctrl-tarfile package.deb`	Print control tar archive
`dpkg-deb --fsys-tarfile package.deb`	Print filesystem tar archive

Package Selections

Export and restore package selection states.

Command	Description
`dpkg --get-selections`	Print package selections
`dpkg --get-selections > packages.txt`	Save selections
`sudo dpkg --set-selections < packages.txt`	Restore selections
`dpkg --get-selections 'nginx*'`	Filter selections
`sudo apt-get dselect-upgrade`	Apply restored selections

Repair and Configure

Resume interrupted installs and fix package state.

Command	Description
`sudo dpkg --configure -a`	Configure pending packages
`sudo dpkg --configure package`	Configure one package
`sudo dpkg -C`	Audit broken packages
`sudo apt install -f`	Fix missing dependencies
`sudo dpkg-reconfigure package`	Re-run package setup

Use these references for package management workflows.

Guide	Description
`dpkg Command in Linux`	Full dpkg tutorial with examples
`Install deb Files on Ubuntu`	Install local .deb files with apt and dpkg
`apt Cheatsheet`	Higher-level package management commands

dpkg Command in Linux: Install and Manage Debian Packages

hello@linuxize.com (Linuxize) — Mon, 01 Jun 2026 10:20:00 +0200

When you install software on Ubuntu or Debian with apt , the package manager quietly calls dpkg in the background to do the actual work. dpkg is the low-level tool that unpacks and installs .deb files, maintains the package database, and handles removal and purging. Knowing how to use it directly is useful when you have a local .deb file that is not in a repository, when you need to query what files a package installed, or when you want to find which package owns a specific file on your system.

Syntax

txt
dpkg [OPTIONS] COMMAND [ARGUMENTS]

Install, remove, purge, and configure operations require sudo because they modify system directories and the package database. Query commands such as dpkg -l, dpkg -L, dpkg -S, and dpkg -s usually run without elevated privileges.

Install a Package

To install a local .deb file:

Terminal
sudo dpkg -i package.deb

dpkg unpacks the archive, runs the maintainer scripts, and registers the package in its database. If the package has unmet dependencies, the install fails with a dependency error. Fix it by running:

Terminal
sudo apt install -f

apt install -f (fix broken) resolves and installs any missing dependencies, then completes the pending dpkg installation.

For most local .deb installs, apt install ./package.deb is easier because it can resolve dependencies in the same step. Use dpkg -i when you specifically need the lower-level package operation.

Remove a Package

To uninstall a package while keeping its configuration files:

Terminal
sudo dpkg -r package-name

To uninstall a package and delete its configuration files at the same time (a full purge):

Terminal
sudo dpkg -P package-name

Use -P when you want a clean removal with no leftover config, or when you plan to reinstall with a fresh configuration.

List Installed Packages

To list every installed package with its version and status:

Terminal
dpkg -l

The output is wide. Each package line starts with three status columns: desired action, current package status, and error state. The normal installed state appears as ii, followed by the package name, version, architecture, and description:

output

Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-=============-============-=================================
ii curl 8.5.0 amd64 command line tool for transferring data
ii nginx 1.26.0 amd64 small, powerful, scalable web/proxy server

The first i means the package is selected for installation, and the second i means it is installed and configured. Filter by name to narrow the output:

Terminal
dpkg -l 'nginx*'

output

ii nginx 1.26.0 amd64 small, powerful, scalable web/proxy server
ii nginx-common 1.26.0 all small, powerful, scalable web/proxy server (common files)

List Files Installed by a Package

To see every file a package placed on your system:

Terminal
dpkg -L nginx

output

/.
/etc
/etc/nginx
/etc/nginx/nginx.conf
/etc/nginx/sites-available
/etc/nginx/sites-enabled
/usr/sbin
/usr/sbin/nginx
...

This is useful when you need to find where a package installs its binary, config files, or documentation.

Find Which Package Owns a File

To identify which package installed a particular file:

Terminal
dpkg -S /usr/sbin/nginx

output

nginx: /usr/sbin/nginx

You can also search by pattern:

Terminal
dpkg -S '*/bin/curl'

output

curl: /usr/bin/curl

Show Package Details

To print the full metadata for an installed package including version, dependencies, and description:

Terminal
dpkg -s nginx

output

Package: nginx
Status: install ok installed
Priority: optional
Section: web
Installed-Size: 47
Maintainer: Ubuntu Developers <ubuntu-devel-discuss@lists.ubuntu.com>
Architecture: amd64
Version: 1.26.0-1ubuntu1
...

Inspect a .deb File Without Installing

To read the metadata of a .deb file before installing it:

Terminal
dpkg --info package.deb

output

 new Debian package, version 2.0.
size 1234567 bytes: control archive=2048 bytes.
...
Package: myapp
Version: 2.1.0
Architecture: amd64
...

To list the files the package would install without actually installing it:

Terminal
dpkg --contents package.deb

Extract a Package Without Installing

To unpack the contents of a .deb file into a directory for inspection:

Terminal
dpkg -x package.deb /tmp/extracted

The directory structure mirrors where files would be installed on the real system.

Export and Restore Package Selections

To export a list of all installed packages (useful for replicating a system):

Terminal
dpkg --get-selections > installed-packages.txt

To restore those selections on another machine:

Terminal
sudo dpkg --set-selections < installed-packages.txt
sudo apt-get dselect-upgrade

Reconfigure an Installed Package

Some packages run interactive setup at install time. To run that setup again:

Terminal
sudo dpkg-reconfigure package-name

This is commonly used to reconfigure tzdata for timezone changes, keyboard-configuration, or locales.

Fix Broken Package State

If a system update or manual operation leaves packages in a half-installed or unconfigured state, run:

Terminal
sudo dpkg --configure -a

This processes any pending package configuration steps. Follow it with sudo apt install -f if dependency issues remain.

Troubleshooting

dpkg reports dependency problems
dpkg installs the package file you give it, but it does not download missing dependencies. Run sudo apt install -f to install the required packages and finish the pending configuration.

A package operation was interrupted
If an update or install stopped before configuration finished, run sudo dpkg --configure -a. This resumes pending package configuration scripts.

dpkg cannot find a package
Use the installed package name, not the .deb filename. Run dpkg -l 'pattern*' to find matching installed packages, then use that package name with commands such as dpkg -L, dpkg -s, or sudo dpkg -r.

Quick Reference

For a printable quick reference, see the dpkg cheatsheet .

Command	Description
`dpkg -i pkg.deb`	Install a local .deb file
`dpkg -r package`	Remove a package, keep config
`dpkg -P package`	Purge a package and its config
`dpkg -l`	List all installed packages
`dpkg -l 'pattern*'`	Filter installed packages
`dpkg -L package`	List files installed by a package
`dpkg -S /path/to/file`	Find which package owns a file
`dpkg -s package`	Show package status and details
`dpkg --info pkg.deb`	Inspect a .deb file
`dpkg --contents pkg.deb`	List files in a .deb
`dpkg -x pkg.deb /dir`	Extract a .deb without installing
`dpkg --get-selections`	Export installed package list
`dpkg-reconfigure package`	Re-run package configuration
`dpkg --configure -a`	Fix incomplete installations

Conclusion

dpkg is the foundation of package management on Debian-based systems. For everyday installs and updates from repositories, apt is the better tool because it resolves dependencies automatically. Reach for dpkg directly when you need to install a .deb file from disk, audit what a package installed, or diagnose a broken package state.

reboot Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 31 May 2026 13:15:00 +0200

Immediate Reboot

Command	Description
`sudo reboot`	Reboot immediately
`sudo systemctl reboot`	Reboot via systemd
`sudo shutdown -r now`	Reboot immediately via shutdown

systemctl Options

Command	Description
`sudo systemctl reboot --force`	Skip graceful shutdown if unresponsive
`sudo systemctl --no-wall reboot`	Reboot without broadcasting a wall message
`sudo systemctl --message="reason" reboot`	Log a reason in the system journal

Schedule with shutdown -r

Command	Description
`sudo shutdown -r +5`	Reboot in 5 minutes
`sudo shutdown -r 10:00`	Reboot at 10:00
`sudo shutdown -r +10 "message"`	Reboot in 10 minutes with a wall message
`sudo shutdown -r`	Reboot after 1 minute (default)

Cancel and Status

Command	Description
`sudo shutdown -c`	Cancel a scheduled reboot
`last reboot`	Show reboot history
`uptime -s`	Show current boot time
`journalctl --list-boots`	List all boot sessions

How to Pass Arguments to a Bash Script

hello@linuxize.com (Linuxize) — Sat, 30 May 2026 15:40:00 +0200

Arguments let a Bash script behave differently each time you run it. Instead of hard-coding a file path, username, environment name, or port number inside the script, you pass those values on the command line and read them from inside the script.

This guide explains how to pass arguments to Bash scripts, read positional parameters such as $1 and $2, work with all arguments through "$@", set defaults, validate required input, and parse named flags with getopts.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Syntax	Description
`bash script.sh arg1 arg2`	Run a script with two arguments
`$0`	Script name or path
`$1`, `$2`	First and second positional arguments
`${10}`	Tenth positional argument
`$#`	Number of arguments passed
`"$@"`	All arguments as separate quoted words
`"${1:-default}"`	Use a default value when the first argument is missing
`shift`	Remove the first positional argument and move the rest down
`getopts`	Parse short named options such as `-p 3000 -v`

Positional Parameters

When you run a script, Bash assigns each argument to a numbered variable:

~/greet.shsh
#!/usr/bin/env bash

printf 'Hello, %s!\n' "$1"
printf 'Argument count: %s\n' "$#"

Run the script with one argument:

Terminal
bash greet.sh World

output

Hello, World!
Argument count: 1

The special variables are:

Variable	Value
`$0`	The script name or path
`$1`, `$2`, …	First, second, … argument
`${10}`, `${11}`, …	Tenth argument and beyond
`$#`	Number of arguments passed
`$@`	All arguments as separate words
`$*`	All arguments as a single string

For more detail about each special parameter, see the Bash positional parameters guide.

Access All Arguments

Use $@ to iterate over every argument regardless of how many were passed:

~/list-args.shsh
#!/usr/bin/env bash

for arg in "$@"; do
 printf 'Argument: %s\n' "$arg"
done

Terminal
bash list-args.sh alpha beta "hello world"

output

Argument: alpha
Argument: beta
Argument: hello world

Always quote "$@" so arguments with spaces stay as single values. Unquoted $@ allows word splitting, which turns "hello world" into two separate words.

Set Default Values

When an argument is optional, assign a default with ${N:-default}:

~/deploy.shsh
#!/usr/bin/env bash

ENV=${1:-production}
BRANCH=${2:-main}

printf 'Deploying %s to %s\n' "$BRANCH" "$ENV"

If the caller passes no arguments, ENV becomes production and BRANCH becomes main. If they pass one argument, ENV uses that value and BRANCH falls back to main.

Validate Required Arguments

Exit early with a usage message when a required argument is missing:

~/backup.shsh
#!/usr/bin/env bash

if [ $# -lt 2 ]; then
 echo "Usage: $0 SOURCE DESTINATION" >&2
 exit 1
fi

SOURCE=$1
DEST=$2

printf 'Ready to back up %s to %s\n' "$SOURCE" "$DEST"

$# -lt 2 checks whether fewer than two arguments were provided. The error message goes to stderr with >&2, and the script exits with code 1 to signal failure. After validation succeeds, you can safely use $SOURCE and $DEST in the real backup command, such as rsync.

Shift Through Arguments

shift removes the first argument and renumbers the rest. It is useful when a script accepts a variable number of items to process:

~/process.shsh
#!/usr/bin/env bash

printf 'Script: %s\n' "$0"

while [ $# -gt 0 ]; do
 printf 'Processing: %s\n' "$1"
 shift
done

Each shift call moves $2 into $1, $3 into $2, and so on, and decrements $# by one. The loop continues until no arguments remain.

Named Flags with getopts

For scripts with optional flags, getopts parses named options in the style of standard Unix commands:

~/server.shsh
#!/usr/bin/env bash

PORT=8080
VERBOSE=0

usage() {
 echo "Usage: $0 [-p PORT] [-v]" >&2
}

while getopts ":p:v" opt; do
 case $opt in
 p) PORT=$OPTARG ;;
 v) VERBOSE=1 ;;
 \?) usage; exit 1 ;;
 :) usage; exit 1 ;;
 esac
done

shift $((OPTIND - 1))

printf 'Starting server on port %s (verbose: %s)\n' "$PORT" "$VERBOSE"

The option string ":p:v" means -p takes a value, -v is a flag with no value, and the leading colon lets the script handle errors itself. $OPTARG holds the value for options that require one. shift $((OPTIND - 1)) removes all parsed flags so $1, $2, and the rest refer to any remaining positional arguments after the flags.

Run it:

Terminal
bash server.sh -p 3000 -v

output

Starting server on port 3000 (verbose: 1)

For a deeper look at option strings, OPTARG, OPTIND, and error handling, read the Bash getopts guide.

Conclusion

Bash positional parameters handle the straightforward case of ordered arguments, while getopts adds named flag support for more complex scripts. Start with positional parameters, validate the count early, set defaults for optional arguments, and use getopts when your script grows a meaningful set of options. For more on script execution and permissions, see the guide on running Bash scripts .

iptables Command in Linux: Manage Firewall Rules

hello@linuxize.com (Linuxize) — Fri, 29 May 2026 09:30:00 +0100

When a packet arrives at a Linux machine, the kernel decides what to do with it based on a set of firewall rules. Those rules live in the kernel’s Netfilter framework, and for more than two decades the standard way to edit them from user space has been the iptables command.

iptables controls packet filtering, network address translation, and packet mangling. Higher-level front ends such as ufw and firewalld manage the same Netfilter firewall stack through simpler interfaces, although many modern systems use nftables underneath. Understanding the underlying command is still valuable, especially when you inherit a server that was set up by someone else. This guide walks through the concepts and the commands you need to read, edit, and persist firewall rules.

Tables and Chains

Before you write a rule, you need to know where it goes. iptables is organized into tables, and each table contains chains.

The three tables you will use most often are:

filter - the default table, used for allowing and blocking traffic
nat - used for network address translation, such as port forwarding and masquerading
mangle - used to alter packet headers, for example to set QoS marks

Each table has a set of built-in chains that correspond to moments in the life of a packet. In the filter table:

INPUT - packets destined for the local machine
OUTPUT - packets originating from the local machine
FORWARD - packets routed through the machine

A rule says: for packets that enter this chain and match these criteria, take this action. The action is called a target and is usually ACCEPT, DROP, REJECT, or the name of another chain.

iptables Syntax

The general form of the command is:

txt
iptables [-t TABLE] COMMAND CHAIN [MATCH] [-j TARGET]

If -t is omitted, iptables uses the filter table. Common commands include -A (append a rule), -I (insert), -D (delete), -L (list), -F (flush), and -P (set default policy).

All commands that change the firewall require root privileges. Run them with sudo or as root.

Warning

It is easy to lock yourself out of a remote server with a single wrong rule. Before you apply a restrictive ruleset over SSH, either test on a local machine first or use iptables-apply, which rolls back automatically if you lose access.

List Rules

To print every rule in the filter table, use the -L option:

Terminal
sudo iptables -L

The default output shows service names, resolves IP addresses, and hides packet and byte counters. For real work, add -n to keep numeric output and -v to show counters and interface information:

Terminal
sudo iptables -L -n -v

output

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1234 98K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:23
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

To list a single chain, append its name:

Terminal
sudo iptables -L INPUT -n -v

To number the rules so you can reference them by index when deleting, add --line-numbers:

Terminal
sudo iptables -L INPUT -n -v --line-numbers

Add and Remove Rules

New rules are added to the end of a chain with -A (append) or at a specific position with -I (insert). The difference matters because iptables evaluates rules top to bottom and stops at the first match.

To allow incoming SSH connections:

Terminal
sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

To allow HTTP and HTTPS:

Terminal
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

To insert a rule as the first one in the chain, use -I CHAIN 1:

Terminal
sudo iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT

This is important when you are working over SSH. If a broad DROP rule already appears earlier in the chain, appending the accept rule after it would not help because the packet would be dropped first.

To delete a rule, either repeat the exact specification with -D:

Terminal
sudo iptables -D INPUT -p tcp --dport 23 -j DROP

Or delete by line number, which is easier when the rule has many options:

Terminal
sudo iptables -D INPUT 3

Allow and Block Specific IPs

To block all traffic from a single IP address:

Terminal
sudo iptables -A INPUT -s 203.0.113.10 -j DROP

To block a range using CIDR notation:

Terminal
sudo iptables -A INPUT -s 203.0.113.0/24 -j DROP

To allow SSH only from a trusted subnet:

Terminal
sudo iptables -A INPUT -p tcp -s 192.168.1.0/24 --dport 22 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 22 -j DROP

The first rule accepts SSH from the local subnet. The second drops SSH from everywhere else. Order matters: if you reversed the two lines, every SSH attempt would be dropped before the accept rule had a chance to match.

Allow Established Connections

Most firewall setups include a rule that accepts traffic belonging to an already established connection. This lets return traffic through without needing a matching rule for each outbound request:

Terminal
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Put this rule near the top of the INPUT chain so it matches early. Without it, the default DROP policy breaks outbound connections that expect responses.

Set a Default Policy

Each built-in chain has a default policy that applies when no rule matches. The -P option changes it:

Terminal
sudo iptables -P INPUT DROP
sudo iptables -P FORWARD DROP
sudo iptables -P OUTPUT ACCEPT

Switching INPUT to DROP is the foundation of a deny-by-default firewall: nothing gets in unless an explicit rule allows it. Before you flip the policy, make sure you have already added the rules that allow SSH, established connections, and anything else you need.

Flush Rules

To remove every rule from every chain in the current table:

Terminal
sudo iptables -F

To flush a specific chain only:

Terminal
sudo iptables -F INPUT

Flushing does not reset the default policies. If you have set INPUT to DROP, flushing will leave it at DROP with no rules, which blocks all inbound traffic. Reset the policy to ACCEPT first if that is not what you want:

Terminal
sudo iptables -P INPUT ACCEPT
sudo iptables -F

Save and Restore Rules

Rules added with iptables live in kernel memory only. They disappear on reboot unless you save them.

On Ubuntu, Debian, and Derivatives, the iptables-persistent package saves rules to /etc/iptables/rules.v4 and reloads them at boot:

Terminal
sudo apt install iptables-persistent

The installer asks whether to save the current rules. To update the saved copy later:

Terminal
sudo netfilter-persistent save

On Fedora, RHEL, and Derivatives, the equivalent service is iptables-services:

Terminal
sudo dnf install iptables-services
sudo systemctl enable --now iptables
sudo service iptables save

Independent of the distribution, you can dump and restore rules manually with iptables-save and iptables-restore:

Terminal
sudo iptables-save -f /etc/iptables/rules.v4
sudo iptables-restore /etc/iptables/rules.v4

This is also the recommended way to edit a large ruleset: save to a file, edit the file, then restore it atomically.

Troubleshooting

Rules disappear after a reboot
iptables rules are not persistent by default. Install iptables-persistent on Debian-based systems or iptables-services on RHEL-based ones, and save the ruleset.

SSH stops working after setting a DROP policy
You switched INPUT to DROP without an ACCEPT rule for port 22, or the ACCEPT rule is positioned after a more general DROP rule. Connect through the console, add the rule with -I INPUT 1, and save.

A rule looks correct but does not match
Check the order. iptables walks the chain top to bottom and stops at the first match, so an earlier accept or drop may be catching the packet first. Use iptables -L INPUT -n -v --line-numbers to inspect the order.

Changes are silently ignored
You may be editing the wrong table. A rule in filter does not affect NAT, and vice versa. Pass -t TABLE explicitly when you are not working in filter.

iptables: command not found
On some modern distributions, only nftables is installed by default. Install iptables with your package manager, or use nft directly.

Quick Reference

For a printable quick reference, see the iptables cheatsheet .

Action	Command
List rules (verbose, numeric)	`iptables -L -n -v --line-numbers`
Allow port	`iptables -A INPUT -p tcp --dport PORT -j ACCEPT`
Block IP	`iptables -A INPUT -s IP -j DROP`
Allow established connections	`iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT`
Insert rule at top	`iptables -I INPUT 1 -p tcp --dport 22 -j ACCEPT`
Delete rule by number	`iptables -D INPUT N`
Set default policy	`iptables -P INPUT DROP`
Flush all rules	`iptables -F`
Save rules	`iptables-save -f /etc/iptables/rules.v4`
Restore rules	`iptables-restore /etc/iptables/rules.v4`

FAQ

Is iptables still relevant in 2026?
It is still installed and widely used, but it is being replaced by nftables, which offers a cleaner syntax and better performance. On recent distributions, the iptables command is often a compatibility front end that writes nftables rules underneath.

Should I use iptables, ufw, or firewalld?
If you are managing rules by hand on Debian or Ubuntu, ufw is simpler and covers most cases. On Fedora and RHEL, firewalld is the default. Reach for raw iptables when you need fine-grained control that the front ends do not expose, or when you are troubleshooting an existing ruleset.

What is the difference between DROP and REJECT?
DROP silently discards the packet; the sender sees a timeout. REJECT sends an ICMP error back (or a TCP reset for TCP), so the sender gets immediate feedback. DROP is often preferred on public interfaces because it does not confirm that the port exists.

How do I block a country or a list of IPs?
For a handful of addresses, add one -s rule per entry. For larger lists, use the ipset tool to manage the addresses and reference the set from a single iptables rule.

Does iptables handle IPv6?
No. Use ip6tables for IPv6 rules. It has the same syntax and the same tables and chains, but operates on a separate rule set.

Conclusion

iptables is a low-level but reliable way to read and shape the Linux firewall. Once you have a working ruleset, save it with iptables-save and commit the file so the next person to touch the server has a clear starting point.

Network Bandwidth Monitoring Tools: iftop, nload, bmon, and vnstat

hello@linuxize.com (Linuxize) — Thu, 28 May 2026 09:30:00 +0200

When a server feels slow or a connection is saturated, the first question is usually “what is using the bandwidth?” The answer depends on what you need to see: the total rate on an interface, the individual connections moving the most data, a graph across several interfaces, or how much you have transferred this month. No single tool does all of this well, so it helps to know which one fits each question.

This guide compares four command-line bandwidth monitors: nload, iftop, bmon, and vnstat. Each one is small, available in the default repositories, and built for a different angle on network usage.

nload: Per-Interface Throughput

nload is the simplest of the four. It shows the incoming and outgoing rate on a single interface in real time, with a small ASCII graph and running statistics. It answers the question “how fast is this interface moving data right now?”

Install it on Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install nload

On Fedora, RHEL, and Derivatives, install it with dnf. On RHEL-compatible systems, enable EPEL first if the package is not available:

Terminal
sudo dnf install nload

Run it with no arguments to monitor the default interface, or name an interface directly:

Terminal
nload eth0

The display splits into incoming and outgoing sections, each showing the current rate along with the average, minimum, maximum, and total transferred:

output

Device eth0 [192.168.1.50] (1/1):
Incoming:
Curr: 4.21 MBit/s
Avg: 2.88 MBit/s
Max: 9.10 MBit/s
Ttl: 1.42 GByte
Outgoing:
Curr: 512.00 kBit/s
Avg: 320.10 kBit/s

When more than one interface is present, the left and right arrow keys cycle between them. Press q to quit. nload does not need root privileges, which makes it the quickest way to glance at raw throughput.

iftop: Bandwidth by Connection

nload tells you how much traffic is flowing, but not where it is going. iftop fills that gap. It works like top for the network, listing active connections sorted by bandwidth so you can see which hosts and ports are responsible for the load.

Install it on Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install iftop

On Fedora, RHEL, and Derivatives, use dnf. On RHEL-compatible systems, enable EPEL first if the package is not available:

Terminal
sudo dnf install iftop

iftop needs to capture packets, so it must run as root. Point it at an interface:

Terminal
sudo iftop -i eth0

Each row shows a pair of hosts and the bandwidth between them, averaged over the last 2, 10, and 40 seconds:

output

 => 192.168.1.50 4.10Mb 3.85Mb 3.20Mb
192.0.2.14 <= 256Kb 210Kb 180Kb

By default iftop resolves IP addresses to hostnames and port numbers to service names, which can be slow and can clutter the view. Three flags make it more useful on a busy server: -n skips DNS hostname lookups, -N shows ports as numbers instead of service names, and -P displays the port column so you can tell which service is responsible:

Terminal
sudo iftop -i eth0 -nNP

Press q to quit. When you need to find the connection saturating a link, iftop is the tool to reach for. To then identify the local process behind a port, pair it with the ss command .

bmon: Multiple Interfaces at a Glance

bmon (bandwidth monitor) is the right choice when you want to watch several interfaces at once. It lists every interface with its current receive and transmit rates, and draws a live graph for the one you select, which is handy on routers, gateways, and virtualization hosts with many NICs and bridges.

Install it on Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install bmon

On Fedora, RHEL, and Derivatives, use dnf. On RHEL-compatible systems, enable EPEL first if the package is not available:

Terminal
sudo dnf install bmon

Launch it with no arguments:

Terminal
bmon

The top pane lists all interfaces with their RX and TX rates. Use the arrow keys to highlight an interface, and the lower pane updates its graph to match. Press d to toggle detailed counters such as errors and dropped packets, and q to quit. bmon reads kernel counters and does not require root for basic monitoring.

vnstat: Historical Usage Over Time

The first three tools show what is happening now and forget it the moment you quit. vnstat is different: it runs as a background service, records traffic per interface into a database, and reports usage by hour, day, and month. It answers “how much data have I used this month?” rather than “what is the rate right now?”, which makes it the tool for usage caps and capacity planning.

Install it and enable the service on Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install vnstat
sudo systemctl enable --now vnstat

On Fedora, RHEL, and Derivatives, install the package first. On RHEL-compatible systems, enable EPEL first if the package is not available:

Terminal
sudo dnf install vnstat
sudo systemctl enable --now vnstat

vnstat needs time to collect data, because it samples the interface counters periodically rather than capturing packets. After it has been running for a while, view a summary:

Terminal
vnstat

output

 eth0 since 2026-01-01
rx: 42.18 GiB tx: 8.04 GiB total: 50.22 GiB
monthly
rx | tx | total
------------------------+-------------+------------
2026-01 42.18 GiB | 8.04 GiB | 50.22 GiB

Several flags change the reporting period: vnstat -h for hourly, vnstat -d for daily, and vnstat -m for monthly. For a live rate display similar to the other tools, use vnstat -l, which shows the current throughput until you press Ctrl+C. Because the daemon keeps logging, the history survives reboots.

Which Tool to Use

The four tools overlap a little but each has a clear best use:

Tool	Shows	Needs root	Best for
nload	Per-interface in/out rate	No	A quick glance at total throughput
iftop	Per-connection bandwidth	Yes	Finding which host or port is using the link
bmon	All interfaces plus graphs	No	Hosts with many interfaces
vnstat	Historical hourly/daily/monthly totals	No	Tracking usage over time and quotas

In practice, many administrators keep vnstat running for history and reach for iftop when they need to investigate a live spike.

Troubleshooting

command not found after installing
Confirm the package installed with apt list --installed | grep <tool> or dnf list installed <tool>. On Ubuntu, the package may be in the universe repository; on RHEL-compatible systems, you may need to enable EPEL first.

iftop shows no traffic
iftop must run as root and be pointed at the active interface. List interfaces with ip link and pass the correct one with -i. Traffic on the loopback interface will not appear unless you select lo.

vnstat reports “Not enough data available yet”
The daemon has not collected a full sampling interval. Confirm the service is running with systemctl status vnstat and wait a few minutes for the first data points.

Rates look wrong on a virtual interface
Bridges, bonds, and VLAN interfaces report aggregate counters. Monitor the underlying physical interface as well to see where the traffic actually enters the host.

FAQ

Which tool shows bandwidth per process?
None of these four map traffic to a process directly. iftop shows it per connection; to tie a connection to a process, use ss -tp or nethogs, which groups bandwidth by process.

Do these tools work over SSH?
Yes. All four are terminal applications and run fine in an SSH session, which is exactly how they are used on headless servers.

Does vnstat slow down the network?
No. vnstat reads interface counters periodically rather than inspecting packets, so its overhead is negligible even on busy links.

Can I monitor a specific interface only?
Yes. nload, iftop, and vnstat all accept an interface name (for example eth0), and bmon lets you select one from its list.

Conclusion

Pick the tool that matches the question: nload for a fast look at throughput, iftop to find the connection eating the link, bmon for many interfaces, and vnstat for usage history. When you need to move from bandwidth numbers to sockets and interface details, pair them with the lower-level ss and ip commands.

Bash set Command: set -e, set -x, and set -u Explained

hello@linuxize.com (Linuxize) — Wed, 27 May 2026 15:53:00 +0200

By default, a bash script keeps running even after a command fails. A typo in a variable name expands to an empty string, a failed cd is ignored, and the script marches on as if nothing happened, often doing real damage by the time it stops. The set builtin changes that. With a few flags, you can make bash stop on the first error, treat unset variables as mistakes, and print each command as it runs.

This guide explains the set command and the three options you will use most: set -e, set -u, and set -x, plus pipefail and how to combine them into a strict mode.

What the set Command Does

set is a shell builtin that turns shell options on or off and sets the positional parameters. For options, it takes this form:

txt
set [options]

Each option has a short form and a long form. A leading dash turns an option on, and a leading plus turns it off, which is the reverse of what most people expect:

set -e enables an option (here, exit on error).
set +e disables it.
set -o errexit is the long form of set -e.
set +o errexit is the long form of set +e.

You place these near the top of a script so they apply to everything that follows, or around a specific block when you only want them in part of the script.

set -e: Exit on Error

set -e (also written set -o errexit) tells bash to exit immediately if any command returns a non-zero status. It stops a script from continuing past a failure.

Consider a script that changes into a directory and then writes a log message:

cleanup.shsh
#!/bin/bash
set -e

cd /var/cache/myapp
printf 'Cleaning application cache\n'

Without set -e, if the cd fails because the directory does not exist, the script would continue and run the next command in whatever directory it started in. With set -e, the failed cd stops the script before the log message or any later cache command runs.

There are important exceptions where set -e does not trigger an exit, and they trip people up. A command does not cause an exit when it is:

part of an if, while, or until test,
joined with && or ||,
preceded by !.

This is by design, so that you can test a command’s exit status. If you need a specific command’s failure to be tolerated, append || true:

sh
grep "pattern" file.txt || true

set -u: Treat Unset Variables as Errors

set -u (or set -o nounset) makes bash exit when you reference a variable that has not been set. This catches one of the most common scripting bugs: a typo in a variable name that silently expands to nothing.

deploy.shsh
#!/bin/bash
set -u

target_dir="/srv/www"
printf 'Target cache directory: %s\n' "${tagret_dir}/cache"

The variable name is misspelled as tagret_dir. Without set -u, ${tagret_dir} expands to an empty string, and the command prints /cache instead of /srv/www/cache. With set -u, bash stops with an error instead:

output

deploy.sh: line 5: tagret_dir: unbound variable

When a variable is legitimately optional, provide a default with ${VAR:-default} so the reference is always defined:

sh
echo "Deploying to ${ENVIRONMENT:-staging}"

set -x: Trace Each Command

set -x (or set -o xtrace) prints every command to standard error before it runs, with the expanded values of any variables. It is the fastest way to see exactly what a script is doing without adding echo statements everywhere.

greet.shsh
#!/bin/bash
set -x

name="Linuxize"
echo "Hello, $name"

Running the script shows each command, prefixed with a +, alongside its normal output:

output

+ name=Linuxize
+ echo 'Hello, Linuxize'
Hello, Linuxize

The trace shows the variable already expanded, so you see the real value bash used. The prefix comes from the PS4 variable. Set it to include the script name and line number, which is invaluable in longer scripts:

sh
PS4='+ ${BASH_SOURCE}:${LINENO}: '

Because tracing is noisy, it is common to enable it only around the section you are debugging with set -x and then turn it off again with set +x.

set -o pipefail: Catch Failures in a Pipeline

By default, a pipeline returns the exit status of its last command, so a failure earlier in the pipe is hidden. In the pipeline below, wc succeeds even though grep failed because the file does not exist:

sh
grep "ERROR" missing.log | wc -l

Without pipefail, the pipeline exits with the status from wc, which is 0. set -o pipefail changes this so the pipeline returns the status of the rightmost command that failed, or 0 if every command succeeded. Combined with set -e, it makes a failed first stage actually stop the script.

Combine Them into a Strict Mode

These options are most useful together. The common combination at the top of a careful script is:

script.shsh
#!/bin/bash
set -euo pipefail

This enables exit-on-error, unset-variable checking, and pipeline failure detection in one line. Add x as set -euxo pipefail while debugging, then remove it. This pattern is the foundation of what is often called “bash strict mode”, which our bash strict mode guide covers in more depth, including the trade-offs of set -e.

Enable and Disable Options for a Block

You do not have to apply an option to the whole script. Turn one on for a block and off afterward. This is common with tracing:

sh
set -x
deploy_application
sync_assets
set +x

Only the two commands between set -x and set +x are traced. The same pattern works with set -e when you have a section where you want to handle errors manually.

View the Current Options

Running set -o with no flag prints every option and whether it is on or off. The full list has more than two dozen entries; the four options discussed here are:

Terminal
set -o

output

errexit off
nounset off
pipefail off
xtrace off

This is a quick way to confirm which options an interactive shell or a sourced script has enabled.

Set Positional Parameters

The set command has a second job unrelated to options: when given arguments after --, it replaces the positional parameters $1, $2, and so on. This is useful when you want to reset the arguments a script or function reads:

sh
set -- one two three
echo "$2"

output

two

The -- marks the end of options so that arguments starting with a dash are not mistaken for flags.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Option	Long form	Effect
`set -e`	`set -o errexit`	Exit immediately on a command failure
`set -u`	`set -o nounset`	Error when an unset variable is used
`set -x`	`set -o xtrace`	Print each command before running it
`set -o pipefail`	`set -o pipefail`	Fail a pipeline if any command in it fails
`set +e`	`set +o errexit`	Disable an option (plus instead of dash)
`set -o`		List all options and their state
`set -- a b c`		Set the positional parameters

FAQ

What is the difference between set -e and set -o errexit?
They are the same thing. set -e is the short form and set -o errexit is the long, more readable form. Use whichever you prefer; long forms are common in shared scripts because they are self-documenting.

Why does my script still continue after a command fails with set -e?
The failed command is probably part of an if test, joined with && or ||, or preceded by !. In those positions bash deliberately ignores the failure so you can test exit status. A command substitution or a function call can also mask the failure.

What does the plus sign do, as in set +x?
A plus disables an option that a dash would enable. set -x turns tracing on and set +x turns it off, so you can scope an option to part of a script.

Should I always use set -euo pipefail?
It is a good default for new scripts and catches many bugs early, but set -e in particular has surprising edge cases. For complex scripts, understand how each option behaves and handle the exceptions explicitly rather than assuming the script is fully protected.

Conclusion

The set builtin turns bash from a forgiving shell into a strict one: set -e stops on errors, set -u catches typos in variable names, and set -x shows you exactly what ran. Combine them as set -euo pipefail at the top of a script, scope tracing to the block you are debugging, and your scripts will fail loudly and early instead of quietly doing the wrong thing. For more on writing reliable scripts, see our guides on bash best practices and bash functions .

ripgrep Cheatsheet

hello@linuxize.com (Linuxize) — Tue, 26 May 2026 10:20:00 +0200

Basic Search

Search files and directories for matching text.

Command	Description
`rg "pattern"`	Search recursively from the current directory
`rg "pattern" file.txt`	Search a single file
`rg "pattern" dir/`	Search a specific directory
`rg "pattern" file1 file2`	Search specific files
`rg --version`	Show the installed ripgrep version

File Type Filters

Limit searches to known file types.

Command	Description
`rg -t py "pattern"`	Search only Python files
`rg -t js "pattern"`	Search only JavaScript files
`rg -t markdown "pattern"`	Search only Markdown files
`rg -T js "pattern"`	Exclude JavaScript files
`rg --type-list`	Show available file type names

Glob Filters

Include or exclude paths with glob patterns.

Command	Description
`rg -g '*.log' "error"`	Search only `.log` files
`rg -g '*.conf' "listen" /etc`	Search matching config files
`rg -g '!*.min.js' "console.log"`	Exclude minified JavaScript files
`rg -g '!node_modules/' "TODO"`	Exclude a directory
`rg -g '*.md' -g '!README.md' "pattern"`	Combine include and exclude globs

Case and Literal Search

Control case matching and regex handling.

Command	Description
`rg -i "warning"`	Case-insensitive search
`rg -S "warning"`	Smart case search
`rg -s "Warning"`	Force case-sensitive search
`rg -F "price[0]"`	Search for a fixed string
`rg -w "id"`	Match whole words only

Counts and File Lists

Summarize matches or print filenames.

Command	Description
`rg -c "error"`	Count matching lines per file
`rg --count-matches "error"`	Count individual matches per file
`rg -l "error"`	List files with matches
`rg --files-without-match "error"`	List files without matches
`rg --stats "error"`	Print search statistics

Context Output

Show lines around each match.

Command	Description
`rg -C 3 "panic"`	Show 3 lines before and after
`rg -A 2 "error"`	Show 2 lines after
`rg -B 2 "error"`	Show 2 lines before
`rg -n "error"`	Show line numbers
`rg -N "error"`	Hide line numbers

Patterns and Regex

Search with multiple patterns and regex features.

Command	Description
`rg -e "error" -e "warning"`	Match either pattern
`rg -e "--force"`	Search for a pattern starting with `-`
`rg 'error\|warning'`	Use regex alternation
`rg '^server'`	Match lines starting with `server`
`rg 'listen$'`	Match lines ending with `listen`

Hidden and Ignored Files

Search paths that rg skips by default.

Command	Description
`rg --hidden "api_key"`	Include hidden files and directories
`rg --no-ignore "TODO"`	Ignore `.gitignore`, `.ignore`, and `.rgignore`
`rg --hidden --no-ignore "password"`	Search hidden and ignored files
`rg -u "pattern"`	Reduce ignore filtering by one level
`rg -uuu "pattern"`	Search almost everything, including binary files

Replacement Preview

Preview changed output without editing files.

Command	Description
`rg "old" -r "new"`	Preview replacing `old` with `new`
`rg '(foo)(bar)' -r '$2$1'`	Reorder capture groups in output
`rg -o 'v[0-9]+\.[0-9]+\.[0-9]+'`	Print only matched version strings
`rg -o -r '$1' 'version = "([^"]+)"'`	Extract a captured value
`rg "foo" -r "bar"`	Preview before using `sed` or an editor

Troubleshooting

Quick checks for common rg issues.

Issue	Check
File is missing from results	Run `rg --debug "pattern"`
Hidden files are skipped	Add `--hidden`
Ignored files are skipped	Add `--no-ignore`
Glob does not work	Quote it, for example `-g '*.conf'`
Pattern starts with `-`	Use `rg -e "--flag"`

Common Options

Useful flags to remember.

Option	Description
`-t TYPE`	Search only a file type
`-T TYPE`	Exclude a file type
`-g GLOB`	Include or exclude paths by glob
`-i`	Ignore case
`-S`	Smart case
`-F`	Fixed string search
`-w`	Whole-word match
`-l`	List matching files
`--files-without-match`	List non-matching files
`-C N`	Show context lines
`-r TEXT`	Preview replacement output
`--hidden`	Include hidden files
`--no-ignore`	Ignore ignore-file rules

Use these guides for full command workflows.

Guide	Description
ripgrep Command in Linux	Full `rg` tutorial with practical examples
grep Command in Linux	Standard text search with GNU `grep`
Grep Exclude	Exclude files, directories, and patterns with `grep`
find Files in Linux	Locate files by metadata and path
sed Find and Replace	Replace text after previewing matches

ripgrep Command in Linux: Fast Recursive Search

hello@linuxize.com (Linuxize) — Tue, 26 May 2026 09:30:00 +0200

Searching through a large codebase or a directory full of log files with grep often means adding -r for recursion, -n for line numbers, and --include or --exclude rules to avoid unrelated files. In a Git repository, you may also need extra excludes for build directories, vendor files, and binary output.

ripgrep (rg) handles the common case with better defaults. It searches directories recursively, respects .gitignore, .ignore, and .rgignore rules, skips hidden and binary files during recursive searches, and shows friendly interactive output. It is also much faster than traditional recursive grep on many large file trees because it uses Rust’s regex engine and parallel directory traversal.

This guide explains how to use the ripgrep command in Linux, from basic searches to file type filters, context lines, replacement previews, and config defaults.

Installing ripgrep

On Ubuntu, Debian, and Derivatives, install the ripgrep package with apt:

Terminal
sudo apt install ripgrep

On Fedora, RHEL, and Derivatives, use dnf:

Terminal
sudo dnf install ripgrep

On Arch Linux, install it from the official repositories:

Terminal
sudo pacman -S ripgrep

Verify the installation with:

Terminal
rg --version

The output shows the installed version:

output

ripgrep 15.1.0 (rev af60c2de9d)

Your distribution may ship a different version, but the examples in this guide use common options available in current ripgrep releases.

Syntax

The basic syntax for the rg command is:

txt
rg [OPTIONS] PATTERN [PATH ...]

The PATTERN argument is the text or regular expression to search for. If you omit PATH, rg searches recursively from the current directory.

For example, rg "error" searches the current directory tree, while rg "error" logs/ limits the search to the logs directory.

Basic Search

Search for a pattern in all files under the current directory:

Terminal
rg "error"

Example output:

output

logs/app.log:42:error: connection refused
logs/app.log:78:error: timeout after 30s
src/main.py:114:raise ValueError("error parsing config")

The output shows the filename, line number, and matching line. In an interactive terminal, rg also uses color by default, so you do not need the usual recursive grep flags for the common code-search workflow.

To search in a specific file, pass the filename after the pattern:

Terminal
rg "error" logs/app.log

To search in a specific directory, pass the directory path:

Terminal
rg "error" logs/

Filtering by File Type

Use -t to restrict the search to a known file type:

Terminal
rg -t py "import os"

This searches only Python files. ripgrep includes built-in definitions for many file types. To see the full list, run:

Terminal
rg --type-list

To exclude a file type, use -T:

Terminal
rg -T js "TODO"

You can also use glob patterns with -g to match or exclude specific filenames. Quote glob patterns so the shell does not expand them before rg receives them:

Terminal
rg -g '*.log' "error"

Use a leading ! to exclude matching paths:

Terminal
rg -g '!*.min.js' "console.log"

The ! prefix belongs to rg, so quoting is especially useful in shells where ! can trigger history expansion.

Case-Insensitive Search

Add -i to ignore letter case:

Terminal
rg -i "warning"

This matches warning, Warning, WARNING, and other case variants.

For a more flexible default, use -S or --smart-case:

Terminal
rg -S "warning"

With smart case, an all-lowercase pattern is case-insensitive, but a pattern with any uppercase letter is case-sensitive. For example, rg -S "warning" matches Warning, while rg -S "Warning" searches for that exact capitalization.

Fixed String Search

By default, rg treats the pattern as a regular expression. Use -F to search for a literal string instead, which is useful when the pattern contains regex characters:

Terminal
rg -F "price[0]"

Without -F, [0] would be interpreted as a character class. With -F, rg searches for the literal text price[0].

Counting and Listing Matches

To count matching lines per file instead of printing the matching lines, use -c:

Terminal
rg -c "error"

Example output:

output

logs/app.log:14
logs/nginx/access.log:3

The count is the number of matching lines, not the total number of matching words or strings.

To print only filenames that contain at least one match, use -l:

Terminal
rg -l "error"

To print only filenames that contain no matches, use --files-without-match:

Terminal
rg --files-without-match "error"

This is different from combining -v with -l. The --files-without-match option checks whether a file has zero matching lines.

Context Lines

When a matching line alone is not enough to understand the surrounding code, add context with -C:

Terminal
rg -C 3 "panic"

This prints three lines before and three lines after each match.

Use -A for lines after the match only:

Terminal
rg -A 2 "def connect"

Use -B for lines before the match only:

Terminal
rg -B 2 "def connect"

Context output is useful when you want to inspect the code around a function, error message, or configuration value without opening each file.

Multiple Patterns

Use -e to search for more than one pattern in a single pass:

Terminal
rg -e "error" -e "warning"

This matches any line containing either word. It is equivalent to the regex error|warning, but repeated -e options are easier to read when patterns become longer.

The -e option is also useful when a pattern begins with a dash:

Terminal
rg -e "--force"

Without -e, rg would try to interpret --force as an option.

Whole-Word Match

The -w flag restricts matches to whole words. This is useful when you want to find a variable name without matching it inside a longer name:

Terminal
rg -w "id"

This matches id, but not uid or invalid.

Invert Match

The -v flag prints lines that do not match the pattern:

Terminal
rg -v "^#" config.txt

This shows all lines in config.txt that do not begin with #.

If you want filenames that do not contain a pattern at all, use --files-without-match instead:

Terminal
rg --files-without-match "version" -g '*.json'

Searching Hidden Files and Ignoring .gitignore

By default, recursive rg searches skip hidden files and directories, and respect .gitignore, .ignore, and .rgignore files. This is usually what you want in a source tree.

To include hidden files and directories, use --hidden:

Terminal
rg --hidden "api_key"

To ignore .gitignore, .ignore, and .rgignore rules, use --no-ignore:

Terminal
rg --no-ignore "TODO"

The --no-ignore option does not include hidden files by itself. To search hidden files and ignored files in the same search, combine both options:

Terminal
rg --hidden --no-ignore "password"

Warning

Searching with --hidden --no-ignore can include build artifacts, dependency directories, cache folders, and other large trees. It is much slower and can produce noisy results, so use it only when you have a specific reason to search outside the normal project files.

Replacing Output

The -r option rewrites matching text in the output to show what a replacement would look like. It does not modify any files:

Terminal
rg "foo" -r "bar"

Example output:

output

src/config.py:5:bar = get_setting("bar")

The output shows the line as it would look after replacing foo with bar. This is useful for previewing a project-wide rename before using sed or a text editor’s find-and-replace feature.

For capture groups in replacements, wrap the command in single quotes so the shell does not expand $1, $name, or similar replacement references before rg runs.

Showing Only the Match

By default, rg prints the full line containing the match. Use -o to print only the matched text:

Terminal
rg -o 'v[0-9]+\.[0-9]+\.[0-9]+'

Example output:

output

package.json:4:v1.4.2
package-lock.json:8:v1.4.2

This is useful when you want to extract values from files rather than inspect matching lines in context.

ripgrep Configuration File

ripgrep can read default options from a configuration file, but it does not automatically look in ~/.config/ripgrep/ or any other fixed path. You must point RIPGREP_CONFIG_PATH to the file you want rg to read.

For example, create a config file named ~/.ripgreprc:

~/.ripgreprctxt
--smart-case
--hidden
--glob=!.git/

Then export the environment variable:

Terminal
export RIPGREP_CONFIG_PATH="$HOME/.ripgreprc"

Add that export line to your shell startup file, such as ~/.bashrc or ~/.zshrc, if you want the setting to apply in new terminal sessions.

Each config file line is passed to rg as one command-line argument. For options with values, use either --option=value on one line or put the option and its value on separate lines.

Troubleshooting

rg does not find a file you expected
The file may be hidden, ignored by .gitignore, ignored by .ignore or .rgignore, or detected as binary. Start with rg --debug "pattern" to see why paths were skipped, then add --hidden, --no-ignore, or both only when needed.

A glob pattern does not work as expected
Quote glob patterns, such as rg -g '*.conf' "server" and rg -g '!*.min.js' "console.log". Without quotes, your shell may expand * before rg sees the pattern.

A pattern starting with - is treated as an option
Use -e before the pattern, for example rg -e "--force". You can also use -- to stop option parsing, as in rg -- "--force".

Options Reference

-t TYPE - Search only files of the given type.
-T TYPE - Exclude files of the given type.
-g GLOB - Include or exclude files by glob. A ! prefix excludes paths.
-i - Search case-insensitively.
-F - Treat the pattern as a fixed string, not a regex.
-c - Count matching lines per file.
-l - List only filenames with matches.
--files-without-match - List only filenames without matches.
-C N - Show N lines of context around each match.
-A N - Show N lines after each match.
-B N - Show N lines before each match.
-e PATTERN - Add a search pattern. Repeat it to search for multiple patterns.
-w - Match whole words only.
-v - Invert the match and print non-matching lines.
-o - Print only the matched text, not the full line.
-r REPLACEMENT - Show output with matches replaced. This is a preview only.
-n - Show line numbers. This is enabled by default in interactive terminal output.
--hidden - Search hidden files and directories.
--no-ignore - Do not respect .gitignore, .ignore, and .rgignore rules.
-S, --smart-case - Search case-insensitively when the pattern is lowercase, and case-sensitively when it contains uppercase.
--stats - Print a summary of the search at the end.
-M N - Omit lines longer than N bytes.

Quick Reference

For a printable quick reference, see the ripgrep cheatsheet .

Task	Command
Search recursively from the current directory	`rg "pattern"`
Search in a specific file	`rg "pattern" file.txt`
Search in a specific directory	`rg "pattern" logs/`
Search only Python files	`rg -t py "pattern"`
Exclude JavaScript files	`rg -T js "pattern"`
Search by glob	`rg -g '*.log' "pattern"`
Exclude by glob	`rg -g '!*.min.js' "pattern"`
Search case-insensitively	`rg -i "pattern"`
Use smart case	`rg -S "pattern"`
Search for a fixed string	`rg -F "price[0]"`
Count matching lines per file	`rg -c "pattern"`
List matching filenames	`rg -l "pattern"`
List filenames without matches	`rg --files-without-match "pattern"`
Show three lines of context	`rg -C 3 "pattern"`
Search multiple patterns	`rg -e "foo" -e "bar"`
Match a whole word	`rg -w "id"`
Invert line matches	`rg -v "pattern"`
Include hidden files	`rg --hidden "pattern"`
Ignore ignore files	`rg --no-ignore "pattern"`
Include hidden and ignored files	`rg --hidden --no-ignore "pattern"`
Preview replacement output	`rg "old" -r "new"`
Print only matched text	`rg -o "pattern"`

Conclusion

ripgrep covers the same ground as grep , but its recursive search, file filtering, and ignore-file support make it a better default for many code and log searches. For path-based file finding, pair it with find , or use rg -l when you need a list of files that contain a specific pattern.

whois Command in Linux: Query Domain Registration Info

hello@linuxize.com (Linuxize) — Mon, 25 May 2026 11:30:00 +0200

When you need to know who owns a domain, when it expires, which registrar handles it, or which organization holds a particular IP block, the whois command is the fastest route. It queries the registry databases that record this information and returns a plain-text response you can scan in a terminal. The output format varies by registry, but the questions you can answer are consistent: registrar, name servers, registration and expiry dates, and contact info (where privacy rules allow).

This guide explains how to use whois in Linux to look up domains, IP addresses, and AS numbers, how to target a specific server, and how to parse the output for the fields you actually care about.

whois Syntax

The general form is:

txt
whois [OPTIONS] OBJECT

OBJECT is the domain, IP address, or AS number you want information about. With no options, whois picks the right registry automatically based on the type of query.

Install whois

whois is not always installed by default. On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt update
sudo apt install whois

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install whois

Confirm it is in place:

Terminal
whois --version

output

Version 5.6.6.

The Debian-family whois is an actively maintained client with built-in routing logic that knows which registry to ask for each TLD.

Look Up a Domain

The most common use is checking a domain:

Terminal
whois example.com

output

 Domain Name: EXAMPLE.COM
Registry Domain ID: 2336799_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.iana.org
Registrar URL: http://res-dom.iana.org
Updated Date: 2026-01-16T18:26:50Z
Creation Date: 1995-08-14T04:00:00Z
Registry Expiry Date: 2026-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority
Registrar IANA ID: 376
Name Server: ELLIOTT.NS.CLOUDFLARE.COM
Name Server: HERA.NS.CLOUDFLARE.COM
DNSSEC: signedDelegation
...

The fields that matter most for everyday questions are:

Registrar, the company managing the registration.
Creation Date and Registry Expiry Date, which tell you how old the domain is and when it needs renewing.
Name Server, which lists the DNS servers authoritative for the domain.
DNSSEC, which shows whether the domain is cryptographically signed.

For ccTLDs (.de, .uk, .jp), the format differs because each country runs its own registry. The information is similar; the field names and order change.

Look Up an IP Address

whois on an IP returns the network allocation, not the domain:

Terminal
whois 93.184.216.34

output

inetnum: 93.184.216.0 - 93.184.216.255
netname: EDGECAST-NETBLK-03
descr: NETBLK-03-EU-93-184-216-0-24
country: EU
admin-c: DS7892-RIPE
tech-c: DS7892-RIPE
status: ASSIGNED PA
...

This kind of query is the right tool for “who owns this IP that has been hitting my server” investigations. The output names the network block, maintainer, and abuse contact details when the registry publishes them.

Look Up an AS Number

Pass an autonomous system number with the AS prefix:

Terminal
whois AS15169

output

ASNumber: 15169
ASName: GOOGLE
ASHandle: AS15169
RegDate: 2000-03-30
Updated: 2012-02-24
Ref: https://rdap.arin.net/registry/autnum/15169

AS lookups are useful when you trace a route with mtr or traceroute and want to know which network each hop belongs to.

Pick a Specific WHOIS Server

The default routing finds the right server for most TLDs, but you can force a query against a specific server with -h:

Terminal
whois -h whois.arin.net 8.8.8.8

The flag is the right tool for two situations: when the default routing picks the wrong upstream (rare but happens for some legacy TLDs), and when you want to compare answers between regional registries (ARIN, RIPE, APNIC, AFRINIC, LACNIC).

Limit the Recursion

Most modern whois clients follow a referral chain: query IANA, follow the pointer to the TLD registry, follow the pointer to the registrar, and return the most specific answer. To stop registry-to-registrar recursion, pass --no-recursion:

Terminal
whois --no-recursion example.com

The flag is most useful when you specifically want the registry data and not the registrar’s slightly different format.

The -H option has a different purpose. It hides legal disclaimers from the output, which can make short lookups easier to read:

Terminal
whois -H example.com

Filter the Output

Real whois responses are dozens of lines long with legal disclaimers and template text. To extract one field, pipe through grep:

Terminal
whois example.com | grep -E "Registrar:|Expiry Date:"

output

 Registry Expiry Date: 2026-08-13T04:00:00Z
Registrar: RESERVED-Internet Assigned Numbers Authority

For a name-server list:

Terminal
whois example.com | awk '/Name Server:/ {print $NF}'

output

ELLIOTT.NS.CLOUDFLARE.COM
HERA.NS.CLOUDFLARE.COM

These short patterns work for monitoring scripts that watch for domain expirations or DNSSEC status changes.

Check Domain Availability

If the domain is not registered, the response says so explicitly. The exact wording depends on the registry:

Terminal
whois never-existed-domain-xyzzy.com

output

No match for domain "NEVER-EXISTED-DOMAIN-XYZZY.COM".

Some registries (notably .io, .co, and several ccTLDs) return an empty or near-empty response for unregistered domains. Two heuristics that work in scripts:

For .com/.net/.org, grep for No match for or Domain Name: in the output.
For ccTLDs, grep for Domain not found or check whether the registration fields exist.

Rate Limits and Etiquette

Registries rate-limit whois queries. Hammering them with a script is the fastest way to get blocked. If you query many domains, add a sleep between calls and cache the result locally. For bulk lookups, use the registry’s RDAP service directly or pay for a commercial WHOIS API.

A simple polite pattern:

Terminal
while IFS= read -r domain; do
 whois "$domain"
 sleep 2
done < domains.txt

Two seconds between queries is a sane starting point; raise it if you see throttling responses.

Privacy and Redacted Output

Since GDPR took effect, most TLDs redact personal contact information for individual registrants. The response usually contains placeholders like REDACTED FOR PRIVACY or Data Protected, Not Disclosed. For organizations and legal entities, the contact information often stays visible.

This is not a defect in whois; the underlying registry data is simply less detailed than it used to be. For account-takeover prevention and abuse handling, focus on the registrar field and the abuse contact email, which remain published.

Quick Reference

Task	Command
Look up a domain	`whois example.com`
Look up an IP address	`whois 93.184.216.34`
Look up an AS number	`whois AS15169`
Query a specific server	`whois -h whois.arin.net 8.8.8.8`
Stop registry-to-registrar recursion	`whois --no-recursion example.com`
Hide legal disclaimers	`whois -H example.com`
Extract registrar and expiry fields	`whois example.com \| grep -E “Registrar:\|Expiry Date:"`
List name servers	`whois example.com \| awk ‘/Name Server:/ {print $NF}’`

Troubleshooting

whois: command not found
Install the package: sudo apt install whois on Ubuntu, Debian, and Derivatives, or sudo dnf install whois on Fedora, RHEL, and Derivatives. The package is small and adds no significant dependencies.

Output says “fgets: Connection reset by peer”
The registry rate-limited or blocked your IP. Wait a few minutes and retry, slow your script down, or query through a different network.

Response is in a different language or alphabet
Some ccTLD registries return data in the local language. Look for the English section (usually further down), or pipe through iconv if the encoding makes the response unreadable in your terminal.

FAQ

What is the difference between WHOIS and RDAP?
RDAP (Registration Data Access Protocol) is the modern replacement for WHOIS. It returns structured JSON instead of free-text and supports authentication and access controls. Most registries now serve both, and RDAP is usually the better choice for scripts that need predictable fields.

Why does the data for the same domain look different between two whois runs?
Different clients and servers can follow the referral chain differently. One response may come from the registry, while another may include data from the registrar’s WHOIS server. Use --no-recursion when you want to stop at the registry answer.

Can I run my own WHOIS server?
Yes, but only registrars and registries have authoritative data. Self-hosted WHOIS servers are useful for internal directories (IP allocation in a large network), not for public domain lookups.

Conclusion

whois is the answer to “who owns this”, whether the “this” is a domain, an IP, or an AS number. The output is plain text, the flags are short, and a handful of grep/awk patterns turn it into a script-friendly data source. For bulk work, slow the queries down and respect the rate limits the registries publish.

For related reading, see our guides on the dig command and the nslookup command .

How to Install and Use Zsh on Ubuntu

hello@linuxize.com (Linuxize) — Sat, 23 May 2026 10:20:00 +0200

Bash has been the default login shell on Ubuntu for years, and it works fine for running scripts and one-off commands. When we spend most of the day inside a terminal, though, small details start to matter: smarter tab completion, spell correction on commands, recursive globs, and rich theming. Zsh adds those features without breaking the Bash scripts we already rely on.

This guide explains how to install Zsh on Ubuntu, set it as the default shell, configure ~/.zshrc, and bolt on the Oh My Zsh framework for plugins and themes.

Quick Reference

Task	Command
Install Zsh	`sudo apt install zsh`
Check version	`zsh --version`
Set as default shell	`chsh -s $(which zsh)`
Reload config	`source ~/.zshrc`
List shells	`cat /etc/shells`
Switch back to Bash	`chsh -s /bin/bash`
Install Oh My Zsh	`sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"`

Prerequisites

You need an Ubuntu system with a user account that has sudo privileges. The Zsh package comes from the default Ubuntu repositories, while the Oh My Zsh installer needs curl and git.

Install those helper packages if they are missing:

Terminal
sudo apt update
sudo apt install curl git

Install Zsh

Zsh is available in the default Ubuntu repositories. Refresh the package index and install it:

Terminal
sudo apt update
sudo apt install zsh

Verify the installation by checking the Zsh version:

Terminal
zsh --version

The output looks similar to:

output

zsh 5.9 (x86_64-ubuntu-linux-gnu)

Run Zsh for the First Time

Start Zsh without changing your default shell yet:

Terminal
zsh

The first launch opens the zsh-newuser-install configuration wizard. The relevant choices are:

0 exits the wizard and creates an empty ~/.zshrc so Zsh stops asking on every start.
1 continues to the interactive menu, where we can pick defaults for history, completion, key bindings, and a few other behaviors.
2 populates ~/.zshrc with the system-wide recommended defaults.
q quits without creating a config file at all, which means the wizard runs again next time.

Pick option 0 or q if you plan to install Oh My Zsh next, since it ships its own template and will overwrite the file anyway. Otherwise, run the interactive setup to generate a sensible starting point.

Set Zsh as the Default Shell

Once you are happy with the way Zsh behaves, change the default login shell for your user:

Terminal
chsh -s $(which zsh)

Log out and log back in so the new shell takes effect. Confirm the change with:

Terminal
echo $SHELL

The output should be /usr/bin/zsh or /bin/zsh, depending on your Ubuntu release and shell path layout.

If you prefer to keep Bash as the login shell and only run Zsh on demand, skip this step and start Zsh manually with zsh whenever you need it.

Edit ~/.zshrc

The ~/.zshrc file runs every time an interactive Zsh session starts. Open it with your editor:

Terminal
nano ~/.zshrc

A minimal useful starting point looks like this:

~/.zshrcsh
# History
HISTFILE=~/.zsh_history
HISTSIZE=10000
SAVEHIST=10000
setopt SHARE_HISTORY
setopt HIST_IGNORE_DUPS

# Completion
autoload -Uz compinit
compinit

# Aliases
alias ll='ls -lah'
alias gs='git status'

# Prompt
PROMPT='%n@%m %~ %# '

Reload the file in the current session without opening a new terminal:

Terminal
source ~/.zshrc

For more on aliases, see how to create Bash aliases . The same syntax works in Zsh.

Install Oh My Zsh

Oh My Zsh is a popular framework that ships a large catalog of plugins and themes. The official installer is the most common setup path:

Warning

Piping a remote install script into sh runs code from the network as your user. If you are setting up a shared or production machine, download the installer first, review it, and then run it locally.

To inspect the script before running it, use:

Terminal
curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh -o install-oh-my-zsh.sh
less install-oh-my-zsh.sh
sh install-oh-my-zsh.sh

For a quick personal workstation setup, you can run the installer directly:

Terminal
sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)"

The installer clones Oh My Zsh into ~/.oh-my-zsh, backs up the existing ~/.zshrc to ~/.zshrc.pre-oh-my-zsh, and writes a new ~/.zshrc with sensible defaults.

Pick a Theme

Open ~/.zshrc and find the ZSH_THEME line. The default value is robbyrussell. Try a different theme by setting:

sh
ZSH_THEME="agnoster"

The agnoster theme uses powerline-style segments and requires a Nerd Font for the special glyphs. If you want to sample themes without installing extra fonts first, use ZSH_THEME="random" to cycle themes on every login until you find one you like.

Reload the configuration to apply the new theme:

Terminal
source ~/.zshrc

Enable Plugins

Plugins extend Zsh with completion definitions, shortcuts, and visual aids. Edit the plugins=() line in ~/.zshrc and add the plugins you want:

sh
plugins=(git docker kubectl sudo zsh-autosuggestions zsh-syntax-highlighting)

git, docker, kubectl, and sudo ship with Oh My Zsh. zsh-autosuggestions and zsh-syntax-highlighting are external plugins. Install them with:

Terminal
git clone https://github.com/zsh-users/zsh-autosuggestions ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-autosuggestions
git clone https://github.com/zsh-users/zsh-syntax-highlighting.git ${ZSH_CUSTOM:-~/.oh-my-zsh/custom}/plugins/zsh-syntax-highlighting

Reload ~/.zshrc to activate them:

Terminal
source ~/.zshrc

zsh-autosuggestions shows a faded completion based on your history as you type. Press the right arrow key to accept it. zsh-syntax-highlighting colors valid commands green and unknown commands red, which catches typos before you press Enter.

Useful Built-in Features

Zsh ships several features that are not available in Bash without extra setup:

Recursive glob patterns: ls **/*.log lists every .log file under the current directory.
Globbing qualifiers: ls *(.) lists only regular files; ls *(/) lists only directories.
Spell correction: setopt CORRECT prompts you to fix mistyped commands.
Sharing history across sessions in real time with setopt SHARE_HISTORY.

Troubleshooting

chsh reports “non-standard shell”
Make sure /usr/bin/zsh is listed in /etc/shells. If it is missing, add it with echo $(which zsh) | sudo tee -a /etc/shells and run chsh again.

Zsh starts but the prompt is broken on a remote SSH session
The theme probably depends on a Nerd Font that the local terminal does not have. Switch to a simpler theme such as robbyrussell or install a Nerd Font in the terminal application.

Plugins are listed but nothing happens
Check the ZSH_CUSTOM path matches where you cloned the plugin. Run ls ~/.oh-my-zsh/custom/plugins to confirm the plugin directory exists, then reload ~/.zshrc.

Conclusion

From here we can keep tweaking ~/.zshrc to match the way we work: add aliases for repetitive commands, pin a theme that reads well in the terminal we use most, and pull in plugins as new tools enter the workflow. The alias syntax matches Bash, so existing alias workflows carry over without changes.

Bash Arithmetic: Integer and Floating-Point Math

hello@linuxize.com (Linuxize) — Fri, 22 May 2026 14:41:00 +0200

Bash treats everything as a string by default, which catches many people out the first time they write total=$count+1 and end up with the literal text 5+1 instead of 6. The shell has dedicated arithmetic forms that evaluate numeric expressions properly, but they only handle integers; for floating-point math you reach for bc or awk. Once you know which form to use where, the math is short and predictable.

This guide explains how Bash arithmetic works, the differences between (( )), $(( )), and let, and how to combine them with external tools when you need decimals.

Why Plain Assignment Does Not Add

A first attempt at incrementing a variable usually looks like this:

sh
count=5
total=$count+1
echo "$total"

output

5+1

The shell sees $count as the string 5, joins it with +1, and assigns the result. To force numeric evaluation, use one of the arithmetic forms below.

The (( )) Compound Command

Wrap an expression in double parentheses to evaluate it as integer math:

sh
count=5
(( count = count + 1 ))
echo "$count"

output

Inside (( )), variable names work without $, the C-style operators are available (+, -, *, /, %, **, ++, --, <<, >>, &, |, ^, &&, ||), and the exit status of the whole expression is non-zero when the result is 0, which means you can use arithmetic in if:

sh
if (( count > 5 )); then
 echo "count is above 5"
fi

output

count is above 5

The shortcut increment and decrement operators read cleanly in loops:

sh
for (( i = 0; i < 3; i++ )); do
 echo "i=$i"
done

output

i=0
i=1
i=2

(( )) is the right form when you assign back to a variable or use the result for control flow. It does not print anything to standard output.

The $(( )) Expansion

When you want the value of an expression rather than the side effect, use the $(( )) arithmetic expansion. The result is substituted into the surrounding command like any other expansion:

sh
count=5
echo "Next: $(( count + 1 ))"

output

Next: 6

$(( )) is the right form for inline math inside echo, assignments to other variables, command arguments, and printf:

sh
files=42
echo "Average: $(( files / 7 )) per day"

output

Average: 6 per day

Notice that the division truncates: 42 / 7 happens to be exact, but 43 / 7 would yield 6, not 6.14. Bash arithmetic is integer-only; the decimal part is silently discarded.

The let Builtin

let is the older builtin for arithmetic. It evaluates each argument as an expression:

sh
let "count = 5 + 1"
echo "$count"

output

let is mostly historical at this point. (( )) does the same work without the quoting trap (let count=* would expand the * as a glob unless quoted) and reads more cleanly. New scripts should prefer (( )); let is worth recognizing in code you inherit.

Operators You Will Actually Use

Bash supports a wide list of arithmetic operators. These are the ones that come up in everyday scripts:

+, -, *, /, % - Standard arithmetic and remainder.
** - Exponentiation.
++, -- - Increment and decrement, prefix or postfix.
+=, -=, *=, /=, %= - Compound assignment.
==, !=, <, <=, >, >= - Numeric comparison (inside (( ))).
&&, ||, ! - Logical AND, OR, NOT.
<<, >>, &, |, ^, ~ - Bitwise shifts and operations.

A small example that uses several:

sh
size=1024
if (( size > 0 && size % 2 == 0 )); then
 echo "Power of two? $(( (size & (size - 1)) == 0 ? 1 : 0 ))"
fi

output

Power of two? 1

The ternary operator (? :) works inside arithmetic contexts, which keeps short branches readable without nesting if.

Number Bases

Bash arithmetic supports several integer bases. Prefix a number to declare its base:

0xNN for hexadecimal.
0NN for octal.
BASE#NNN for any base from 2 to 64.

Examples:

sh
echo "$(( 0xff ))"
echo "$(( 0755 ))"
echo "$(( 2#1010 ))"

output

255
493
10

Watch out for leading zeros: 08 is interpreted as octal and rejected because 8 is not a valid octal digit. If user input may include leading zeros (HTTP status codes parsed from a string, timestamps), strip them before arithmetic with ${var#0} or use the explicit 10# base prefix:

sh
value="08"
echo "$(( 10#$value ))"

output

Floating-Point Math with bc

Bash itself cannot do decimal math, but it is happy to call out to a tool that can. bc is the arbitrary-precision calculator that ships with most distributions:

sh
echo "scale=2; 43 / 7" | bc

output

6.14

The scale=2 directive sets two decimal places of precision. Without it, bc truncates the division the same way Bash does. Use a higher scale for currency or scientific work:

sh
echo "scale=10; 4*a(1)" | bc -l

output

3.1415926532

The -l flag loads the math library, which gives you s (sine), c (cosine), a (arctangent), l (natural log), e (exponential), and sqrt. The expression above computes pi from 4 * arctan(1).

To capture the result into a variable:

sh
pi=$(echo "scale=4; 4*a(1)" | bc -l)
echo "pi = $pi"

output

pi = 3.1415

bc is the right tool when you need genuine decimals and do not want a heavyweight dependency. For one-off interactive calculations, run bc -l and type expressions at its prompt.

Floating-Point Math with awk

awk is the other obvious choice and is often faster because it does not start a separate calculator process. Use awk for inline expressions inside scripts:

sh
rate=$(awk 'BEGIN { printf "%.2f\n", 43 / 7 }')
echo "rate = $rate"

output

rate = 6.14

printf inside awk works the same way as the C function, with %.2f controlling the number of decimal places. For a percentage:

sh
pct=$(awk -v a=23 -v b=89 'BEGIN { printf "%.1f%%\n", (a / b) * 100 }')
echo "pct = $pct"

output

pct = 25.8%

Pass values into awk with -v name=value rather than building the expression by string concatenation; the -v form avoids quoting headaches and shell-injection issues when the inputs come from user data.

Increment Counters in a Loop

Counter loops are the bread and butter of arithmetic in scripts, and they lean on the increment and decrement operators . Two equivalent forms work; pick the one that reads best:

sh
count=0
while IFS= read -r line; do
 (( count++ ))
done < input.txt
echo "Lines: $count"

sh
count=0
while IFS= read -r line; do
 count=$(( count + 1 ))
done < input.txt
echo "Lines: $count"

The (( count++ )) form is shorter and is what most authors prefer. Both produce the same result and run at the same speed.

If the script uses set -e, avoid (( count++ )) when count may start at zero. The arithmetic command returns a failure status when the expression evaluates to 0, so the first increment can stop the script. Use pre-increment or assignment instead:

sh
(( ++count ))
(( count += 1 ))

Troubleshooting

syntax error in expression
A variable that should hold a number contains non-numeric characters (often a leading or trailing space from read, or a stray letter). Inside (( )) and $(( )), Bash reports a syntax error on the offending token. Trim the input with ${var//[[:space:]]/} or validate it before the arithmetic line.

division by 0
A divisor evaluated to zero, often because the variable was empty and Bash treated it as 0. Quote the expansion in your check (if [ -n "$divisor" ]) before the divide, and either skip the operation or substitute a default with ${divisor:-1}.

Result is 0 when it should be a fraction
Bash arithmetic is integer-only. Switch to bc with an explicit scale= or to awk with %.Nf formatting for decimal output.

FAQ

When should I use (( )) versus $(( ))?
Use (( )) for assignments and control flow (if, while, for). Use $(( )) when you want the value substituted into a surrounding command. They share the same expression syntax.

Can I do floating-point math without an external tool?
Not in Bash. ksh93 and zsh support floating-point in their arithmetic contexts; Bash does not. For Bash, route decimals through bc or awk.

Is there a performance difference between bc and awk?
awk is usually faster because it runs entirely inside a single process and does not communicate over a pipe. For one-off calculations the difference is negligible; in a tight loop, prefer awk or precompute the values with a single awk call instead of running bc per iteration.

Conclusion

Reach for (( )) and $(( )) whenever a script needs counters, conditions, or quick integer math, and switch to bc or awk the moment decimals enter the picture. Pair that habit with Bash strict mode and the patterns in our Bash best practices guide so numeric code keeps working even when the inputs do not.

Docker Networking: Connect Containers

hello@linuxize.com (Linuxize) — Thu, 21 May 2026 12:20:00 +0200

Once you move past single-container tests, the next problem is communication. A web application needs to reach its database, a reverse proxy needs to forward traffic to an app server, and none of those internal services should be exposed to the public internet by accident.

Docker networking handles that traffic. The defaults work for quick tests, but production-like setups are easier to manage when you understand networks, drivers, DNS names, and published ports. This guide explains how Docker networking works and walks through practical examples for connecting and isolating containers.

How Docker Networking Works

When the Docker daemon starts, it creates three networks automatically: bridge, host, and none. You can see them with docker network ls:

Terminal
docker network ls

output

NETWORK ID NAME DRIVER SCOPE
b84a2c1f9d8e bridge bridge local
c1f3a7b2d4e5 host host local
e7d6a8c2b1f4 none null local

Each network uses a driver that decides how containers on that network communicate:

bridge - Creates an isolated virtual network on one Docker host.
host - Removes network namespace isolation and uses the host network directly.
none - Starts the container with only a loopback interface.

The bridge driver is the default and works for most single-host applications. For anything beyond a quick test, create a user-defined bridge network instead of relying on the default bridge network. User-defined networks give containers automatic DNS resolution by name and keep unrelated services separated.

The Default Bridge Network

When you start a container without specifying a network, Docker attaches it to the default bridge network. Containers on this network can reach each other by IP address, but not by container name, which makes configuration brittle.

Start two containers on the default network:

Terminal
docker run -d --name default_web1 nginx
docker run -d --name default_web2 nginx

Inspect the default bridge to see both containers and their IP addresses:

Terminal
docker network inspect bridge

The output includes a Containers section listing each container with its assigned IP address. Containers on the default bridge can communicate with those addresses, but a name such as default_web2 does not resolve automatically from default_web1. That is the main reason to avoid the default bridge for application stacks.

Creating a User-Defined Bridge Network

User-defined bridge networks solve the name resolution problem and let you group related containers together. Create one with docker network create:

Terminal
docker network create app_net

output

a1b2c3d4e5f67890123456789abcdef0

Now run containers on that network by passing --network:

Terminal
docker run -d --name net_web --network app_net nginx
docker run -d --name net_client --network app_net alpine sleep 3600

From inside net_client, you can reach net_web by container name:

Terminal
docker exec -it net_client ping -c 2 net_web

output

PING net_web (172.18.0.2): 56 data bytes
64 bytes from 172.18.0.2: seq=0 ttl=64 time=0.098 ms
64 bytes from 172.18.0.2: seq=1 ttl=64 time=0.074 ms

The embedded Docker DNS server resolves the container name to the correct IP address. If you add or remove containers, the DNS records update automatically, so you do not have to track container IP addresses yourself.

Publishing Ports to the Host

Containers on a bridge network are reachable from other containers on the same network, but not from outside the Docker host unless you publish a port. Use -p host_port:container_port with docker run:

Terminal
docker run -d --name port_web -p 8080:80 nginx

Nginx listens on port 80 inside the container, and Docker forwards traffic from port 8080 on the host to it. A browser pointed at http://localhost:8080 reaches the container.

You can publish multiple ports by repeating the flag:

Terminal
docker run -d --name port_app -p 8081:80 -p 8443:443 nginx

By default, Docker publishes the port on all host interfaces. To bind only to a specific host interface, prefix the host port with the address:

Terminal
docker run -d --name loopback_web -p 127.0.0.1:8082:80 nginx

This binds the port to the loopback interface only. The container is reachable from the host itself, but not from other machines on the network.

Connecting a Running Container to a Network

A container is not locked to the network it was started on. You can attach a running container to an additional network with docker network connect:

Terminal
docker network connect app_net default_web1

After connecting, default_web1 has an IP address on both its original network and app_net. Containers on either network can reach it through the network they share. This is useful when a service needs to talk to more than one group of containers, for example a shared logger or monitoring agent.

To remove a container from a network, use docker network disconnect:

Terminal
docker network disconnect app_net default_web1

Isolating Containers with Separate Networks

Multiple user-defined networks act as separate network segments. Containers on different networks cannot reach each other unless one of them is explicitly connected to both. This makes it simple to isolate a frontend tier from a database tier.

Create two networks:

Terminal
docker network create frontend_net
docker network create backend_net

Start a database on backend_net, an application container on both networks, and a web server on frontend_net:

Terminal
docker run -d --name db_net --network backend_net -e POSTGRES_PASSWORD=localpass postgres:16-alpine
docker run -d --name app_net_demo --network backend_net alpine sleep 3600
docker network connect frontend_net app_net_demo
docker run -d --name web_net --network frontend_net -p 8083:80 nginx

The web_net container can reach app_net_demo over frontend_net, and app_net_demo can reach db_net over backend_net. The web_net container cannot reach db_net directly because they do not share a network. If the web container is compromised, it cannot open a connection to the database without going through the application layer.

Warning

The PostgreSQL password above is only a local demo value. Use strong secrets for real services, and do not store production credentials in shell history, Compose files, or source control.

The host Network Driver

The host driver skips network namespace isolation and attaches the container directly to the host network. The container shares the host network interfaces, so any port it listens on is immediately available on the host:

Terminal
docker run --rm -d --name host_nginx --network host nginx

Nginx is now reachable on port 80 of the host with no port publishing. In host mode, -p, --publish, and --publish-all are ignored because there is no separate container network namespace to map from.

Use host networking only when you specifically need it, such as for very high port counts or when the application must bind directly to host interfaces. The trade-off is weaker network isolation and possible port conflicts with services already running on the host.

Host networking is native to Docker Engine on Linux. Docker Desktop supports host networking in version 4.34 and later, but it must be enabled in Docker Desktop settings.

The none Network Driver

The none driver disables external networking for the container. The container gets a loopback interface and nothing else:

Terminal
docker run --rm --network none alpine ip addr

This is useful for batch jobs that process local files and should not reach the network.

Inspecting Networks

docker network inspect prints the full configuration of a network in JSON:

Terminal
docker network inspect app_net

The output includes the subnet, gateway, driver options, and a list of every container attached to the network with its IPv4 and IPv6 addresses. When a container cannot reach another container, this is usually the first place to look.

For a quick overview across all bridge networks, use a filter:

Terminal
docker network ls --filter driver=bridge

You can also inspect a container to see its network attachments:

Terminal
docker inspect net_web

Look for the NetworkSettings.Networks section in the output.

Removing Networks

Unused networks remain on the host until you remove them. Delete a single network with docker network rm:

Terminal
docker network create temp_net
docker network rm temp_net

The removal command fails if any containers are still attached. Stop or disconnect those containers first, then retry.

To clean up every user-defined network that is not in use, run:

Terminal
docker network prune

Docker asks for confirmation and then removes idle user-defined networks. The built-in bridge, host, and none networks are not removed.

Docker Compose Networking

When you run applications with Docker Compose , Compose creates a dedicated default network for each project and attaches every service to it. Services reach each other by service name without extra configuration:

docker-compose.ymlyaml
services:
 web:
 image: nginx
 ports:
 - "8080:80"

 db:
 image: postgres:16-alpine
 environment:
 POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}

Define the password in a local .env file:

.envtxt
POSTGRES_PASSWORD=change-this-password

From the web service, db resolves to the database container IP address. You can also declare multiple named networks under a top-level networks key and attach services selectively, which mirrors the frontend and backend split shown earlier.

Warning

Do not commit .env files or real passwords to version control. Add .env to .gitignore, and use secret management from your platform for production credentials.

Quick Reference

For a printable quick reference, see the Docker cheatsheet .

Command	Description
`docker network ls`	List Docker networks
`docker network create app_net`	Create a user-defined bridge network
`docker run --network app_net image`	Start a container on a network
`docker network connect app_net container`	Attach a running container to a network
`docker network disconnect app_net container`	Remove a container from a network
`docker network inspect app_net`	Show network configuration and attached containers
`docker run -p 8080:80 image`	Publish container port 80 on host port 8080
`docker run -p 127.0.0.1:8080:80 image`	Publish a port only on the host loopback interface
`docker run --network host image`	Run a container on the host network
`docker run --network none image`	Run a container with no external network access
`docker network rm app_net`	Remove an unused network
`docker network prune`	Remove all unused user-defined networks

Troubleshooting

Containers cannot reach each other by name
Name-based DNS works on user-defined networks. If you started the containers on the default bridge network, recreate them on a user-defined network, or attach them with docker network connect.

Port is already allocated when publishing
Another process on the host is already using that port. Pick a different host port, or find and stop the conflicting process with lsof -i :PORT .

Cannot remove a network
The network still has containers attached. List them with docker network inspect NAME, disconnect or stop them, and try again.

Service is unreachable from the host after publishing a port
Check that the service inside the container is listening on 0.0.0.0, not only on 127.0.0.1. A service bound to the container loopback interface is not reachable through the published port.

The -p option does not work with host networking
Published ports are ignored when a container uses --network host. The container is already using the host network directly, so it must listen on the desired host port itself.

FAQ

What is the difference between a bridge and a host network?
A bridge network creates an isolated virtual network for containers and requires port publishing to expose services on the host. A host network attaches the container directly to the host network, with no separate container network namespace and no port publishing.

Do containers on the same user-defined bridge network need published ports to talk to each other?
No. Port publishing controls access from the host or external network. Containers on the same user-defined network reach each other directly on the container port.

Can two containers share the same name on different networks?
No. Container names are unique per Docker daemon, regardless of how many networks they are attached to. Network-scoped aliases, set with --network-alias, can overlap across networks.

Why does ping not work from some containers?
Some minimal images do not include ping. Alpine includes it by default, which makes it useful for quick network tests. Other images may require installing the relevant package, or you can use a temporary troubleshooting image.

Conclusion

Docker networking becomes easier to manage when each application gets its own user-defined network and only public-facing services publish ports. For more Docker basics, see the docker run and docker exec guides.

ss Cheatsheet

hello@linuxize.com (Linuxize) — Thu, 21 May 2026 10:00:00 +0200

Basic Syntax

Core ss command forms and output controls.

Command	Description
`ss`	Show non-listening sockets with an established connection
`ss -a`	Show all sockets, listening and non-listening
`ss -n`	Show numeric addresses and ports, no name resolution
`ss -p`	Show the process that owns each socket
`ss -s`	Show a summary of socket counts by type and state

Filter by Protocol

Restrict output to a single socket family.

Command	Description
`ss -t`	TCP sockets
`ss -u`	UDP sockets
`ss -x`	Unix domain sockets
`ss -ta`	All TCP sockets, including listening
`ss -4`	IPv4 sockets only
`ss -6`	IPv6 sockets only

Listening Ports

Find services that are accepting connections.

Command	Description
`ss -l`	Show listening sockets only
`ss -tl`	Listening TCP sockets
`ss -ul`	Listening UDP sockets
`ss -tulpn`	Listening TCP/UDP with process and numeric output
`sudo ss -tlpn 'sport = :80'`	Find the process listening on TCP port 80

Connection State Filters

Narrow output to a specific TCP state.

Command	Description
`ss -tn state ESTABLISHED`	Established TCP connections
`ss -tn state listening`	Listening TCP sockets
`ss -tn state TIME-WAIT`	Connections in `TIME-WAIT`
`ss -tn state CLOSE-WAIT`	Connections in `CLOSE-WAIT`
`ss -tn state ESTABLISHED \| tail -n +2 \| wc -l`	Count established TCP connections

Address and Port Filters

Match sockets by source or destination.

Command	Description
`ss -tnp 'dport = :443'`	Filter by destination port
`ss -tnp 'sport = :22'`	Filter by source port
`ss -tn dst 192.168.1.5`	Filter by remote address
`ss -tn src 192.168.1.10`	Filter by local address
`sudo ss -tlpn sport = :8080`	Find the process listening on port 8080

Process and Statistics

Tie sockets to processes and read summary counts.

Command	Description
`sudo ss -tp`	TCP sockets with process name and PID
`sudo ss -tulpn`	Listening sockets with owning processes
`ss -s`	Total sockets by transport and state
`ss -tn`	TCP sockets with numeric addresses
`ss -tn dst 203.0.113.10`	All connections to a remote host

netstat to ss Translation

Map old netstat commands to their ss equivalents.

netstat Command	ss Command
`netstat -tuln`	`ss -tuln`
`sudo netstat -tulnp`	`sudo ss -tulpn`
`netstat -at`	`ss -ta`
`netstat -ant \| grep ESTABLISHED`	`ss -tn state ESTABLISHED`
`netstat -s`	`ss -s`

Troubleshooting

Common ss issues and quick fixes.

Issue	Check
`-p` shows no process	Run with `sudo` to see sockets owned by other users
Filters return nothing	Quote the expression and verify `sport` versus `dport`
Service names hide ports	Add `-n` to keep numeric ports
Output too broad	Start with `-t`, `-u`, or a `state` filter, then narrow
Port match too broad	Use a built-in filter, such as `ss -tlpn 'sport = :80'`

Use these guides for full walkthroughs and related tools.

Guide	Description
`ss` Command in Linux	Full `ss` guide with examples
`netstat` Command in Linux	The legacy tool `ss` replaces
`ip` Command in Linux	Modern routes and interface management
How to Check Listening Ports in Linux	Compare `ss`, `netstat`, and `lsof`
`lsof` Command in Linux	Tie sockets and files back to processes

How to Install Nginx on Debian 13

hello@linuxize.com (Linuxize) — Wed, 20 May 2026 09:30:00 +0200

Nginx is a fast, lightweight web server that serves static content, terminates TLS, and proxies requests to application servers behind it. Debian 13 Trixie ships Nginx in its main apt repository, which makes the install a single command on a fresh system.

This guide explains how to install Nginx on Debian 13, open the firewall, manage the service with systemd, and create a basic server block for your first site.

Prerequisites

You will need a Debian 13 server with a sudo user. UFW should be installed and active so the install is firewalled by default.

Quick Reference

Task	Command
Install Nginx	`sudo apt install nginx`
Allow HTTP and HTTPS in UFW	`sudo ufw allow 'Nginx Full'`
Start the service	`sudo systemctl start nginx`
Enable on boot	`sudo systemctl enable nginx`
Reload after config change	`sudo systemctl reload nginx`
Test configuration	`sudo nginx -t`
Show service status	`systemctl status nginx`
Site config directory	`/etc/nginx/sites-available/`
Enabled-site symlinks	`/etc/nginx/sites-enabled/`
Default document root	`/var/www/html/`

Step 1: Update the Package Index

Refresh apt so it sees the latest package metadata before the install:

Terminal
sudo apt update

The output lists the repositories that were checked. A clean run finishes without errors.

Step 2: Install Nginx

Install the nginx package:

Terminal
sudo apt install nginx

The default install pulls in the nginx-common package, the systemd unit, and the standard set of modules. apt also creates the www-data user that owns the document root and runs the worker processes.

Confirm the version:

Terminal
nginx -v

output

nginx version: nginx/1.26.3

The exact version may differ as Debian publishes point updates, but 1.26.x is the version that ships with Debian 13 Trixie.

Step 3: Allow HTTP and HTTPS in UFW

The Nginx package registers application profiles with UFW. Allow both HTTP and HTTPS in one rule:

Terminal
sudo ufw allow 'Nginx Full'

Verify the rule is in place:

Terminal
sudo ufw status

output

Status: active
To Action From
-- ------ ----
Nginx Full ALLOW Anywhere
OpenSSH ALLOW Anywhere

If you only need HTTP for now, replace the rule with Nginx HTTP. Switch to Nginx Full later when you add TLS.

Step 4: Manage the Nginx Service with systemd

The Nginx package starts the service at install time and enables it for boot. Confirm both:

Terminal
systemctl is-active nginx
systemctl is-enabled nginx

output

active
enabled

If the service is not running, start it:

Terminal
sudo systemctl start nginx

The most common service operations are restart, reload, and status:

Terminal
sudo systemctl restart nginx
sudo systemctl reload nginx
systemctl status nginx

reload re-reads the configuration without dropping connections and is the right command after editing a server block. restart stops and starts the service, which is only needed when the binary itself changes.

Step 5: Verify the Default Page

Open a browser and visit the server’s IP, or use curl:

Terminal
curl -I http://localhost

output

HTTP/1.1 200 OK
Server: nginx/1.26.3
Content-Type: text/html

A 200 OK response confirms Nginx is serving the default page. The default document root is /var/www/html/ and contains an index.nginx-debian.html welcome page.

Step 6: Create Your First Server Block

Server blocks are how Nginx serves multiple sites from a single host. Create the document root for the new site:

Terminal
sudo mkdir -p /var/www/example.com/html
sudo chown -R $USER:$USER /var/www/example.com/html
echo '<h1>Hello from example.com</h1>' | sudo tee /var/www/example.com/html/index.html

Create a server block file:

Terminal
sudo nano /etc/nginx/sites-available/example.com

Paste the following configuration and adjust the domain name:

/etc/nginx/sites-available/example.comnginx
server {
 listen 80;
 listen [::]:80;

 server_name example.com www.example.com;

 root /var/www/example.com/html;
 index index.html;

 location / {
 try_files $uri $uri/ =404;
 }
}

Enable the site by creating a symlink in sites-enabled:

Terminal
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

Test the configuration before reloading:

Terminal
sudo nginx -t

output

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

Reload Nginx so the new server block takes effect:

Terminal
sudo systemctl reload nginx

Visit the domain to verify the site loads. If the domain does not yet point at the server, edit /etc/hosts on a workstation or use curl --resolve example.com:80:SERVER_IP http://example.com/ to test.

Important Nginx Files and Directories

The default Debian layout splits configuration across several locations:

/etc/nginx/nginx.conf is the main configuration file.
/etc/nginx/sites-available/ holds the server block templates.
/etc/nginx/sites-enabled/ holds symlinks to the active server blocks.
/etc/nginx/snippets/ is for shared configuration snippets such as TLS hardening.
/var/log/nginx/access.log and /var/log/nginx/error.log are the log files.
/var/www/html/ is the default document root.

Troubleshooting

Default page does not load
Check that the service is running with systemctl status nginx. If it is not, run sudo nginx -t to spot configuration errors. UFW may also block port 80; confirm with sudo ufw status.

bind() to 0.0.0.0:80 failed (98: Address already in use)
Another web server is bound to port 80. Apache is the usual culprit on Debian. Stop it with sudo systemctl stop apache2 and disable it on boot with sudo systemctl disable apache2.

Server block returns 404
The symlink in sites-enabled is missing or points to the wrong file. List it with ls -l /etc/nginx/sites-enabled/. Recreate the symlink and reload Nginx.

nginx -t reports duplicate default_server
Two server blocks set listen 80 default_server. Only one can be the default. Remove the keyword from the new server block and reload.

Conclusion

Nginx on Debian 13 is one apt command away. Stick with the Debian package for general-purpose use, and switch to the upstream nginx.org repository when you need a feature only the latest mainline release supports.

How to Install Podman on Ubuntu: Rootless Container Alternative to Docker

hello@linuxize.com (Linuxize) — Tue, 19 May 2026 09:40:00 +0200

Podman is a daemonless container engine that runs OCI containers without a long-lived root process. Each container is started as a regular user-owned process, which removes the privileged daemon that Docker relies on and makes containers safer to run on shared servers. The command-line surface mirrors Docker almost exactly, so most Dockerfiles, image references, and docker run patterns work with little to no change.

This guide explains how to install Podman on Ubuntu, configure rootless mode, run your first container, and use Podman as a drop-in replacement for the Docker CLI.

Quick Reference

For a printable quick reference, see the Podman cheatsheet .

Task	Command
Install Podman	`sudo apt install podman`
Run a container	`podman run -d --name web -p 8080:80 nginx`
List containers	`podman ps -a`
Build an image	`podman build -t myimage .`
List images	`podman images`
Pull an image	`podman pull alpine:latest`
Stop and remove	`podman rm -f web`
Inspect rootless setup	`podman info`

Install Podman

Podman has been part of the Ubuntu universe repository since 20.10, so on every supported release you can install it through apt without adding a third-party PPA.

Update the package index, then install:

Terminal
sudo apt update
sudo apt install podman

Confirm the version:

Terminal
podman --version

output

podman version 5.7.0

Ubuntu 26.04 ships Podman 5.7 from the universe repository. Ubuntu 24.04 ships the 4.9 series, while Ubuntu 22.04 ships the 3.4 series, so the exact version depends on the Ubuntu release you are using.

Verify the Rootless Setup

Podman supports both root and rootless modes, and the rootless mode is the one most users want. Run podman info as your regular user and look for rootless: true:

Terminal
podman info | head -20

output

host:
arch: amd64
cgroupManager: systemd
...
security:
rootless: true

Two pieces have to be in place for rootless containers to work: subordinate UID/GID mappings, and a user namespace. Ubuntu sets both up automatically on first run, but you can confirm with:

Terminal
cat /etc/subuid /etc/subgid

output

sara:100000:65536
sara:100000:65536

Each user gets a range of 65,536 subordinate UIDs and GIDs that Podman uses to map container processes to non-overlapping host IDs. If the file is missing your user, add an entry with sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 sara and run podman system migrate to apply the change.

Run Your First Container

Pull and run an Nginx container in detached mode, exposing port 8080 on the host:

Terminal
podman run -d --name web -p 8080:80 nginx

output

Resolved "nginx" as an alias (/etc/containers/registries.conf.d/shortnames.conf)
Trying to pull docker.io/library/nginx:latest...
Getting image source signatures
Copying blob sha256:...
Writing manifest to image destination
Storing signatures
2b9bd4e1f3...

Check that the container is running:

Terminal
podman ps

output

CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
2b9bd4e1f3a8 docker.io/library/nginx:latest nginx -g daemon o... 10 seconds ago Up 10 seconds 0.0.0.0:8080->80/tcp web

Hit the published port from the host:

Terminal
curl -I http://localhost:8080

output

HTTP/1.1 200 OK
Server: nginx/1.27.4

The response confirms that the user-mode network stack forwarded the request into the container correctly. Stop and remove the container with:

Terminal
podman rm -f web

Configure Registries

By default Podman searches a configured list of registries when you run podman pull nginx (without a registry prefix). The list lives in /etc/containers/registries.conf. To prefer Docker Hub, edit the file:

Terminal
sudo nano /etc/containers/registries.conf

Set the unqualified-search registries:

/etc/containers/registries.conftoml
unqualified-search-registries = ["docker.io", "quay.io"]

Save and exit. From now on podman pull alpine resolves to docker.io/library/alpine:latest, which matches Docker’s default behavior. Save yourself confusion by always pulling with the full reference (podman pull docker.io/library/alpine) in scripts and CI pipelines.

Use Podman as a Docker Replacement

If you already have shell history, Makefiles, or scripts that call docker, install the alias package and keep them working:

Terminal
sudo apt install podman-docker

The package adds a /usr/bin/docker symlink that points to podman, plus a stub that suppresses the daemon-not-running warning. Test it:

Terminal
docker run --rm hello-world

output

Hello from Docker!

Behind the scenes, docker run invoked podman run. Most everyday commands (build, pull, push, images, ps, logs, exec) work identically. The differences show up around Docker Compose and the daemon socket; Podman 4 ships its own socket that Docker Compose can target by setting DOCKER_HOST.

Build an Image with a Dockerfile

Podman builds OCI images from a standard Dockerfile, no changes required. Create a small Flask app to demonstrate:

Terminal
mkdir hello-podman && cd hello-podman
nano app.py

app.pypy
from flask import Flask

app = Flask(__name__)


@app.route("/")
def index():
 return "Hello from Podman!"


if __name__ == "__main__":
 app.run(host="0.0.0.0", port=5000)

Write the Dockerfile:

Dockerfiledockerfile
FROM python:3.12-slim
WORKDIR /app
RUN pip install --no-cache-dir flask
COPY app.py .
EXPOSE 5000
CMD ["python", "app.py"]

Build the image:

Terminal
podman build -t hello-podman .

output

STEP 1/6: FROM python:3.12-slim
STEP 2/6: WORKDIR /app
...
Successfully tagged localhost/hello-podman:latest

Run a container from the new image:

Terminal
podman run -d --name hello -p 5000:5000 hello-podman
curl http://localhost:5000

output

Hello from Podman!

The image and container both live in the user’s storage (~/.local/share/containers), so no sudo is involved at any step.

Run Pods of Containers

The name “Podman” comes from its support for Kubernetes-style pods: groups of containers that share a network namespace. Create an empty pod, then add containers to it:

Terminal
podman pod create --name webapp -p 8080:80
podman run -d --pod webapp --name redis redis:7
podman run -d --pod webapp --name nginx nginx

Inside the pod, nginx can reach Redis at localhost:6379 because they share the network namespace. List pods with:

Terminal
podman pod ps

output

POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS
8f4d7b8c0e1f webapp Running 20 seconds ago c2a8f9b1d3e4 3

The count of three includes an infra container that holds the shared namespaces.

Run Podman as a systemd Service

To start a container at boot in rootless mode, use a Quadlet container unit. Quadlet is Podman’s current systemd integration method and keeps the container definition in a small, readable file.

Terminal
mkdir -p ~/.config/containers/systemd
nano ~/.config/containers/systemd/web.container

Add the container definition:

~/.config/containers/systemd/web.containerini
[Unit]
Description=Rootless Nginx container

[Container]
Image=docker.io/library/nginx:latest
ContainerName=web
PublishPort=8080:80

[Service]
Restart=always

[Install]
WantedBy=default.target

Reload the user systemd manager, then start the generated service:

Terminal
systemctl --user daemon-reload
systemctl --user start web.service

Enable lingering so the user services keep running after logout:

Terminal
sudo loginctl enable-linger sara

The [Install] section tells the Podman systemd generator to attach the service to the user’s default target. The container now starts without root or a system-wide daemon.

Troubleshooting

Error: short-name "nginx" did not resolve to an alias
The unqualified-search-registries list is empty. Edit /etc/containers/registries.conf and add at least docker.io, or pull with the full reference (podman pull docker.io/library/nginx).

ERRO[0000] cannot find UID/GID for user
The current user has no entry in /etc/subuid or /etc/subgid. Run sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER, then podman system migrate.

Ports under 1024 refuse to bind in rootless mode
The kernel restricts low ports for non-root users. Either publish to a high port (-p 8080:80), or allow your user to bind low ports with sudo sysctl net.ipv4.ip_unprivileged_port_start=80.

FAQ

Is Podman a drop-in Docker replacement?
For everyday run, build, pull, push, and exec workflows, yes. Compose and the long-lived socket need extra setup. Most CI jobs only need the CLI and switch over without changes.

Does Podman work with Docker Compose?
Yes. Start the Podman socket with systemctl --user enable --now podman.socket, export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock, and run docker compose up.

Are Podman images compatible with Docker?
Yes. Both produce OCI-compliant images, so an image built with podman build runs unchanged under Docker, and vice versa.

Conclusion

Podman gives you the Docker workflow without the daemon and without root, which is often what you want on a multi-user server or a developer workstation. Install it from apt, alias docker if you have existing scripts, and the rest of the CLI feels familiar.

For follow-up reading, see our guides on installing Docker on Ubuntu 26.04 and building Docker images with a Dockerfile .

Bash String Manipulation: Substring, Replace, Length, and More

hello@linuxize.com (Linuxize) — Mon, 18 May 2026 10:30:00 +0200

When you write Bash scripts, many small text tasks do not need sed, awk, or another external command. Parameter expansion can extract part of a string, replace text, strip a prefix, or change case directly inside ${}.

This guide covers the most useful string operations with practical examples for each one.

String Length

Get the number of characters in a variable using ${#variable}:

Terminal
filename="backup-2026-04-14.tar.gz"
echo "${#filename}"

output

This returns the character count. For strings that contain only ASCII characters, the character count and byte count are the same.

Extracting a Substring

Use ${variable:offset:length} to extract part of a string:

Terminal
str="Hello, World"
echo "${str:7:5}"

output

World

The offset is zero-based, so 7 starts at the eighth character. 5 is how many characters to return.

Omit the length to extract from the offset to the end of the string:

Terminal
echo "${str:7}"

output

World

Negative offsets count from the end of the string. Note the space before the minus sign; it is required to avoid being interpreted as the :- default value syntax:

Terminal
echo "${str: -5}"

output

World

Replacing a Substring

Use ${variable/pattern/replacement} to replace the first match of a pattern:

Terminal
path="/var/log/app/error.log"
echo "${path/log/logs}"

output

/var/logs/app/error.log

Only the first occurrence is replaced. To replace every occurrence, double the forward slash:

Terminal
echo "${path//log/logs}"

output

/var/logs/app/error.logs

Leave the replacement empty to delete a substring:

Terminal
version="v1.2.3"
echo "${version/v/}"

output

1.2.3

The pattern supports glob characters: * matches any sequence of characters, ? matches a single character, and [...] matches a character class.

Removing a Prefix

Use # to remove a prefix from the beginning of a string. The shortest matching prefix is removed:

Terminal
file="photo.backup.tar.gz"
echo "${file#*.}"

output

backup.tar.gz

Use ## to remove the longest possible matching prefix:

Terminal
echo "${file##*.}"

output

gz

A common use is stripping a directory path to get just the filename:

Terminal
filepath="/home/user/documents/report.pdf"
echo "${filepath##*/}"

output

report.pdf

Removing a Suffix

Use % to strip a suffix from the end of a string. The shortest match is removed:

Terminal
file="photo.backup.tar.gz"
echo "${file%.*}"

output

photo.backup.tar

Use %% for the longest match:

Terminal
echo "${file%%.*}"

output

photo

Combining prefix and suffix removal is a clean way to extract a bare filename from a path:

Terminal
filepath="/home/user/documents/report.pdf"
base="${filepath##*/}"
name="${base%.*}"
echo "$name"

output

report

Changing Case

Convert a string to uppercase with ^^:

Terminal
greeting="hello, world"
echo "${greeting^^}"

output

HELLO, WORLD

Convert to lowercase with ,,:

Terminal
input="Hello World"
echo "${input,,}"

output

hello world

To capitalize only the first character, use a single ^:

Terminal
word="linux"
echo "${word^}"

output

Linux

To lowercase only the first character, use a single ,:

Terminal
word="LINUX"
echo "${word,}"

output

lINUX

Case conversion requires Bash 4.0 or newer. The default shell on older macOS systems ships with Bash 3.2 and does not support these operators. As a portable alternative, use tr:

Terminal
echo "$greeting" | tr '[:lower:]' '[:upper:]'

Checking if a String Contains a Substring

Use a glob pattern inside [[ ]] to test whether a string contains another string:

Terminal
str="Running on Linux kernel 6.8"
if [[ "$str" == *"Linux"* ]]; then
 echo "Linux detected"
fi

output

Linux detected

The * wildcards match anything before and after the search pattern. The comparison is case-sensitive. To check case-insensitively, convert both sides to the same case first using ,, before comparing.

For a more detailed walkthrough of substring detection, including case-insensitive matching and edge cases, see How to Check if a String Contains a Substring in Bash . For more on [[ ]] conditionals and string comparison operators, see the guide on Bash comparison operators .

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Operation	Syntax
String length	`${#var}`
Substring from offset	`${var:offset}`
Substring with length	`${var:offset:length}`
Replace first match	`${var/pattern/replacement}`
Replace all matches	`${var//pattern/replacement}`
Delete substring	`${var/pattern/}`
Remove shortest prefix	`${var#pattern}`
Remove longest prefix	`${var##pattern}`
Remove shortest suffix	`${var%pattern}`
Remove longest suffix	`${var%%pattern}`
Uppercase all	`${var^^}`
Lowercase all	`${var,,}`
Uppercase first char	`${var^}`
Lowercase first char	`${var,}`

Conclusion

Bash parameter expansion handles most day-to-day string operations without extra commands, which keeps scripts shorter and faster. For more on working with strings, see the guides on Bash string concatenation and splitting strings by delimiter .

nmcli Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 17 May 2026 10:40:00 +0200

Basic Syntax

Use this structure for most nmcli commands.

Command	Description
`nmcli [OPTIONS] OBJECT COMMAND`	General command syntax
`nmcli OBJECT help`	Show help for an object
`nmcli --version`	Show nmcli version
`nmcli -t ...`	Use terse output for scripts
`nmcli -f FIELD1,FIELD2 ...`	Select output fields
`nmcli -g FIELD ...`	Print field values only

General Status

Check NetworkManager state and hostname settings.

Command	Description
`nmcli general status`	Show overall NetworkManager status
`nmcli networking connectivity`	Check internet connectivity state
`nmcli general hostname`	Show system hostname
`sudo nmcli general hostname server01`	Set system hostname
`nmcli general permissions`	Show NetworkManager permissions
`nmcli general logging`	Show logging level and domains

Devices

Inspect and control network interfaces.

Command	Description
`nmcli device status`	List devices and connection state
`nmcli device show eth0`	Show detailed device properties
`nmcli -f GENERAL,IP4 device show eth0`	Show selected device sections
`sudo nmcli device connect eth0`	Connect a device
`sudo nmcli device disconnect eth0`	Disconnect a device
`nmcli device reapply eth0`	Reapply active profile settings

Connection Profiles

Manage saved NetworkManager profiles.

Command	Description
`nmcli connection show`	List all profiles
`nmcli connection show --active`	List active profiles
`nmcli connection show "home-wifi"`	Show one profile
`sudo nmcli connection up "home-wifi"`	Activate a profile
`sudo nmcli connection down "home-wifi"`	Deactivate a profile
`sudo nmcli connection delete "home-wifi"`	Delete a saved profile

Wi-Fi

Scan networks and connect to wireless profiles.

Command	Description
`nmcli radio wifi`	Show Wi-Fi radio state
`sudo nmcli radio wifi on`	Turn Wi-Fi on
`sudo nmcli radio wifi off`	Turn Wi-Fi off
`nmcli device wifi list`	Scan visible Wi-Fi networks
`sudo nmcli device wifi connect "SSID" password "PASSWORD"`	Connect with password
`sudo nmcli --ask device wifi connect "SSID"`	Prompt for Wi-Fi password
`sudo nmcli device wifi connect "SSID" password "PASSWORD" hidden yes`	Connect to hidden network

Static IPv4

Set or remove manual IPv4 settings on a profile.

Command	Description
`sudo nmcli connection modify "Wired connection 1" ipv4.method manual`	Use manual IPv4
`sudo nmcli connection modify "Wired connection 1" ipv4.addresses 192.168.1.50/24`	Set static address
`sudo nmcli connection modify "Wired connection 1" ipv4.gateway 192.168.1.1`	Set gateway
`sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 9.9.9.9"`	Set DNS servers
`sudo nmcli connection up "Wired connection 1"`	Apply profile changes
`nmcli -g IP4.ADDRESS,IP4.GATEWAY connection show "Wired connection 1"`	Check IPv4 settings

DHCP and DNS

Return to DHCP or adjust DNS servers.

Command	Description
`sudo nmcli connection modify "Wired connection 1" ipv4.method auto`	Use DHCP for IPv4
`sudo nmcli connection modify "Wired connection 1" ipv4.addresses ""`	Clear static address
`sudo nmcli connection modify "Wired connection 1" ipv4.gateway ""`	Clear static gateway
`sudo nmcli connection modify "Wired connection 1" ipv4.dns ""`	Clear static DNS
`sudo nmcli connection modify "Wired connection 1" +ipv4.dns 8.8.8.8`	Append DNS server
`sudo nmcli connection modify "Wired connection 1" -ipv4.dns 8.8.8.8`	Remove DNS server

Add Profiles

Create new wired and wireless profiles.

Command	Description
`sudo nmcli connection add type ethernet ifname eth0 con-name "wired-dhcp"`	Add wired DHCP profile
`sudo nmcli connection add type ethernet ifname eth0 con-name "wired-static" ip4 192.168.1.50/24 gw4 192.168.1.1`	Add wired static profile
`sudo nmcli connection add type wifi ifname wlan0 con-name "office-wifi" ssid "Office"`	Add Wi-Fi profile
`sudo nmcli connection modify "office-wifi" wifi-sec.key-mgmt wpa-psk`	Set WPA-PSK security
`sudo nmcli connection modify "office-wifi" wifi-sec.psk "PASSWORD"`	Set Wi-Fi password
`sudo nmcli connection up "wired-static"`	Activate new profile

Scripting Output

Use stable output formats in scripts.

Command	Description
`nmcli -t connection show --active`	Terse active profile list
`nmcli -t -f NAME,DEVICE connection show --active`	Active names and devices
`nmcli -g GENERAL.STATE device show eth0`	Print device state value
`nmcli -g IP4.ADDRESS device show eth0`	Print IPv4 address values
`nmcli -f DEVICE,TYPE,STATE device status`	Select device status fields
`nmcli -m multiline connection show "home-wifi"`	Multiline profile details

Monitor and Reload

Watch changes and reload profile files.

Command	Description
`nmcli monitor`	Watch NetworkManager events
`nmcli device monitor eth0`	Watch one device
`sudo nmcli connection reload`	Reload profile files from disk
`sudo nmcli general reload`	Reload NetworkManager configuration
`sudo nmcli general reload dns-rc`	Rewrite DNS resolver configuration
`journalctl -u NetworkManager -n 100`	Show recent NetworkManager logs

Troubleshooting

Fast checks for common NetworkManager issues.

Issue	Check
NetworkManager is not running	`sudo systemctl start NetworkManager`
Wi-Fi list is empty	`sudo nmcli radio wifi on` and `rfkill list`
Wrong profile is active	`nmcli connection show --active`
Static IP did not apply	`sudo nmcli connection up "PROFILE"`
DNS is not working	`nmcli -g IP4.DNS device show eth0`
Permission denied	Run the command with `sudo`

Use these articles for detailed networking workflows.

Guide	Description
`nmcli Command in Linux`	Complete `nmcli` command guide
`Linux ip Command with Examples`	Interface, address, and route management
`How to Configure Static IP Address on Ubuntu`	Netplan and desktop static IP setup
`How to Use the dig Command`	DNS lookup and troubleshooting
`SSH Command in Linux`	Remote shell access and options

nmcli Command in Linux: NetworkManager CLI Reference

hello@linuxize.com (Linuxize) — Sun, 17 May 2026 09:15:00 +0200

When a Linux system needs a network change from a terminal, nmcli is usually the cleanest way to make it. It controls NetworkManager, the service that handles wired, wireless, VPN, and other connection profiles on many Linux desktops and servers.

This guide explains how to inspect device status, list and edit connections, join Wi-Fi networks, assign a static IP address, and get script-friendly output with nmcli.

Before You Begin

Before changing network settings, confirm that NetworkManager is installed and running:

Terminal
systemctl status NetworkManager

On distributions that use a different network stack, install NetworkManager from the package manager and enable the service before continuing. Most Ubuntu, Fedora, and Arch desktops have it preinstalled.

If you are connected over SSH , be careful with commands that disconnect an interface, change an address, or bring a profile down. A wrong gateway, IP address, or device name can drop the remote session.

nmcli Syntax

The general nmcli syntax is:

txt
nmcli [OPTIONS] OBJECT { COMMAND | help }

OBJECT is the part of NetworkManager you want to inspect or change. The most common objects are:

general - show overall NetworkManager status and hostname settings
networking - enable, disable, or check networking
radio - control Wi-Fi and WWAN radio switches
device - show and manage network interfaces
connection - show and manage saved connection profiles
monitor - watch NetworkManager events in real time

You can abbreviate most objects, for example nmcli con show instead of nmcli connection show, but the full form is clearer in scripts and documentation.

Show General Status

The general subcommand reports the overall NetworkManager state, the hostname, and whether networking is enabled:

Terminal
nmcli general status

output

STATE CONNECTIVITY WIFI-HW WIFI WWAN-HW WWAN
connected full enabled enabled enabled enabled

Read or change the system hostname through the same subcommand:

Terminal
nmcli general hostname
sudo nmcli general hostname server01

The second form writes the new hostname to /etc/hostname and updates the kernel value without a reboot. For more hostname options, see the guide on changing the hostname in Linux .

Manage Devices

A device in NetworkManager is a physical or virtual interface, for example eth0, wlan0, or wg0. List every known device with:

Terminal
nmcli device status

output

DEVICE TYPE STATE CONNECTION
eth0 ethernet connected Wired connection 1
wlan0 wifi connected home-wifi
lo loopback unmanaged --

Show detailed properties of a single device, including the MAC address, driver, and current IP configuration:

Terminal
nmcli device show eth0

Bring an interface up or down without changing the underlying connection profile:

Terminal
sudo nmcli device connect eth0
sudo nmcli device disconnect eth0

disconnect stops the connection but keeps the profile available for the next connect call. Do not disconnect the device that carries your current SSH session unless you have another access path.

Manage Connection Profiles

NetworkManager stores each network as a connection profile under /etc/NetworkManager/system-connections/. List every profile:

Terminal
nmcli connection show

output

NAME UUID TYPE DEVICE
Wired connection 1 3f4e... ethernet eth0
home-wifi 7a92... wifi wlan0

Activate a saved profile by name:

Terminal
sudo nmcli connection up "home-wifi"

Deactivate it without deleting the profile:

Terminal
sudo nmcli connection down "home-wifi"

Delete a profile when it is no longer needed:

Terminal
sudo nmcli connection delete "home-wifi"

Deleting a profile removes the saved NetworkManager configuration. If you only want to stop using it for the moment, bring it down instead.

Connect to a Wi-Fi Network

Scan for available networks. The radio must be on for the scan to return results:

Terminal
nmcli device wifi list

Join an open or WPA2 network in one call. NetworkManager creates a new profile and stores the password in the system keyring:

Terminal
sudo nmcli device wifi connect "home-wifi" password "secret-passphrase"

Avoid putting real Wi-Fi passwords in shell history, shared scripts, or configuration repositories. For interactive use, run sudo nmcli --ask device wifi connect "home-wifi" so nmcli prompts for the password instead.

For hidden networks, add the hidden yes flag so NetworkManager probes the SSID directly:

Terminal
sudo nmcli device wifi connect "office-hidden" password "secret-passphrase" hidden yes

Turn the radio on or off without removing saved profiles:

Terminal
sudo nmcli radio wifi off
sudo nmcli radio wifi on

Configure a Static IP Address

Static addressing is one of the most common scripted changes on a server. The example below sets a static IPv4 address, gateway, and DNS servers on the existing Wired connection 1 profile:

Terminal
sudo nmcli connection modify "Wired connection 1" \
 ipv4.method manual \
 ipv4.addresses 192.168.1.50/24 \
 ipv4.gateway 192.168.1.1 \
 ipv4.dns "1.1.1.1 9.9.9.9"

Apply the change by reactivating the profile:

Terminal
sudo nmcli connection up "Wired connection 1"

If you are changing a remote machine, confirm the address, prefix, gateway, and DNS values before running connection up. A wrong value can make the host unreachable. On Ubuntu systems that use Netplan instead, see the guide on configuring a static IP address on Ubuntu .

Switch back to DHCP at any point with:

Terminal
sudo nmcli connection modify "Wired connection 1" \
 ipv4.method auto \
 ipv4.addresses "" \
 ipv4.gateway "" \
 ipv4.dns ""
sudo nmcli connection up "Wired connection 1"

The empty values clear the manual entries that would otherwise stay on the profile.

Add a New Wired Connection

When the default profile is missing or has been deleted, create a fresh ethernet profile:

Terminal
sudo nmcli connection add type ethernet ifname eth0 con-name "wired-static" \
 ipv4.method manual \
 ipv4.addresses 192.168.1.50/24 \
 ipv4.gateway 192.168.1.1 \
 ipv4.dns 1.1.1.1
sudo nmcli connection up "wired-static"

This pattern works well in provisioning scripts when you first check whether the profile exists, or when you intentionally replace a known profile. If you only need to change an existing profile, use connection modify instead of deleting and recreating it.

Set DNS Servers

You can change DNS servers without changing the IP address method. For example, to set Cloudflare and Quad9 DNS on a wired profile:

Terminal
sudo nmcli connection modify "Wired connection 1" ipv4.dns "1.1.1.1 9.9.9.9"
sudo nmcli connection up "Wired connection 1"

To append another DNS server instead of replacing the whole list, prefix the property with +:

Terminal
sudo nmcli connection modify "Wired connection 1" +ipv4.dns 8.8.8.8

After changing DNS, verify name resolution with a lookup tool such as dig or nslookup .

Common Examples

Show only the active connections in a parseable format. The -t flag enables terse output and -f selects fields:

Terminal
nmcli -t -f NAME,DEVICE connection show --active

Watch interface events in real time, useful when a connection drops during a remote session:

Terminal
nmcli monitor

Reload all profile files from disk after editing them by hand:

Terminal
sudo nmcli connection reload

For low-level interface and route inspection outside NetworkManager, pair nmcli with the ip command .

Quick Reference

For a printable quick reference, see the nmcli cheatsheet .

Task	Command
Show overall status	`nmcli general status`
Show syntax help	`nmcli OBJECT help`
List devices	`nmcli device status`
List connection profiles	`nmcli connection show`
Activate a profile	`sudo nmcli connection up <name>`
Deactivate a profile	`sudo nmcli connection down <name>`
Scan Wi-Fi networks	`nmcli device wifi list`
Join a Wi-Fi network	`sudo nmcli device wifi connect <ssid> password <pwd>`
Prompt for Wi-Fi password	`sudo nmcli --ask device wifi connect <ssid>`
Set static IPv4	`sudo nmcli connection modify <name> ipv4.method manual ipv4.addresses <ip/cidr>`
Set DNS servers	`sudo nmcli connection modify <name> ipv4.dns "<a> <b>"`
Switch back to DHCP	`sudo nmcli connection modify <name> ipv4.method auto ipv4.addresses "" ipv4.gateway "" ipv4.dns ""`
Reload profile files	`sudo nmcli connection reload`
Watch events	`nmcli monitor`

Troubleshooting

Error: NetworkManager is not running
Start the service with sudo systemctl start NetworkManager and enable it at boot with sudo systemctl enable NetworkManager. On a fresh server install, the package may not be present yet.

Wi-Fi list is empty after nmcli device wifi list
The radio is most likely off. Run sudo nmcli radio wifi on, and check that no rfkill switch is blocking the device with rfkill list.

A new static IP does not take effect
NetworkManager applies the change only after the connection is reactivated. Run sudo nmcli connection up <name> after connection modify. If a stale DHCP lease is still in place, run sudo nmcli connection down <name> first.

Not authorized to control networking
The operation requires administrator privileges or a PolicyKit rule that allows the current user. Run the command with sudo, or ask the system administrator to grant the needed NetworkManager permissions.

A profile keeps reverting to DHCP after reboot
A second profile or a cloud-init configuration may be overwriting it. Check /etc/NetworkManager/system-connections/ and /etc/netplan/ for conflicting files.

Conclusion

nmcli gives you a scriptable way to inspect NetworkManager state, activate profiles, join Wi-Fi networks, and make persistent IP and DNS changes. For deeper network troubleshooting, use it alongside ip, ss, dig, and the system logs so you can see both the saved profile and the live kernel state.

timedatectl Command in Linux: Manage Time, Date, and Time Zone

hello@linuxize.com (Linuxize) — Sat, 16 May 2026 09:20:00 +0200

Wrong system time can break TLS checks, make cron jobs run at the wrong hour, and leave logs with misleading timestamps. On systemd-based Linux systems, timedatectl is the standard tool for checking and changing time settings.

timedatectl is part of systemd and is available on most systemd-based distributions. It handles time zones, NTP synchronization, RTC settings, and manual time adjustments from the command line. This guide explains how to use it with practical examples.

Syntax

txt
timedatectl [OPTIONS] COMMAND

When called without any arguments, timedatectl shows the current status, which is the same as running timedatectl status.

Check Current Time and Date

Run timedatectl with no arguments to see the full time status:

Terminal
timedatectl

output

 Local time: Tue 2026-04-14 12:00:00 CEST
Universal time: Tue 2026-04-14 10:00:00 UTC
RTC time: Tue 2026-04-14 10:00:00
Time zone: Europe/Berlin (CEST, +0200)
System clock synchronized: yes
NTP service: active
RTC in local TZ: no

The output shows the local time in your configured time zone, the same moment in UTC, and the hardware clock (RTC) time. System clock synchronized: yes means NTP has synced the clock recently. NTP service: active means systemd-timesyncd (or another NTP daemon) is running and managing synchronization.

If RTC in local TZ shows yes, the hardware clock is set to local time rather than UTC. Most Linux systems keep the hardware clock in UTC, which avoids daylight saving time complications when rebooting.

Set the Time Zone

To set the system time zone, use set-timezone followed by a time zone identifier:

Terminal
sudo timedatectl set-timezone America/New_York

After running this, timedatectl shows the new time zone immediately. The change persists across reboots.

If you do not know the exact time zone identifier, use list-timezones:

Terminal
timedatectl list-timezones

The list is long, so pipe it through grep to filter by region:

Terminal
timedatectl list-timezones | grep America

output

America/Adak
America/Anchorage
America/Anguilla
America/Antigua
America/Araguaina
America/Argentina/Buenos_Aires
...
America/New_York
...

Time zone identifiers follow the Region/City format, such as Europe/Paris, Asia/Tokyo, or Australia/Sydney. For a step-by-step walkthrough, see the guide on how to set or change the time zone in Linux .

Enable and Disable NTP Synchronization

NTP (Network Time Protocol) keeps the system clock accurate by periodically syncing it against internet time servers. timedatectl can enable or disable NTP management:

Terminal
sudo timedatectl set-ntp true

Terminal
sudo timedatectl set-ntp false

After enabling NTP, run timedatectl to confirm NTP service: active appears in the output.

Turn off NTP before setting the time manually. If NTP is active, timedatectl rejects direct clock changes.

Set the Time and Date Manually

To set the clock manually, you must first disable NTP synchronization:

Terminal
sudo timedatectl set-ntp false

Then set the time and date using the set-time subcommand. You can provide a full timestamp:

Terminal
sudo timedatectl set-time '2026-04-15 14:30:00'

To set only the time and keep the current date:

Terminal
sudo timedatectl set-time '14:30:00'

To set only the date and keep the current time:

Terminal
sudo timedatectl set-time '2026-04-15'

After setting the time, you can re-enable NTP to let the system sync automatically afterward:

Terminal
sudo timedatectl set-ntp true

Set the Hardware Clock Mode

The RTC, or hardware clock, can store time in UTC or in local time. Linux systems should normally keep the RTC in UTC because it avoids daylight saving time issues and works better on servers.

To make sure the hardware clock uses UTC, run:

Terminal
sudo timedatectl set-local-rtc 0

If you dual-boot with an operating system that expects the hardware clock to use local time, you can switch the RTC to local time:

Terminal
sudo timedatectl set-local-rtc 1

After changing the RTC mode, run timedatectl again and check the RTC in local TZ line. Use local RTC only when another operating system on the same machine requires it.

Check NTP Synchronization Status

For more detail about the NTP sync, use timesync-status. This subcommand is provided by systemd-timesyncd and shows the current server, offset, and polling interval:

Terminal
timedatectl timesync-status

output

 Server: 185.125.190.56 (ntp.ubuntu.com)
Poll interval: 34min 8s (min: 32s; max 34min 8s)
Leap: normal
Version: 4
Stratum: 2
Reference: 17.253.52.253
Precision: 1us (-19)
Root distance: 19.455ms (max: 5s)
Offset: -2.408ms
Delay: 29.124ms
Jitter: 5.716ms
Packet count: 5

Offset is how far your system clock drifted before the last sync. A small offset, under a few hundred milliseconds, is normal. A large offset can point to network problems or a misconfigured time source.

timesync-status only works when systemd-timesyncd is handling NTP. If your system uses a different NTP daemon such as chrony or ntpd, check its own status commands instead.

Machine-Parseable Output

The show subcommand prints the same information as status in a key-value format that is easier to parse in scripts:

Terminal
timedatectl show

output

Timezone=Europe/Berlin
LocalRTC=no
CanNTP=yes
NTP=yes
NTPSynchronized=yes
TimeUSec=Tue 2026-04-14 10:00:00 UTC
RTCTimeUSec=Tue 2026-04-14 10:00:00 UTC

Pass --property to extract a single value:

Terminal
timedatectl show --property=Timezone --value

output

Europe/Berlin

This is useful in automation and configuration management scripts where you need to check the current time zone without parsing the human-readable status output.

For timesync details in key-value format, use show-timesync:

Terminal
timedatectl show-timesync

This gives scripts access to systemd-timesyncd properties such as the current server name, poll interval, and root distance.

timedatectl Options

--no-ask-password - Do not prompt for authentication; use the invoking user’s credentials
--adjust-system-clock - When setting the RTC, also adjust the system clock accordingly
--no-pager - Print output without piping through a pager
-p NAME, --property=NAME - Show one named property from show output
-H ADDR, --host=ADDR - Execute the command on a remote host over SSH
-M MACHINE, --machine=MACHINE - Execute the command inside a local container

Quick Reference

For a printable quick reference, see the timedatectl cheatsheet .

Command	Description
`timedatectl`	Show current time, time zone, and NTP status
`timedatectl show`	Show status in key-value format (script-friendly)
`timedatectl list-timezones`	List all available time zone identifiers
`sudo timedatectl set-timezone TZ`	Set the time zone (e.g., `America/New_York`)
`sudo timedatectl set-ntp true`	Enable NTP synchronization
`sudo timedatectl set-ntp false`	Disable NTP synchronization
`sudo timedatectl set-time 'YYYY-MM-DD HH:MM:SS'`	Set time and date manually (NTP must be off)
`sudo timedatectl set-local-rtc 0`	Store the hardware clock in UTC
`timedatectl timesync-status`	Show NTP sync detail from systemd-timesyncd
`timedatectl show-timesync`	Show NTP sync detail in key-value format
`timedatectl show --property=Timezone --value`	Print the current time zone name only

Troubleshooting

Failed to set time: Automatic time synchronization is enabled
NTP is active and has locked the clock. Disable NTP first with sudo timedatectl set-ntp false, then run your set-time command.

Failed to set time: Access denied
You need administrator privileges. Prepend sudo to the command.

Failed to connect to bus: No such file or directory
timedatectl communicates with systemd-logind over D-Bus. This error usually appears in minimal containers or chroot environments where systemd is not running. In those cases, set the time directly with the date command: sudo date -s '2026-04-15 14:30:00'.

timesync-status returns Failed to query server: Unit dbus-org.freedesktop.timesync1.service not found
systemd-timesyncd is not installed or not running. If your system uses chrony or ntpd instead, check their status with chronyc tracking or ntpq -p.

FAQ

What is the difference between timedatectl and the date command?
date reads and formats timestamps, and it can set the system clock with sudo date -s. timedatectl is the systemd tool that also manages time zones, the RTC, and NTP synchronization. On systemd-based systems, use timedatectl for time configuration and date for formatting timestamps.

Does timedatectl work on non-systemd distributions?
No. timedatectl is part of systemd and requires systemd-logind and D-Bus to be running. On systems without systemd (such as Alpine Linux with OpenRC), use the date command and edit /etc/localtime or /etc/timezone directly.

How do I check which NTP servers the system is using?
Run timedatectl timesync-status to see the current NTP server. To see the full list of configured servers, check /etc/systemd/timesyncd.conf. The NTP= and FallbackNTP= lines list the configured time servers.

How do I view historical time changes in system logs?
timedatectl itself does not keep a history, but the system journal does. Search for time-related events with:

Terminal
journalctl -u systemd-timesyncd

For more on reading system logs, see the journalctl guide .

Conclusion

For day-to-day administration, timedatectl is usually enough to check the current time settings, switch time zones, toggle NTP, and inspect RTC behavior. If you need distribution-specific time zone steps, see the guide on how to set or change the time zone in Linux .

How to Check CPU Usage in Linux

hello@linuxize.com (Linuxize) — Fri, 15 May 2026 09:40:00 +0200

A Linux server tells you what its CPUs are doing through several built-in tools, each with a different angle. top and htop show the live picture. mpstat, vmstat, and sar from the sysstat package report numeric samples that suit scripts and dashboards. ps attributes usage to specific processes, and uptime summarizes the load over the last fifteen minutes.

This guide explains how to read CPU usage from each of those tools, which one to reach for in which situation, and how to interpret common output fields.

Quick Reference

Tool	Best for	Command
`top`	Live snapshot, sort by CPU	`top`
`htop`	Interactive, per-core view	`htop`
`mpstat`	Per-core sampling for scripts	`mpstat -P ALL 1 5`
`vmstat`	System-wide CPU and memory	`vmstat -y 1 5`
`sar`	Current or saved CPU samples	`sar -u 1 5`
`ps`	Per-process attribution	`ps -eo pid,user,%cpu,comm --sort=-%cpu \| head`
`uptime`	Load average summary	`uptime`
`nproc`	Logical core count	`nproc`
`lscpu`	CPU topology details	`lscpu`

Method 1: top

The top command is available on most Linux systems without any extra packages. Run it without arguments to open the live view:

Terminal
top

The header summarizes the CPU lines:

output

%Cpu(s): 4.2 us, 1.3 sy, 0.0 ni, 93.8 id, 0.5 wa, 0.0 hi, 0.2 si, 0.0 st

The fields tell you where CPU time goes. us is user-space code, sy is kernel code, id is idle, wa is time waiting for I/O, and st is time stolen by the hypervisor on a virtual machine. A high wa value points at slow disks rather than a CPU bottleneck.

Press 1 while top is open to switch from the aggregate line to one row per logical CPU. Press P to sort processes by CPU usage, M to sort by memory, and q to quit.

Method 2: htop

htop is an interactive replacement for top. It is available in the default repositories of most Linux distributions, but it may not be installed by default.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install htop

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install htop

Run it the same way:

Terminal
htop

htop shows a colored bar per CPU at the top, a memory and swap bar, and a sortable process table below. Click a column header or use the function keys to sort. Search for a process with F3, filter with F4, and send a signal to a selected process with F9.

Method 3: mpstat

mpstat is part of the sysstat package and is the right tool when you need numeric CPU samples per core. Install it once before using mpstat or sar.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install sysstat

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install sysstat

Sample all cores at one-second intervals five times:

Terminal
mpstat -P ALL 1 5

output

03:14:00 PM CPU %usr %nice %sys %iowait %irq %soft %steal %guest %gnice %idle
03:14:01 PM all 3.27 0.00 0.75 0.00 0.00 0.00 0.00 0.00 0.00 95.98
03:14:01 PM 0 4.95 0.00 0.99 0.00 0.00 0.00 0.00 0.00 0.00 94.06
03:14:01 PM 1 1.00 0.00 1.00 0.00 0.00 0.00 0.00 0.00 0.00 98.00

The all row is the aggregate. Each numbered row is a single logical CPU. Use this output when one core is pinned at 100 percent and the others are idle, which can happen when an application is single-threaded.

Method 4: vmstat

vmstat is part of procps and combines CPU usage with memory, swap, and I/O. The first report normally shows averages since boot, so use -y when you want only interval samples. The columns at the right are the CPU summary:

Terminal
vmstat -y 1 5

output

procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
0 0 0 7430080 311288 1843264 0 0 8 18 148 263 3 1 96 0 0
0 0 0 7430080 311288 1843264 0 0 0 0 127 226 1 0 99 0 0

r is the run queue length, which is how many processes are ready to use a CPU. A run queue consistently larger than the number of CPUs is a sign of CPU pressure. The cpu columns mirror the meaning of the top header.

Method 5: sar

sar, also from sysstat, can print current samples and read saved activity logs. On Ubuntu and Debian, enable history collection after installing sysstat:

Terminal
sudo sed -i 's/^ENABLED="false"/ENABLED="true"/' /etc/default/sysstat
sudo systemctl enable --now sysstat

The collector setup differs between distributions. If sar shows no saved history, check your distribution’s sysstat service or timer configuration.

Show current CPU samples:

Terminal
sar -u 1 5

output

03:15:01 PM CPU %user %nice %system %iowait %steal %idle
03:15:02 PM all 2.34 0.00 0.71 0.05 0.00 96.90
03:15:03 PM all 2.18 0.00 0.69 0.04 0.00 97.09

Each row is a sample interval. Combine with -f to read an older log, for example sar -u -f /var/log/sysstat/sa10 for the tenth of the month on systems that store logs in /var/log/sysstat/. This is the right tool when you need to confirm that a slowdown reported yesterday lined up with a CPU spike.

Method 6: ps

The ps command lists every process and lets you sort by CPU percentage. The pattern most admins reach for is:

Terminal
ps -eo pid,user,%cpu,%mem,comm --sort=-%cpu | head

output

 PID USER %CPU %MEM COMMAND
1437 dejan 23.5 4.2 firefox
2049 dejan 11.2 2.8 node
1102 root 4.7 0.9 systemd-journal

The output is a snapshot at the moment ps ran. The %CPU value is the average CPU usage over the lifetime of the process, not an instantaneous reading. For a live view, repeat the command with watch:

Terminal
watch -n 2 'ps -eo pid,user,%cpu,%mem,comm --sort=-%cpu | head'

watch reruns the command every two seconds, which gives you a refreshing top-five view without leaving the shell.

Method 7: uptime and Load Averages

The uptime command is the smallest of the lot. Without arguments it prints the system uptime and the load average:

Terminal
uptime

output

 15:04:23 up 3:17, 2 users, load average: 0.42, 0.35, 0.31

The three numbers are the average number of processes that are runnable or in uninterruptible sleep over the last 1, 5, and 15 minutes. Compare them with nproc:

Terminal
nproc

output

A load average that stays below the core count is healthy. A load average well above the core count means processes are queueing for CPU time. The 15-minute value is the trend; the 1-minute value reacts to short spikes.

Method 8: Capacity Context

Before you read CPU usage, know what the host has. lscpu summarizes the CPU model, sockets, cores, and threads. For a deeper hardware view, see the guide on checking CPU information in Linux .

Terminal
lscpu

output

Architecture: x86_64
CPU op-mode(s): 32-bit, 64-bit
Address sizes: 46 bits physical, 48 bits virtual
Byte Order: Little Endian
CPU(s): 8
On-line CPU(s) list: 0-7
Vendor ID: GenuineIntel
Model name: Intel(R) Core(TM) i7-9700K CPU @ 3.60 GHz
Thread(s) per core: 1
Core(s) per socket: 8
Socket(s): 1

Thread(s) per core: 1 means hyper-threading is disabled or not present, so each logical CPU is a physical core. A high CPU usage on a chip with eight physical cores is different from the same number on a four-core chip with hyper-threading.

Troubleshooting

mpstat: command not found
The sysstat package is not installed. Install it with sudo apt install sysstat on Ubuntu, Debian, and Derivatives, or sudo dnf install sysstat on Fedora, RHEL, and Derivatives.

sar reports Cannot open /var/log/sysstat/
Sample collection is not enabled. Set ENABLED="true" in /etc/default/sysstat and restart the service with sudo systemctl restart sysstat. Wait at least one collection interval before rerunning sar.

top shows more than 100% CPU for one process
The default mode shows percentage relative to a single CPU, so a multi-threaded process can exceed 100 percent. Press Shift+I to toggle Irix mode off, and the value normalizes across all CPUs.

Load average looks high but no process consumes CPU
Load includes processes in D state, which is uninterruptible sleep. Check ps -eo state,pid,comm | awk '$1 ~ /D/' to find processes blocked on I/O. The cause is usually a slow or stalled disk.

Per-core view in htop is empty
Old terminal sizes hide the CPU bar. Resize the window or set Display options inside htop with F2.

FAQ

Which tool should I check first?
Run top or htop for a live picture, then drop to mpstat and sar when you need numbers or history. ps answers the per-process question once you know there is a problem.

What does %steal mean?
%steal is the time the hypervisor took from the guest VM to run something else. A consistent non-zero %steal value on a VM means the host is over-committed and the guest cannot get the CPU it asked for.

How do I count CPUs from a script?
Use nproc for the logical CPU count, or nproc --all to include offline CPUs. Both return a single integer and are stable across distributions.

Is high CPU always bad?
No. A batch job that finishes faster on a CPU running at full capacity is healthier than the same job spread thinly over a long period. CPU is bad when the load average exceeds the core count for sustained periods or when interactive workloads time out.

Conclusion

Pick the tool that matches the question. top and htop answer “what is happening right now”. mpstat and vmstat answer “is the load even across cores”. sar answers “what happened last night”. Treat load averages as a trend, not a verdict, and always read CPU numbers in the context of the core count from nproc.

systemctl Command in Linux: Start, Stop, and Manage Services

hello@linuxize.com (Linuxize) — Thu, 14 May 2026 10:30:00 +0200

Every modern Linux distribution runs a handful of services in the background at any given moment: an SSH daemon, a cron daemon, a web server, a database, a firewall. On systemd-based systems, the one tool you use to control all of them is systemctl.

systemctl is the command-line front end for systemd. It starts and stops services, enables them at boot, reloads unit files after an edit, and reports the status of each one. This guide walks through the commands you will reach for most often when managing services on a running system.

systemctl Syntax

The general syntax of the command is:

txt
systemctl [OPTIONS] COMMAND [UNIT...]

A UNIT is usually a service name such as nginx.service or cron.service. The .service suffix is optional when the unit type is unambiguous, so systemctl start nginx and systemctl start nginx.service do the same thing.

Most commands that change state (start, stop, enable, disable) require root privileges. Run them with sudo or as root.

Check the Status of a Service

Before you touch a service, check what it is doing. The status command prints the current state, recent log lines, the PID of the main process, and the path of the unit file:

Terminal
systemctl status nginx

output

● nginx.service - A high performance web server and a reverse proxy server
Loaded: loaded (/lib/systemd/system/nginx.service; enabled; preset: enabled)
Active: active (running) since Mon 2026-04-13 09:12:04 CEST; 2h 3min ago
Docs: man:nginx(8)
Main PID: 1591 (nginx)
Tasks: 3 (limit: 4612)
Memory: 6.2M
CPU: 112ms
CGroup: /system.slice/nginx.service
├─1591 "nginx: master process /usr/sbin/nginx -g daemon on; master_process on;"
└─1592 "nginx: worker process"

The two lines to read first are Loaded and Active. Loaded tells you whether the unit file was found and whether it is set to start at boot (enabled, disabled, masked, or static). Active tells you what the service is doing right now (active (running), inactive (dead), failed, and so on).

Start and Stop Services

To start a service that is not running:

Terminal
sudo systemctl start nginx

The command returns silently when the service starts. Run systemctl status nginx afterwards to confirm.

To stop a running service:

Terminal
sudo systemctl stop nginx

Stopping a service only affects the current session. If the service is enabled at boot, it will come back the next time the system starts.

Restart and Reload

A restart fully stops the service and starts it again, which terminates all active connections. This is the command you use after a binary upgrade or any change that the service cannot pick up on its own:

Terminal
sudo systemctl restart nginx

A reload asks the service to re-read its configuration without dropping active connections. Whether this works depends on the service itself. Web servers such as Nginx and Apache support it well; some services do not define a reload action.

Terminal
sudo systemctl reload nginx

If the unit file supports it, reload-or-restart is a safer combination: it tries reload first and falls back to a full restart if the service does not handle reload signals.

Terminal
sudo systemctl reload-or-restart nginx

Enable and Disable at Boot

Starting a service with start does not persist across a reboot. To make a service launch automatically at boot, use enable:

Terminal
sudo systemctl enable nginx

output

Created symlink /etc/systemd/system/multi-user.target.wants/nginx.service → /lib/systemd/system/nginx.service.

The output hints at what is happening behind the scenes. Enabling a service creates a symlink in one of the *.wants directories so that the appropriate boot target pulls the unit in.

To disable a service so that it no longer starts at boot:

Terminal
sudo systemctl disable nginx

enable and disable only change the boot behavior. To start or stop the service in the current session as well, add the --now flag:

Terminal
sudo systemctl enable --now nginx
sudo systemctl disable --now nginx

To check whether a service is currently enabled at boot:

Terminal
systemctl is-enabled nginx

Mask and Unmask

Disabling a service prevents it from starting at boot, but another service, socket, or admin can still start it manually. mask is the stronger option. It links the unit file to /dev/null so that every attempt to start it fails, whether from the command line, from another unit, or from a boot target.

Terminal
sudo systemctl mask apache2

To undo this:

Terminal
sudo systemctl unmask apache2

Masking is useful when two services conflict over the same port (for example, Nginx and Apache both wanting port 80) and you want to make sure the one you are not using cannot come back.

Reload systemd After Unit File Changes

When you add a new unit file or edit an existing one, systemd does not pick up the changes automatically. Tell it to reload its configuration with:

Terminal
sudo systemctl daemon-reload

Run this command after:

Creating a new .service file under /etc/systemd/system/
Editing a unit file (either directly or via systemctl edit)
Installing a package that ships a new unit file

After daemon-reload, restart the affected service if it was already running, so it starts under the new definition.

List Services

systemctl can list every unit it knows about, which is useful when you want to see what is active, what is failing, or what is simply installed. Because the listing commands have several useful variations, they have their own dedicated guide: see listing Linux services with systemctl for filtering by state, showing inactive units, and listing unit files.

The quickest view is:

Terminal
systemctl --failed

It prints every service that has failed since boot, which is usually the first thing you want to know on a box you do not fully trust yet.

View Service Logs

systemd stores service logs in the journal, which you query with journalctl. To follow the log for a single service:

Terminal
sudo journalctl -u nginx -f

The -u flag filters by unit, and -f follows new entries as they are written. For a full walkthrough of the journal, see the journalctl command guide.

Reboot, Power Off, and Suspend

systemctl also controls system power state. These commands do not require a service name:

Terminal
sudo systemctl reboot
sudo systemctl poweroff
sudo systemctl suspend
sudo systemctl hibernate

They are equivalent to the older reboot, poweroff, and halt commands, and they go through systemd so that services shut down cleanly.

Troubleshooting

Unit nginx.service could not be found.
The service is not installed, or the unit file is in a location systemd does not scan. Install the package, or run sudo systemctl daemon-reload if you just added a unit file manually.

Failed to start nginx.service: Unit is masked.
The unit has been masked. Run sudo systemctl unmask nginx and try again.

Service keeps failing after a config change
Run systemctl status SERVICE and journalctl -u SERVICE -n 50 to read the most recent log lines. Configuration syntax errors are the most common cause.

Changes to the unit file are ignored
You forgot sudo systemctl daemon-reload. systemd caches unit files in memory and needs to be told to reread them.

Permission denied
Most state-changing commands require root. Prefix the command with sudo, or switch to the root user.

Quick Reference

For a printable quick reference, see the systemctl cheatsheet .

Task	Command
Show service status	`systemctl status nginx`
Start a service	`sudo systemctl start nginx`
Stop a service	`sudo systemctl stop nginx`
Restart a service	`sudo systemctl restart nginx`
Reload configuration	`sudo systemctl reload nginx`
Enable at boot	`sudo systemctl enable nginx`
Enable and start now	`sudo systemctl enable --now nginx`
Disable at boot	`sudo systemctl disable nginx`
Check boot status	`systemctl is-enabled nginx`
Reload unit files	`sudo systemctl daemon-reload`
Show failed units	`systemctl --failed`
Follow service logs	`sudo journalctl -u nginx -f`

FAQ

What is the difference between enable and start?
start launches the service in the current session only. enable creates the symlinks that make systemd start the service at every boot. The two are independent, which is why --now exists to do both in one command.

What is the difference between disable and mask?
disable removes the service from boot targets, but it can still be started manually or pulled in by another unit. mask links the unit file to /dev/null so every start attempt fails.

How do I know if my system uses systemd?
Run ps -p 1 -o comm=. If the output is systemd, your init system is systemd and systemctl applies. Virtually every mainstream distribution has used systemd as the default since around 2015.

Does reload work for every service?
No. It depends on whether the unit file defines an ExecReload command and whether the service itself supports reloading. If you are unsure, use reload-or-restart, which falls back to restart when reload is not available.

What happens to running connections when I restart a service?
They are dropped. A full restart kills the process and starts a new one, so anything holding a connection will see it close. Use reload or reload-or-restart when the service supports it.

Conclusion

Most day-to-day work with systemctl comes down to status, start, stop, restart, enable, and disable. Keep daemon-reload in mind whenever you edit a unit file, and pair systemctl with journalctl when something fails to start.

Bash Best Practices: Writing Safer, Cleaner Scripts

hello@linuxize.com (Linuxize) — Wed, 13 May 2026 10:00:00 +0200

Bash scripts tend to start small and grow over time. A helper you wrote in five minutes to copy a few files can end up running in a cron job, a deployment pipeline, or a server startup script. When that happens, small oversights such as an unquoted variable or an ignored error become real outages.

This guide covers practical Bash best practices that keep scripts predictable, safe to re-run, and easy for other people to read.

Start With a Clear Shebang

Every Bash script should begin with a proper shebang line. The portable choice for Bash is:

~/script.shsh
#!/usr/bin/env bash

Using /usr/bin/env bash lets the script find Bash through the PATH, which matters on systems where Bash is installed outside /bin, such as macOS with Homebrew. If you rely on features that exist only in Bash, do not use #!/bin/sh. On many distributions /bin/sh points to dash or another minimal shell, and arrays, [[ ]], and local will not behave the same way.

Enable Strict Mode

By default, Bash ignores many errors. A command can fail, a variable can be unset, and the script will keep running as if nothing happened. Enabling strict mode at the top of the script changes that behavior.

~/script.shsh
#!/usr/bin/env bash
set -euo pipefail

Here is what each flag does:

-e - Exit immediately if any command returns a non-zero status.
-u - Treat unset variables as an error and exit.
-o pipefail - Make a pipeline fail if any command in it fails, not only the last one.

A common extra is IFS=$'\n\t', which prevents word splitting on spaces and avoids surprises when iterating over filenames that contain spaces.

~/script.shsh
#!/usr/bin/env bash
set -euo pipefail
IFS=$'\n\t'

Strict mode is not magic. It will not catch logic errors, and in some scripts you will need to opt out locally with || true for commands that are allowed to fail. The point is to flip the default from “keep going on errors” to “stop on errors”, which is almost always the safer choice. For a closer look at each option on its own, see our bash set command guide.

Always Quote Your Variables

Unquoted variables in Bash are expanded and then word-split. If a variable contains spaces, wildcards, or is empty, the result may be very different from what you expect.

Terminal
file="My Report.txt"
printf '<%s>\n' $file

Because $file is not quoted, Bash passes two arguments to printf: My and Report.txt. Quoting fixes it and keeps the filename as one value:

Terminal
printf '<%s>\n' "$file"

The same rule applies inside tests, loops, and command substitutions. When in doubt, quote. The only common case where you intentionally leave a variable unquoted is when you want word splitting, which should be rare and deliberate.

Prefer [[ ]] Over [ ]

Bash supports two test constructs: the older [ ] (a synonym for the test command) and the newer [[ ]] keyword. For Bash scripts, prefer [[ ]]:

sh
if [[ -f "$config" && "$env" == "production" ]]; then
 echo "Loading production config"
fi

[[ ]] handles empty variables safely even without quotes, supports pattern matching with == and regex with =~, and allows logical operators such as && and || inside the test. Only fall back to [ ] when writing a portable POSIX script that must run under sh or dash.

Use Functions for Repeated Logic

Once a script has more than a couple of steps, group related commands into functions. Functions make scripts easier to read, test, and refactor.

~/backup.shsh
log() {
 printf '[%s] %s\n' "$(date +'%F %T')" "$*"
}

backup_dir() {
 local src="$1"
 local dst="$2"

 log "Backing up $src to $dst"
 rsync -a "$src/" "$dst/"
}

backup_dir "/var/www" "/backup/www"

Declare variables inside functions with local so they do not leak into the rest of the script. Pass input as positional parameters, and return output via echo or printf rather than global variables when possible.

See Bash functions for more details on arguments, return values, and scoping.

Handle Errors Explicitly

Strict mode stops the script on errors, but it does not tell the user what went wrong. Adding a trap on ERR gives you a single place to log failures.

~/script.shsh
#!/usr/bin/env bash
set -Eeuo pipefail

on_error() {
 local exit_code=$?
 local line=$1
 echo "Error on line $line (exit code $exit_code)" >&2
 exit "$exit_code"
}

trap 'on_error $LINENO' ERR

The -E option makes the ERR trap inherit into functions and subshells. Without it, a failure inside a helper function may exit the script without running your error handler.

For cleanup tasks such as removing temporary files, use trap on EXIT:

~/script.shsh
tmp_dir=$(mktemp -d)
trap 'rm -rf "$tmp_dir"' EXIT

The EXIT trap runs whether the script exits normally, hits an error under set -e, or is interrupted with Ctrl+C. It is the safest way to guarantee cleanup.

Validate Input Early

Scripts that take arguments should fail fast when those arguments are missing or invalid. Check them before doing any work:

~/deploy.shsh
if [[ $# -lt 2 ]]; then
 echo "Usage: $0 <environment> <version>" >&2
 exit 1
fi

env="$1"
version="$2"

case "$env" in
 staging|production) ;;
 *)
 echo "Unknown environment: $env" >&2
 exit 1
 ;;
esac

For scripts with several flags, use getopts instead of parsing $@ manually. It handles short options, arguments, and error reporting in a consistent way.

Avoid Parsing the Output of ls

A common beginner mistake is looping over ls output:

sh
for f in $(ls /var/log); do
 echo "$f"
done

This breaks on filenames with spaces, newlines, or special characters. Use a glob or find instead:

sh
for f in /var/log/*; do
 echo "$f"
done

For recursive traversal, use find with -print0 and xargs -0, or a while read loop with IFS= and -d '' to handle unusual filenames correctly.

Keep Scripts Idempotent When Possible

A script you can safely re-run is much easier to work with than one that breaks on the second attempt. Aim for idempotent behavior: check before creating directories, use mkdir -p instead of mkdir, use ln -sf instead of ln -s, and guard commands with if blocks when they would otherwise fail on re-run.

Terminal
mkdir -p /opt/app/config

The same pattern applies to package installation, user creation, and configuration edits. Tools like Ansible enforce idempotency by design; in Bash, you have to add those checks yourself.

Use Shellcheck

Shellcheck is a static analyzer for shell scripts. It catches unquoted variables, unsafe for loops, and many other common mistakes before you hit them in production.

Install it from your package manager:

Terminal
sudo apt install shellcheck

Then run it against your script:

Terminal
shellcheck script.sh

Fix the warnings it raises, or document with an inline comment why a specific check is being ignored. Making shellcheck part of your editor or pre-commit hook removes an entire class of Bash bugs.

Prefer Readable Over Clever

Bash is full of shortcuts and obscure expansions. They can make scripts shorter, but they also make them harder to read six months later. Choose the clearer form, even when it is a few characters longer.

sh
if [[ -z "$name" ]]; then
 name="anonymous"
fi

is almost always easier to maintain than the golfed equivalent:

Terminal
: "${name:=anonymous}"

Aim for scripts that a teammate can read once and understand, not ones that require a reference manual.

Quick Reference

For a printable quick reference, see the Bash cheatsheet .

Before committing a Bash script, confirm the following:

#!/usr/bin/env bash shebang is present.
set -euo pipefail is enabled.
All variable expansions are quoted.
Tests use [[ ]] instead of [ ].
Functions replace long repeated blocks, with local variables.
trap handles errors and cleanup.
Input is validated before work begins.
No parsing of ls output.
shellcheck reports no warnings, or they are explicitly ignored.

FAQ

Is set -e enough on its own?
No. set -e stops on many errors, but it misses failures in pipelines and ignores unset variables. Combine it with -u and -o pipefail to cover those cases.

Does strict mode break existing scripts?
It often surfaces bugs that were already there, such as unset variables and ignored errors. The fix is to quote variables, use default values like ${VAR:-}, and handle expected failures with || true.

Should I write scripts in Bash or switch to Python?
Bash is a good fit for short glue scripts that mostly call other commands. Once a script grows past a few hundred lines, has complex data structures, or needs proper error handling and testing, Python or another language is usually a better choice.

Where can I learn more safe scripting patterns?
Keep the Shellcheck wiki open while you write, and read through the official Bash manual section on shell builtins. Both cover the reasoning behind each rule, not only the rule itself.

Conclusion

Strict mode, quoting, and a few well-placed traps cover most of the risk in Bash scripting. Make these practices your defaults, run shellcheck on every change, and your scripts will behave the same way on your laptop, in CI, and on a production server.

How to Install LEMP Stack on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Tue, 12 May 2026 10:00:00 +0200

When you need to host a PHP application or a CMS such as WordPress, Magento, or Laravel on a fresh Ubuntu server, the LEMP stack is one of the most common ways to get there. LEMP stands for Linux, Nginx (pronounced “engine-x”), MySQL, and PHP, and the four pieces fit together to serve dynamic PHP pages over HTTP.

This guide explains how to install and configure a complete LEMP stack on Ubuntu 26.04. By the end you will have Nginx serving HTTP traffic, MySQL 8.4 running as the database, and PHP 8.5 processing dynamic pages through PHP-FPM.

Quick Reference

Task	Command
Update package index	`sudo apt update`
Install Nginx	`sudo apt install nginx`
Install MySQL	`sudo apt install mysql-server`
Install PHP-FPM	`sudo apt install php-fpm php-mysql`
Secure MySQL	`sudo mysql_secure_installation`
Restart PHP-FPM	`sudo systemctl restart php8.5-fpm`
Reload Nginx	`sudo systemctl reload nginx`
Test Nginx config	`sudo nginx -t`
Allow HTTP/HTTPS	`sudo ufw allow 'Nginx Full'`
PHP-FPM socket	`/run/php/php8.5-fpm.sock`

Prerequisites

Before installing the stack, make sure you have:

A server running Ubuntu 26.04 with a user with sudo privileges .
The UFW firewall enabled. If you have not configured it yet, see ufw Command in Linux: Uncomplicated Firewall Reference .

Step 1: Install Nginx

Nginx is in the default Ubuntu 26.04 repositories. Refresh the package index and install it:

Terminal
sudo apt update
sudo apt install nginx

Once the install finishes, the service starts automatically. Confirm it is running:

Terminal
sudo systemctl status nginx

The output shows the service as active (running). If UFW is enabled, allow HTTP and HTTPS traffic:

Terminal
sudo ufw allow 'Nginx Full'

Open http://your_server_ip in a browser. You should see the default Nginx welcome page, which confirms that Nginx is serving requests.

For a deeper walkthrough of the install and the directory layout, see How to Install Nginx on Ubuntu 26.04 .

Step 2: Install MySQL

The database tier handles persistence. Install the MySQL server package:

Terminal
sudo apt install mysql-server

Once the install completes, run the security script. It walks you through removing anonymous users, disabling remote root login, and dropping the test database:

Terminal
sudo mysql_secure_installation

When prompted, answer Y to each hardening question. The validate password component is optional and you can disable it if you plan to manage credentials yourself.

To verify that the service is running:

Terminal
sudo systemctl status mysql

For details on creating users and granting privileges, see How to Install MySQL on Ubuntu 26.04 .

Step 3: Install PHP and PHP-FPM

Nginx does not embed a PHP interpreter. Instead, requests for PHP files are handed off to PHP-FPM (FastCGI Process Manager) over a Unix socket. Install PHP-FPM and the MySQL driver:

Terminal
sudo apt update
sudo apt install php-fpm php-mysql

On Ubuntu 26.04 this pulls in PHP 8.5. Confirm the version:

Terminal
php -v

The output starts with PHP 8.5.x. The PHP-FPM service starts automatically and listens on a Unix socket at /run/php/php8.5-fpm.sock:

Terminal
sudo systemctl status php8.5-fpm

If you need extra extensions such as php-curl, php-gd, php-mbstring, php-xml, or php-zip, install them now:

Terminal
sudo apt install php-curl php-gd php-mbstring php-xml php-zip

For information on additional modules and switching PHP versions, see How to Install PHP on Ubuntu 26.04 .

Step 4: Configure Nginx to Serve PHP

Now that Nginx and PHP-FPM are running, you need a server block that passes .php requests to PHP-FPM. Create a directory for the site and a small test file:

Terminal
sudo mkdir -p /var/www/example.com
sudo chown -R $USER:$USER /var/www/example.com

Create a new server block configuration:

Terminal
sudo nano /etc/nginx/sites-available/example.com

Paste the following content. Replace example.com with your domain or your server IP if you do not have a domain yet:

nginx
server {
 listen 80;
 listen [::]:80;

 server_name example.com www.example.com;
 root /var/www/example.com;

 index index.php index.html;

 location / {
 try_files $uri $uri/ =404;
 }

 location ~ \.php$ {
 include snippets/fastcgi-php.conf;
 fastcgi_pass unix:/run/php/php8.5-fpm.sock;
 }

 location ~ /\.ht {
 deny all;
 }
}

The try_files directive serves static files when they exist and falls back to a 404 otherwise. The location ~ \.php$ block matches any request ending in .php and forwards it to PHP-FPM through the Unix socket. The final location ~ /\.ht block blocks access to legacy .htaccess files, which Nginx does not use.

Enable the site by creating a symlink in sites-enabled:

Terminal
sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/

If the default server block is still enabled, remove its symlink so Nginx serves your new site for matching requests:

Terminal
sudo unlink /etc/nginx/sites-enabled/default

Test the configuration before reloading:

Terminal
sudo nginx -t

The output should end with syntax is ok and test is successful. Reload Nginx to apply the change:

Terminal
sudo systemctl reload nginx

Step 5: Test the PHP Setup

Create a simple PHP info file to confirm that Nginx hands PHP requests to PHP-FPM:

Terminal
echo "<?php phpinfo();" | sudo tee /var/www/example.com/info.php

Open http://example.com/info.php (or http://your_server_ip/info.php) in a browser. You should see the PHP information page that lists the PHP version, loaded extensions, and configuration directives. If the page shows the source code as plain text, Nginx is not passing the request to PHP-FPM and the location ~ \.php$ block needs to be reviewed.

Once you confirm PHP is working, remove the info file. It exposes details about your environment that should not be publicly readable:

Terminal
sudo rm /var/www/example.com/info.php

Step 6: Test the MySQL Connection from PHP

To confirm that PHP can talk to MySQL, create a test database and user:

Terminal
sudo mysql

In the MySQL prompt, run:

sql
CREATE DATABASE lemp_test;
CREATE USER 'lemp_user'@'localhost' IDENTIFIED BY 'changeme';
GRANT ALL PRIVILEGES ON lemp_test.* TO 'lemp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Warning

The password above is a placeholder. Replace changeme with a strong value, and do not commit credentials to version control. Store secrets in environment variables or a .env file outside the repository.

Create a small connection test:

Terminal
sudo nano /var/www/example.com/db-test.php

Add the following content:

php
<?php
$mysqli = new mysqli("localhost", "lemp_user", "changeme", "lemp_test");
if ($mysqli->connect_error) {
 die("Connection failed: " . $mysqli->connect_error);
}
echo "Connected to MySQL " . $mysqli->server_info;
$mysqli->close();

Open http://example.com/db-test.php. The page prints Connected to MySQL 8.4.x when the credentials and the PHP MySQL driver are working. Remove the file once you confirm the connection:

Terminal
sudo rm /var/www/example.com/db-test.php

Troubleshooting

Nginx shows the welcome page after editing the server block
Nginx still serves the default site. Remove the symlink at /etc/nginx/sites-enabled/default or rename your server block so it loads first, then run sudo nginx -t and sudo systemctl reload nginx.

PHP files download instead of executing
Nginx is not forwarding .php requests to PHP-FPM. Verify that the location ~ \.php$ block exists, that fastcgi_pass points to /run/php/php8.5-fpm.sock, and that PHP-FPM is running with sudo systemctl status php8.5-fpm.

502 Bad Gateway
PHP-FPM is not running, or Nginx is pointing at a wrong socket path. Run ls -l /run/php/ and confirm that the socket file matches the version in your config (for example, php8.5-fpm.sock). Restart the service with sudo systemctl restart php8.5-fpm.

Permission denied accessing the socket
The socket is owned by www-data by default. Make sure Nginx runs as www-data (the default on Ubuntu) and that no custom file permissions on /run/php/ block access.

MySQL connection refused from PHP
Confirm that the php-mysql package is installed, that the user has been granted privileges on the target database, and that the password in the PHP code matches the one used in CREATE USER.

FAQ

What is the difference between LEMP and LAMP?
LEMP uses Nginx as the web server, while LAMP uses Apache. Nginx handles many concurrent connections with low memory and is a strong fit for static content and reverse proxying. Apache supports per-directory .htaccess files and mod_php, which simplifies shared hosting setups. For a step-by-step Apache install, see How to Install LAMP Stack on Ubuntu 26.04 .

Can I use MariaDB instead of MySQL?
Yes. MariaDB is a drop-in replacement for MySQL and uses the same client tools, the same protocol, and the same SQL syntax for the cases covered in this guide.

Which PHP-FPM socket path do I use?
The path follows the PHP version. On Ubuntu 26.04 with the default PHP 8.5, the socket is /run/php/php8.5-fpm.sock. If you install another version, list /run/php/ to find the right socket file.

How do I add HTTPS to the site?
The recommended path is to install Certbot and request a Let’s Encrypt certificate for your domain. The Certbot Nginx plugin updates the server block automatically and sets up redirection from HTTP to HTTPS.

Next Steps

You now have a working LEMP stack on Ubuntu 26.04. From here you can deploy a PHP application, create additional Nginx server blocks for more sites, or front the stack with HTTPS using Let’s Encrypt.

How to Install LAMP Stack on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Tue, 12 May 2026 09:00:00 +0200

When you spin up a new server to run a PHP application or a CMS such as WordPress, Joomla, or Drupal, the LAMP stack is one of the most familiar starting points. LAMP stands for Linux, Apache, MySQL, and PHP, and the four pieces work together to serve dynamic web pages over HTTP.

This guide explains how to install and configure a complete LAMP stack on Ubuntu 26.04. By the end you will have Apache serving HTTP traffic, MySQL 8.4 running as the database, and PHP 8.5 processing dynamic pages through mod_php.

Quick Reference

Task	Command
Update package index	`sudo apt update`
Install Apache	`sudo apt install apache2`
Install MySQL	`sudo apt install mysql-server`
Install PHP with Apache	`sudo apt install php libapache2-mod-php php-mysql`
Secure MySQL	`sudo mysql_secure_installation`
Restart Apache	`sudo systemctl restart apache2`
Test Apache config	`sudo apache2ctl configtest`
Allow HTTP/HTTPS	`sudo ufw allow 'Apache Full'`
Enable a site	`sudo a2ensite example.com`
Disable default site	`sudo a2dissite 000-default`

Prerequisites

Before installing the stack, make sure you have:

A server running Ubuntu 26.04 with a user with sudo privileges .
The UFW firewall enabled. If you have not configured it yet, see ufw Command in Linux: Uncomplicated Firewall Reference .

Step 1: Install Apache

Apache is in the default Ubuntu 26.04 repositories. Refresh the package index and install it:

Terminal
sudo apt update
sudo apt install apache2

The service starts automatically after the install. Confirm it is running:

Terminal
sudo systemctl status apache2

The output shows the service as active (running). If UFW is enabled, allow HTTP and HTTPS through the firewall:

Terminal
sudo ufw allow 'Apache Full'

Open http://your_server_ip in a browser. You should see the default Apache welcome page, which confirms that Apache is serving requests.

For an in-depth walkthrough of the install and the directory layout, see How to Install Apache on Ubuntu 26.04 .

Step 2: Install MySQL

The database tier handles persistence. Install the MySQL server package:

Terminal
sudo apt install mysql-server

Once the install completes, run the security script. It walks you through removing anonymous users, disabling remote root login, and dropping the test database:

Terminal
sudo mysql_secure_installation

Answer Y to each hardening question. The validate password component is optional; skip it if you plan to manage credentials yourself.

To verify that the service is running:

Terminal
sudo systemctl status mysql

For details on creating users and granting privileges, see How to Install MySQL on Ubuntu 26.04 .

Step 3: Install PHP

Apache integrates with PHP through the libapache2-mod-php module, which lets Apache run PHP code in-process. Install PHP, the Apache module, and the MySQL driver:

Terminal
sudo apt update
sudo apt install php libapache2-mod-php php-mysql

On Ubuntu 26.04 this pulls in PHP 8.5. Confirm the version:

Terminal
php -v

The output starts with PHP 8.5.x. Restart Apache so the PHP module loads:

Terminal
sudo systemctl restart apache2

If you need extra extensions such as php-curl, php-gd, php-mbstring, php-xml, or php-zip, install them now:

Terminal
sudo apt install php-curl php-gd php-mbstring php-xml php-zip

For information on additional modules and switching PHP versions, see How to Install PHP on Ubuntu 26.04 .

Step 4: Configure an Apache Virtual Host

The default Apache configuration serves files from /var/www/html. For a real site you usually want a dedicated document root and a virtual host. Create the directory and a small placeholder:

Terminal
sudo mkdir -p /var/www/example.com
sudo chown -R $USER:$USER /var/www/example.com
echo "<h1>example.com is live</h1>" > /var/www/example.com/index.html

Create a new virtual host file:

Terminal
sudo nano /etc/apache2/sites-available/example.com.conf

Paste the following content. Replace example.com with your domain or your server IP if you do not have a domain yet:

apache
<VirtualHost *:80>
 ServerName example.com
 ServerAlias www.example.com
 ServerAdmin webmaster@example.com
 DocumentRoot /var/www/example.com

 <Directory /var/www/example.com>
 Options -Indexes +FollowSymLinks
 AllowOverride All
 Require all granted
 </Directory>

 ErrorLog ${APACHE_LOG_DIR}/example.com-error.log
 CustomLog ${APACHE_LOG_DIR}/example.com-access.log combined
</VirtualHost>

AllowOverride All lets you use per-directory .htaccess files, which is required by many PHP applications such as WordPress for clean URL rewrites. Enable the site and disable the default one:

Terminal
sudo a2ensite example.com
sudo a2dissite 000-default

Make sure mod_rewrite is enabled if your application uses it:

Terminal
sudo a2enmod rewrite

Test the configuration before reloading Apache:

Terminal
sudo apache2ctl configtest

The output should end with Syntax OK. Reload Apache to apply the change:

Terminal
sudo systemctl reload apache2

Step 5: Test the PHP Setup

Create a PHP info file to confirm that Apache executes PHP:

Terminal
echo "<?php phpinfo();" | sudo tee /var/www/example.com/info.php

Open http://example.com/info.php (or http://your_server_ip/info.php) in a browser. You should see the PHP information page that lists the PHP version, loaded extensions, and configuration directives. If the browser downloads the file or shows the source code, the PHP module is not loaded; reinstall libapache2-mod-php and restart Apache.

Once you confirm PHP is working, remove the info file. It exposes details about your environment that should not be publicly readable:

Terminal
sudo rm /var/www/example.com/info.php

Step 6: Test the MySQL Connection from PHP

To confirm that PHP can talk to MySQL, create a test database and user:

Terminal
sudo mysql

In the MySQL prompt, run:

sql
CREATE DATABASE lamp_test;
CREATE USER 'lamp_user'@'localhost' IDENTIFIED BY 'changeme';
GRANT ALL PRIVILEGES ON lamp_test.* TO 'lamp_user'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Warning

Create a small connection test:

Terminal
sudo nano /var/www/example.com/db-test.php

Add the following content:

php
<?php
$mysqli = new mysqli("localhost", "lamp_user", "changeme", "lamp_test");
if ($mysqli->connect_error) {
 die("Connection failed: " . $mysqli->connect_error);
}
echo "Connected to MySQL " . $mysqli->server_info;
$mysqli->close();

Open http://example.com/db-test.php. The page prints Connected to MySQL 8.4.x when the credentials and the PHP MySQL driver are working. Remove the file once you confirm the connection:

Terminal
sudo rm /var/www/example.com/db-test.php

Troubleshooting

Apache shows the default page after editing the virtual host
The default site is still enabled. Run sudo a2dissite 000-default, then sudo a2ensite example.com, and reload Apache.

PHP files download instead of executing
The Apache PHP module is not loaded. Reinstall it with sudo apt install --reinstall libapache2-mod-php, enable it with sudo a2enmod php8.5, and restart Apache.

AllowOverride All is ignored
The <Directory> block in the virtual host must include AllowOverride All. Confirm that the path matches your DocumentRoot and run sudo apache2ctl configtest after the change.

.htaccess rewrites do not work
The rewrite module is not enabled. Run sudo a2enmod rewrite and restart Apache. Verify that the <Directory> block sets AllowOverride All.

FAQ

What is the difference between LAMP and LEMP?
LAMP uses Apache as the web server, while LEMP uses Nginx. Apache supports .htaccess overrides and mod_php, which makes shared hosting and many PHP CMS workflows simpler. Nginx is event-driven and tends to use less memory under high concurrency. For an Nginx-based stack, see How to Install LEMP Stack on Ubuntu 26.04 .

Can I use MariaDB instead of MySQL?
Yes. MariaDB is a drop-in replacement for MySQL and uses the same client tools, the same protocol, and the same SQL syntax for the cases covered in this guide.

Should I use mod_php or PHP-FPM with Apache?
mod_php is the simplest setup and is fine for many sites. For higher concurrency or when you run multiple PHP versions, switch to PHP-FPM with mpm_event and proxy_fcgi. The php-fpm package and the proxy_fcgi Apache module handle the connection.

How do I add HTTPS to the site?
Install Certbot and request a Let’s Encrypt certificate for your domain. The Certbot Apache plugin updates the virtual host automatically and sets up redirection from HTTP to HTTPS.

Next Steps

You now have a working LAMP stack on Ubuntu 26.04. From here you can deploy a PHP application, create additional Apache virtual hosts for more sites, or add HTTPS using Let’s Encrypt.

Nginx Location Blocks: Match Rules and Priority

hello@linuxize.com (Linuxize) — Mon, 11 May 2026 15:20:00 +0100

Sooner or later, every Nginx configuration grows beyond a single catch-all rule. You want PHP files to reach PHP-FPM, static assets to be served directly with long cache headers, one endpoint to be proxied to an application server, and an admin path to be protected with basic auth. Each of these rules lives in its own location block.

The part that trips people up is not writing a location block, it is predicting which one Nginx will pick when a request could match more than one. Nginx does not scan top to bottom. It uses a specific priority order that mixes prefix length, match type, and regex ordering. This guide walks through the match types, the exact order Nginx follows, and the patterns you will use most often.

Location Block Syntax

A location block lives inside a server block and defines how Nginx handles requests whose URI matches a given pattern:

txt
location [modifier] pattern {
 # directives
}

The modifier is optional. When it is omitted, Nginx treats the pattern as a prefix. The pattern is a string (for prefix and exact matches) or a regular expression (when the modifier is ~ or ~*).

A minimal server block that uses two location blocks looks like this:

nginx
server {
 listen 80;
 server_name example.com;
 root /var/www/example.com;

 location / {
 try_files $uri $uri/ =404;
 }

 location /api/ {
 proxy_pass http://127.0.0.1:3000;
 }
}

Requests for /about.html fall into the first block and are served as static files. Requests for /api/users fall into the second block and are proxied to the application.

The Five Match Types

Nginx supports five kinds of location matches. Each one uses a different modifier, and each one has its own role in the priority order covered in the next section.

location /path/ - Prefix match. Matches any URI that begins with the given string. This is the default when no modifier is used.
location = /path - Exact match. Matches only when the request URI is exactly equal to the given string.
location ^~ /path/ - Preferential prefix match. Same matching rules as a plain prefix match, but tells Nginx to stop searching for regex matches once this block is selected as the longest prefix.
location ~ pattern - Case-sensitive regex match. Matches if the URI matches the regular expression.
location ~* pattern - Case-insensitive regex match. Same as ~, but ignores letter case.

There is also a sixth form, location @name, for named locations. Named locations are not used during the normal match process; they are jumped to from directives such as try_files and error_page. We cover them later in this guide.

How Nginx Picks a Location

When a request comes in, Nginx does not walk through location blocks top to bottom. It picks the block that wins according to a fixed priority order.

The order Nginx follows is:

Look for an exact match (=). If one matches, stop and use it.
Look at all prefix matches (plain and ^~) and remember the longest one that matches.
If the longest prefix match was defined with ^~, stop and use it.
Otherwise, go through regex matches (~ and ~*) in the order they appear in the configuration. The first one that matches wins.
If no regex matches, fall back to the longest prefix match remembered in step 2.

The consequences of this order are worth pausing on. Regex blocks are checked in source order, but prefix blocks are not; the longest match wins regardless of position in the file. The ^~ modifier changes the outcome by skipping the regex pass entirely when it is the longest prefix match, even if a regex block would also have matched.

A Worked Example

The easiest way to understand the priority order is to trace a few requests through a real configuration:

nginx
server {
 listen 80;
 server_name example.com;
 root /var/www/example.com;

 location = / {
 return 200 "home\n";
 }

 location / {
 try_files $uri $uri/ =404;
 }

 location /images/ {
 expires 30d;
 }

 location ^~ /downloads/ {
 autoindex on;
 }

 location ~* \.(png|jpg|jpeg|gif)$ {
 expires 7d;
 access_log off;
 }

 location ~ \.php$ {
 fastcgi_pass unix:/run/php/php-fpm.sock;
 include fastcgi_params;
 }
}

Now trace what happens for a few requests:

GET /: The = block matches exactly and wins immediately. Nginx returns the text home.
GET /about.html: No exact match, no ^~ match, and no regex match. The longest prefix match is /, so the try_files block serves the static file.
GET /images/logo.png: The longest prefix match is /images/, which is a plain prefix (no ^~), so regex checking still happens. The first regex to match is the image extension block (~*), so that block wins and the file is served with a 7-day expiry.
GET /downloads/setup.exe: The longest prefix match is /downloads/, defined with ^~. Because of the ^~, regex checking is skipped and the directory listing block wins.
GET /info.php: The longest prefix match is /. Regex checking runs, and the \.php$ block matches, so the request is passed to PHP-FPM.

Notice that the block order in the file did not change the outcome for prefix matches. It only changed the outcome for regex matches, where the first match wins.

Named Locations

A named location starts with @ and does not take part in the matching logic. You can only enter a named location by being redirected there from another directive:

nginx
server {
 listen 80;
 server_name example.com;
 root /var/www/example.com;

 location / {
 try_files $uri $uri/ @fallback;
 }

 location @fallback {
 proxy_pass http://127.0.0.1:3000;
 }
}

In this configuration, Nginx first tries to serve the request as a static file. If the file is not found, try_files jumps to @fallback, which proxies the request to an application server on port 3000. This is a common pattern for single-page apps and for frameworks that handle their own routing.

Named locations are also useful with the error_page directive, where you can route errors into a named block that returns a custom response.

Common Patterns

Most Nginx configurations end up using a handful of recurring location patterns. The snippets below show the shapes you will reach for most often.

Serve Static Files with a Fallback

nginx
location / {
 try_files $uri $uri/ /index.html;
}

Nginx tries the requested URI as a file, then as a directory, and falls back to /index.html. This works well for single-page apps where the router lives in the browser.

Cache Long-Lived Assets

nginx
location ~* \.(?:css|js|woff2?|png|jpg|jpeg|gif|svg|ico)$ {
 expires 30d;
 add_header Cache-Control "public, immutable";
 access_log off;
}

Assets whose content is fingerprinted by the build pipeline can be cached aggressively. The access_log off directive keeps the access log focused on real page requests; see the Nginx log files guide for where those logs live and how to tune them.

Pass PHP Requests to PHP-FPM

nginx
location ~ \.php$ {
 include snippets/fastcgi-php.conf;
 fastcgi_pass unix:/run/php/php-fpm.sock;
}

The regex matches any URI that ends with .php. The fastcgi-php.conf snippet shipped with most distributions sets the correct SCRIPT_FILENAME and related parameters.

Proxy a Path to an Application

nginx
location /api/ {
 proxy_pass http://127.0.0.1:3000;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
}

For a deeper walkthrough of the proxy headers and common pitfalls, see the Nginx reverse proxy guide .

Protect an Admin Path

nginx
location ^~ /admin/ {
 auth_basic "Restricted";
 auth_basic_user_file /etc/nginx/.htpasswd;
}

The ^~ modifier makes sure this block wins over any regex block (for example, a generic static-asset rule), so the auth challenge is not accidentally bypassed by a more specific pattern. Basic auth sends credentials in clear text, so serve the site over HTTPS; see how to redirect HTTP to HTTPS in Nginx .

Test the Configuration

After changing location blocks, always test the Nginx configuration before reloading the service:

Terminal
sudo nginx -t

If the syntax check passes, reload Nginx so the change takes effect without dropping active connections:

Terminal
sudo systemctl reload nginx

If the test fails, Nginx prints the file name and line number that caused the error. Fix that issue first, then run sudo nginx -t again.

Quick Reference

Modifier	Meaning	Priority
`=`	Exact match	1 (highest)
`^~`	Preferential prefix match	2 (skips regex)
`~`	Case-sensitive regex	3 (in source order)
`~*`	Case-insensitive regex	3 (in source order)
(none)	Prefix match	4 (longest wins)
`@name`	Named location	Only reachable from directives

Common Mistakes

A few patterns cause most of the confusion around location blocks.

Assuming top-to-bottom evaluation. Moving a prefix block higher in the file does not make it more likely to match. Prefix matches are chosen by length, not by position.

Forgetting that ^~ skips regex. If a request matches both a ^~ prefix and a regex block, the regex block is not evaluated. This is a feature, not a bug, but it is easy to forget when debugging why a regex rule is being ignored.

Trailing slashes. location /images/ and location /images behave differently. The first only matches URIs that start with /images/, while the second also matches /imagesfoo. Stick to trailing slashes for directory-like prefixes.

Using proxy_pass with a trailing slash on the upstream. Writing proxy_pass http://backend/; rewrites the path in a different way than proxy_pass http://backend;. The Nginx proxy_pass documentation explains the URI replacement rules in detail.

Regex order. When two regex blocks can match the same URI, the one that appears first in the config wins. If requests are landing in the wrong regex block, check the order.

Conclusion

Most Nginx misconfigurations come from assumptions about the order of evaluation, not from the directives themselves. Once you know that exact matches win first, that ^~ can short-circuit the regex pass, and that regex blocks are tried in source order, the behavior of a complex server block becomes predictable.

dd Command in Linux: Copy Disks, Partitions, and Files

hello@linuxize.com (Linuxize) — Sun, 10 May 2026 08:30:00 +0200

Most of the time when you copy a file on Linux, you reach for cp. It walks the filesystem, respects permissions, and works on individual files. But when you need to copy an entire disk, write an ISO image to a USB stick, or create a byte-for-byte backup of a partition, the filesystem view is not enough. For that, Linux ships with dd, a tool that copies raw data block by block between any two files or devices.

This guide explains how to use dd safely to write ISO images, clone disks, back up partitions, create test files, and benchmark storage performance.

dd Syntax

The general form of the dd command is:

txt
dd if=INPUT of=OUTPUT [OPTIONS]

The two key operands are if (input file) and of (output file). Either one can be a regular file, a block device such as /dev/sda, or even /dev/zero and /dev/urandom. Options control the block size, how many blocks to copy, and what conversions to apply.

Warning

dd writes exactly what you tell it to write, to exactly the target you point it at. Pointing of= at the wrong disk will overwrite that disk without warning or confirmation. Always double-check the target device with lsblk or sudo fdisk -l before running a dd command.

Writing an ISO Image to a USB Drive

The most common use for dd is flashing a Linux ISO to a USB drive so you can boot and install from it. First, identify the USB device with lsblk or sudo fdisk -l:

Terminal
lsblk

output

NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINTS
sda 8:0 0 465.8G 0 disk
├─sda1 8:1 0 512M 0 part /boot/efi
└─sda2 8:2 0 465.3G 0 part /
sdb 8:16 1 14.5G 0 disk
└─sdb1 8:17 1 14.5G 0 part

Here sda is the system disk and sdb is the USB drive. Make sure the USB is unmounted before writing to it:

Terminal
sudo umount /dev/sdb1

Then write the ISO image:

Terminal
sudo dd if=ubuntu-24.04-desktop-amd64.iso of=/dev/sdb bs=4M status=progress oflag=sync

Notice that the output target is the whole disk (/dev/sdb), not a partition (/dev/sdb1). Writing an ISO to a partition would leave the USB unbootable. The options do the following:

bs=4M - Read and write 4 MB at a time, which is much faster than the 512-byte default.
status=progress - Print a live progress indicator so you can see how much has been written.
oflag=sync - Flush every write to the device, so the final byte count reflects data actually on disk.

When dd finishes, run sync once more to make sure all buffered writes hit the USB stick before you remove it:

Terminal
sync

For alternative methods and distro-specific tips, see the guide on how to create a bootable Linux USB drive .

Cloning a Whole Disk

To make an exact block-level copy of one disk onto another, point if= and of= at two different block devices:

Terminal
sudo dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync status=progress

The destination disk must be at least as large as the source. Anything already on it is overwritten. The conversion flags handle read errors gracefully:

conv=noerror - Keep going when a read error occurs instead of aborting.
conv=sync - Pad short reads with zeros so the output stays aligned with the source.

Clone offline whenever possible. Cloning a disk that is actively being written to produces an inconsistent copy, especially for databases and journaling filesystems.

Backing Up a Partition to an Image File

dd can also write a partition or whole disk to a regular file. That file becomes a bit-for-bit image you can restore later:

Terminal
sudo dd if=/dev/sda1 of=/backup/sda1.img bs=4M status=progress

To save space, pipe the output through gzip:

Terminal
sudo dd if=/dev/sda1 bs=4M status=progress | gzip -c > /backup/sda1.img.gz

The compressed image is much smaller for filesystems that contain text or empty space, though the compression step adds CPU time.

To restore the image to a partition:

Terminal
gunzip -c /backup/sda1.img.gz | sudo dd of=/dev/sda1 bs=4M status=progress

The target partition must be unmounted during restore, and it must be at least as large as the original.

Backing Up and Restoring the MBR

The Master Boot Record sits in the first 512 bytes of a disk that uses a traditional BIOS partition table. You can back it up with dd:

Terminal
sudo dd if=/dev/sda of=/backup/mbr.img bs=512 count=1

To restore the MBR, swap the input and output:

Terminal
sudo dd if=/backup/mbr.img of=/dev/sda bs=512 count=1

On modern UEFI systems the partition table uses GPT instead of MBR, so this trick only applies to older BIOS installations. For GPT disks, use sgdisk --backup and sgdisk --load-backup from the gdisk package.

Creating an Empty File of a Specific Size

dd is often used to create test files of a known size. The count option sets how many blocks to write, and bs sets the block size:

Terminal
dd if=/dev/zero of=testfile bs=1M count=100

This creates a 100 MB file filled with zeros, useful for testing backups, simulating quota limits, or preparing a swap file. To create a file filled with random data instead, read from /dev/urandom:

Terminal
dd if=/dev/urandom of=random.bin bs=1M count=10

Random data is slower to generate because the kernel has to produce the bytes, while /dev/zero is effectively free.

Creating a Swap File

One practical use of the empty-file pattern is creating a swap file :

Terminal
sudo dd if=/dev/zero of=/swapfile bs=1M count=2048 status=progress
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile

The chmod 600 step keeps the swap file readable only by root, which is required by mkswap on most distros. After swapon, the 2 GB swap file is active immediately. Add an entry to /etc/fstab to make it permanent.

Wiping a Disk

To destroy data on a disk before disposing of it or repurposing it, overwrite the entire device with zeros:

Terminal
sudo dd if=/dev/zero of=/dev/sdb bs=4M status=progress

For a stronger wipe that makes recovery harder on traditional spinning disks, use random data:

Terminal
sudo dd if=/dev/urandom of=/dev/sdb bs=4M status=progress

On SSDs, a dd wipe is not the right tool. SSDs remap blocks internally, so a full write does not guarantee every cell was overwritten. Use blkdiscard or the drive vendor’s secure-erase utility instead.

Benchmarking Disk Write Speed

dd is a quick way to measure sustained write throughput. Write a 1 GB file of zeros and let dd report the rate:

Terminal
dd if=/dev/zero of=tempfile bs=1M count=1024 oflag=direct

output

1024+0 records in
1024+0 records out
1073741824 bytes (1.1 GB, 1.0 GiB) copied, 3.1 s, 346 MB/s

The oflag=direct flag bypasses the page cache, so the number reflects actual disk speed rather than memory throughput. For a read benchmark, drop the caches first and then read the file back:

Terminal
sudo sh -c "sync && echo 3 > /proc/sys/vm/drop_caches"
dd if=tempfile of=/dev/null bs=1M

Remove the test file when you are done:

Terminal
rm tempfile

For more detailed I/O profiling, tools like fio and ioping produce more accurate, repeatable results.

Showing Progress on a Running dd

If you started dd without status=progress, you can still ask it to print a status line by sending the USR1 signal to its process. From another terminal, run:

Terminal
sudo kill -USR1 $(pidof dd)

dd will respond by printing the number of bytes copied so far and its current rate, then keep running.

Common Options

A quick rundown of the options covered in this guide, plus a few more worth knowing:

if=FILE - Input file or device.
of=FILE - Output file or device.
bs=N - Block size for both reads and writes (e.g., 4M for 4 MB).
ibs=N / obs=N - Separate input and output block sizes.
count=N - Number of input blocks to copy.
skip=N - Skip N blocks at the start of the input.
seek=N - Skip N blocks at the start of the output.
status=progress - Print progress while copying.
conv=noerror - Continue past read errors.
conv=sync - Pad short reads with zeros to keep block alignment.
oflag=direct - Bypass the kernel page cache on write.
oflag=sync - Flush each write to the device before continuing.

Quick Reference

Command	Description
`sudo dd if=image.iso of=/dev/sdX bs=4M status=progress oflag=sync`	Write an ISO image to a USB drive
`sudo dd if=/dev/sda of=/dev/sdb bs=64K conv=noerror,sync status=progress`	Clone one disk to another
`sudo dd if=/dev/sda1 of=/backup/sda1.img bs=4M status=progress`	Back up a partition to an image file
`sudo dd if=/dev/sda bs=4M status=progress \| gzip -c > disk.img.gz`	Compressed disk image backup
`sudo dd if=/dev/sda of=/backup/mbr.img bs=512 count=1`	Back up the MBR
`dd if=/dev/zero of=testfile bs=1M count=100`	Create a 100 MB file of zeros
`sudo dd if=/dev/zero of=/dev/sdX bs=4M status=progress`	Wipe a disk with zeros
`dd if=/dev/zero of=tempfile bs=1M count=1024 oflag=direct`	Benchmark disk write speed
`sudo kill -USR1 $(pidof dd)`	Ask a running dd for its progress

Troubleshooting

dd: failed to open ‘/dev/sdX’: Permission denied
Writing to a block device requires root privileges. Prefix the command with sudo. If you are already using sudo, double-check that the device path is correct and that the device is not exclusively held by another process.

dd: error writing ‘/dev/sdX’: No space left on device
The destination is smaller than the source. When cloning, the target disk or partition must be at least as large as the source. When writing an ISO, the USB drive must be larger than the ISO file.

The write is much slower than expected
The default block size of 512 bytes forces millions of tiny syscalls. Set bs=4M or bs=64K to speed things up. Also check whether other processes are doing heavy I/O on the same device.

The USB does not boot after writing the ISO
Verify that you wrote the image to the disk (/dev/sdb), not a partition (/dev/sdb1). Also confirm the ISO download with its SHA256 checksum; a truncated or corrupted download produces an unbootable stick.

dd: invalid number: ‘4M’
Older or minimal systems may ship a dd that does not accept the M, G, or K suffixes. On those systems, spell out the block size in bytes (bs=4194304 for 4 MB), or install GNU coreutils.

FAQ

What does dd stand for?
The name comes from the IBM Job Control Language statement “Data Definition.” Because of how often the command is used to overwrite disks by mistake, many Linux users jokingly call it “disk destroyer.” Either way, the behavior is the same: it copies bytes from input to output without touching the filesystem layer.

Is dd faster than cp for copying large files?
For regular files on a normal filesystem, cp is usually just as fast and safer to use. dd only wins when you are copying raw devices, working with exact byte offsets, or deliberately limiting how much data is copied with count.

Can I use dd on an SSD without damaging it?
Reading and writing with dd is fine. The concern with SSDs is full-disk wipes: a single pass of zeros is enough to erase visible data, but repeated full-drive writes wear out the flash cells. For secure erase, use blkdiscard or the drive’s built-in secure-erase command.

How do I see how much data dd has copied?
Add status=progress to the command, or send the running process the USR1 signal with sudo kill -USR1 $(pidof dd). Both methods print the byte count and current throughput without interrupting the copy.

Why use bs=4M instead of the default?
The default block size of 512 bytes means dd issues a separate read and write for every 512 bytes of data. Larger block sizes such as 4 MB dramatically reduce syscall overhead and let the kernel fill the disk pipeline efficiently, often cutting copy times by a factor of ten.

Conclusion

dd is one of the most direct tools in the Linux toolbox. It copies bytes, no more and no less, between any two files or devices. That power makes it indispensable for flashing installers, cloning disks, and building image backups, and the same power makes it unforgiving if you point it at the wrong target.

For related disk tools, see the guides on fdisk for partitioning and df for checking free space.

How to Install and Use uv: Fast Python Package Manager

hello@linuxize.com (Linuxize) — Sat, 09 May 2026 10:35:00 +0200

If you have worked with Python for a while, you have probably juggled pip, virtualenv, pip-tools, pipx, and pyenv just to keep a few projects running. Each tool does one thing, and wiring them together is slow and fragile. uv is a single binary that replaces all of them. It is written in Rust, published by Astral (the team behind ruff), and is typically ten to a hundred times faster than pip for common workflows.

This guide explains how to install uv on Linux, create and manage Python projects with it, add dependencies, work with virtual environments, and install specific Python versions.

Quick Reference

Command	Description
`uv init my-project`	Create a new project with `pyproject.toml`
`uv add requests`	Add a dependency and update the lockfile
`uv add --dev pytest`	Add a development dependency
`uv remove requests`	Remove a dependency
`uv sync`	Install dependencies from the lockfile
`uv lock`	Update the lockfile
`uv run script.py`	Run a command in the project environment
`uv venv`	Create a virtual environment
`uv pip install requests`	Pip-compatible install interface
`uv python install 3.12`	Install a specific Python version
`uv python list`	List installed and available Python versions
`uv tool install ruff`	Install a CLI tool globally
`uvx ruff check .`	Run a tool without installing it permanently

Installing uv

The recommended install path on Linux is the standalone script from Astral. It downloads a prebuilt binary, places it in ~/.local/bin, and does not require Python to be installed first:

Terminal
curl -LsSf https://astral.sh/uv/install.sh | sh

The script prints where it put the binary and whether it updated your shell rc file. Reload your shell or run source ~/.bashrc so the new PATH takes effect, then verify the install:

Terminal
uv --version

output

uv 0.11.11

If you prefer to install from a package manager, uv is also available through pip, pipx, and Homebrew:

Terminal
pip install uv

Terminal
pipx install uv

Terminal
brew install uv

On Ubuntu, Debian, and Derivatives, pip may refuse a system-wide install because the Python environment is marked as externally managed. In that case, use pipx install uv or the standalone installer.

If you installed uv with the standalone installer, update it to the latest release with:

Terminal
uv self update

Creating a Project

uv init scaffolds a new project with a pyproject.toml, a README.md, a .python-version file, and a starter module:

Terminal
uv init my-project
cd my-project

output

Initialized project `my-project`

The generated pyproject.toml looks like this:

pyproject.tomltoml
[project]
name = "my-project"
version = "0.1.0"
description = "Add your description here"
readme = "README.md"
requires-python = ">=3.12"
dependencies = []

uv has not created a virtual environment yet. That happens the first time you add a dependency or run a command in the project.

Adding and Removing Dependencies

To add a package, use uv add:

Terminal
uv add requests

output

Resolved 5 packages in 320ms
Installed 5 packages in 45ms
+ certifi==2025.1.31
+ charset-normalizer==3.4.1
+ idna==3.10
+ requests==2.32.3
+ urllib3==2.3.0

On the first run, uv creates a .venv directory in the project root, resolves the dependency graph, writes a uv.lock file that pins every package and its transitive dependencies, and installs everything into the venv. The requests line is also added to pyproject.toml under dependencies.

Development-only dependencies go into a separate group with --dev:

Terminal
uv add --dev pytest ruff

They are recorded under a dev dependency group in pyproject.toml and are installed into the same venv, but they are excluded when your project is published or installed as a library.

Remove a dependency with uv remove:

Terminal
uv remove requests

uv updates pyproject.toml, updates uv.lock, and uninstalls the package along with any dependencies that are no longer needed.

Running Code in the Project Environment

You do not have to activate the virtual environment manually. uv run executes a command inside the project venv and syncs dependencies first if needed:

Terminal
uv run python main.py

Terminal
uv run pytest

Scripts declared in pyproject.toml under [project.scripts] are also available:

Terminal
uv run my-command

If you prefer the classic workflow, activate the venv yourself:

Terminal
source .venv/bin/activate
python main.py

Either approach works, but uv run has the advantage of keeping the environment in sync with uv.lock every time you invoke it.

Syncing and Reproducing an Environment

When you clone a project that uses uv, run uv sync to install exactly the versions pinned in uv.lock:

Terminal
uv sync

output

Resolved 12 packages in 5ms
Installed 12 packages in 110ms

uv sync is deterministic: given the same uv.lock, it produces the same environment on any machine. This is the command to run in CI, in Docker builds, and on every fresh checkout.

If pyproject.toml changes but the lockfile is out of date, refresh the lock with:

Terminal
uv lock

Use uv lock --upgrade to bump every dependency to the latest version allowed by the version constraints in pyproject.toml, and uv lock --upgrade-package requests to bump a single package.

Working with Virtual Environments Directly

uv can also be used as a faster drop-in for virtualenv. To create a standalone venv in the current directory:

Terminal
uv venv

output

Using Python 3.12.8
Creating virtual environment at: .venv
Activate with: source .venv/bin/activate

Specify a Python version with --python:

Terminal
uv venv --python 3.11

Specify a different path:

Terminal
uv venv /tmp/myenv

Once the venv exists, use uv pip as a fast replacement for the regular pip commands:

Terminal
uv pip install requests
uv pip install -r requirements.txt
uv pip freeze
uv pip list

The uv pip interface is intentionally compatible with pip, which makes it easy to adopt uv in existing projects without restructuring them as pyproject.toml-based projects.

For a refresher on classic virtual environments, see the guide on Python virtual environments .

Installing and Managing Python Versions

uv can download and manage Python interpreters without touching your system Python. List the versions available and installed:

Terminal
uv python list

Install a specific version:

Terminal
uv python install 3.12

Terminal
uv python install 3.11 3.13

The downloaded interpreters live under ~/.local/share/uv/python/ and are independent of the system package manager. To use a specific version in a project, set it in the .python-version file or pass --python when creating the venv:

Terminal
uv venv --python 3.13

When uv run starts a project, it reads .python-version and the requires-python constraint in pyproject.toml, then picks or downloads a matching interpreter automatically.

Installing CLI Tools

uv ships with a tool manager similar to pipx. It installs Python-based CLIs in isolated environments so they do not pollute your system Python:

Terminal
uv tool install ruff

output

Resolved 1 package in 80ms
Installed 1 package in 12ms
+ ruff==0.9.2
Installed 1 executable: ruff

The ruff binary is now on your PATH. List, upgrade, or remove tools:

Terminal
uv tool list
uv tool upgrade ruff
uv tool uninstall ruff

To run a tool without installing it permanently, use uvx (an alias for uv tool run):

Terminal
uvx ruff check .

uvx downloads the tool into a cached environment, runs it, and reuses the cache on subsequent invocations. This is the fastest way to try a CLI without making it permanent.

Running Single-File Scripts

A Python script can declare its dependencies inline with a PEP 723 comment block. uv run reads that block and sets up an ephemeral environment before executing the script:

script.pypy
# /// script
# requires-python = ">=3.12"
# dependencies = [
# "requests",
# ]
# ///

import requests

response = requests.get("https://api.github.com")
print(response.status_code)

Run the script with:

Terminal
uv run script.py

uv creates a temporary venv, installs requests, runs the script, and keeps the environment in a cache for next time. This pattern is useful for small utilities and one-off automation where a full project is overkill.

Troubleshooting

uv: command not found after install
The installer places the binary in ~/.local/bin, which may not be on your PATH. Add it in your shell rc file: export PATH="$HOME/.local/bin:$PATH", then reload the shell. Verify with which uv.

Installation fails with “error: externally-managed-environment”
This message comes from system pip, not from uv. Use pipx install uv or the standalone installer instead. Installing Python packages into the system Python is discouraged on modern Ubuntu and Debian releases.

uv sync installs different versions than expected
Check that uv.lock is committed to your repository. Without the lockfile, uv sync falls back to resolving from pyproject.toml and may pick newer versions. Commit uv.lock to keep environments reproducible across machines.

uv cannot find a suitable Python interpreter
Run uv python install 3.12 (or whichever version your project requires) to let uv download a matching interpreter. The requires-python field in pyproject.toml tells uv which versions are acceptable.

Permission denied when installing to the system
uv does not need root. If a command prompts for sudo, the destination path is wrong. Use a project virtual environment or uv tool install for CLIs instead of writing to system directories.

FAQ

How is uv different from pip?
pip installs packages into an existing Python environment. uv is a full project manager: it creates and manages virtual environments, locks dependencies, installs Python interpreters, and runs scripts and tools. uv pip also provides a drop-in pip-compatible command for teams that want just the speed without adopting the full workflow.

Does uv replace Poetry or Hatch?
For most projects, yes. uv reads the standard pyproject.toml format used by Poetry and Hatch, manages lockfiles, and handles dependency groups. If you depend on specific features of Poetry plugins or Hatch build hooks, evaluate those needs before migrating.

Is uv compatible with existing requirements.txt workflows?
Yes. uv pip install -r requirements.txt works as a faster replacement for pip install -r, and uv pip compile generates a pinned requirements file from your unpinned input, similar to pip-compile from pip-tools.

Can I use uv with Docker?
Yes, and it is a good fit. The recommended pattern is to copy pyproject.toml and uv.lock first, run uv sync --frozen --no-install-project to install dependencies, then copy the rest of the source and run uv sync --frozen. This keeps the dependency layer cached across builds.

Where does uv store downloaded interpreters and package cache?
Interpreters go under ~/.local/share/uv/python/ and the package cache lives in ~/.cache/uv/. Both paths respect the XDG environment variables, so you can override them by setting XDG_DATA_HOME and XDG_CACHE_HOME.

Conclusion

uv rolls together the jobs that previously required pip, virtualenv, pip-tools, pipx, and pyenv into one fast binary. The speed is the headline feature, but the real payoff is a single, consistent workflow for projects, tools, scripts, and Python versions.

For related Python tooling on Linux, see the guide on installing Python on Ubuntu 24.04 and the guide on Python virtual environments .

How to Install Python on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Thu, 07 May 2026 20:15:00 +0200

When you start a Python project on Ubuntu 26.04, you already have a Python interpreter available. The usual setup work is installing pip, adding the venv module, or installing a separate Python version for a project that needs something other than Ubuntu’s default Python.

This guide explains how to install Python tooling on Ubuntu 26.04, how to use the deadsnakes PPA for alternate Python versions, and how to build Python from source when you need a specific upstream release.

Ubuntu 26.04 Default Python Version

Ubuntu 26.04 ships with Python 3.14 as the default Python 3 interpreter. To check the version on your system, run:

Terminal
python3 --version

output

Python 3.14.1

The exact patch version may change as Ubuntu publishes updates, but the default interpreter remains Python 3.14. Most users should keep this interpreter in place and use virtual environments for project packages.

Do not replace the /usr/bin/python3 interpreter. Ubuntu tools expect the distribution-provided Python version. If a project needs a different Python release, install it alongside the default interpreter and call it by its versioned command, such as python3.13 or python3.15.

Quick Reference

Task	Command
Check Ubuntu’s default Python version	`python3 --version`
Install pip and venv for the default Python	`sudo apt install python3-pip python3-venv`
Create a virtual environment with the default Python	`python3 -m venv myproject`
Add deadsnakes PPA	`sudo add-apt-repository ppa:deadsnakes/ppa`
Install Python 3.13 from PPA	`sudo apt install python3.13`
Install Python 3.15 preview from PPA	`sudo apt install python3.15`
Install venv module for PPA Python	`sudo apt install python3.13-venv`
Create a virtual environment with PPA Python	`python3.13 -m venv myproject`
Activate virtual environment	`source myproject/bin/activate`
Deactivate virtual environment	`deactivate`
Build from source	`./configure --enable-optimizations && make -j $(nproc)`
Install source build safely	`sudo make altinstall`

Installing pip and venv for the Default Python

If Ubuntu’s default Python 3.14 is enough for your work, install pip and the virtual environment module from the Ubuntu repositories.

First, update the package index:

Terminal
sudo apt update

Install pip and the virtual environment module:

Terminal
sudo apt install python3-pip python3-venv

Verify the installed commands:

Terminal
python3 --version
pip3 --version

On Ubuntu 26.04, python3 points to Python 3.14. Use a virtual environment for project dependencies instead of installing packages into the system Python environment.

Create a virtual environment with the default Python:

Terminal
python3 -m venv myproject

Activate it:

Terminal
source myproject/bin/activate

Inside the environment, python and pip point to the isolated project environment:

Terminal
python --version
python -m pip --version

When you are done working in the project, deactivate the environment:

Terminal
deactivate

Installing Python from the Deadsnakes PPA

The deadsnakes PPA provides alternate Python versions packaged for Ubuntu. It now supports Ubuntu 26.04, including packages for Python versions that Ubuntu does not provide as the default interpreter.

Deadsnakes does not provide Python 3.14 for Ubuntu 26.04 because Ubuntu already includes Python 3.14. Use the PPA when you need another interpreter, such as Python 3.13 or the Python 3.15 preview builds.

Install the prerequisites and add the PPA:

Terminal
sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository ppa:deadsnakes/ppa

Press Enter when prompted to confirm.

Install Python 3.13:
Terminal
```
sudo apt update
sudo apt install python3.13
```
To install the Python 3.15 preview package instead, replace python3.13 with python3.15:
Terminal
```
sudo apt install python3.15
```
Python 3.15 is still a preview release, so use it for testing rather than production workloads.
Verify the installation:
Terminal
```
python3.13 --version
```
The command prints the installed Python 3.13 patch release. You can also confirm the binary location:
Terminal
```
which python3.13
```
Install the venv module for the same interpreter:
Terminal
```
sudo apt install python3.13-venv
```
If you installed Python 3.15, use:
Terminal
```
sudo apt install python3.15-venv
```

Create a virtual environment and use pip inside it:

Terminal
python3.13 -m venv myproject
source myproject/bin/activate
python -m pip install --upgrade pip

Info

The system default python3 still points to Python 3.14. To use a PPA version, run python3.13, python3.15, or another explicit version command.

Installing Python from Source

Compiling Python from source allows you to install any version and customize the build options. However, you will not be able to manage the installation through the apt package manager.

The following steps show how to compile Python 3.14.4. If you are installing a different version, replace the version number in the commands below.

Install the libraries and dependencies required to build Python:

Terminal
sudo apt update
sudo apt install build-essential zlib1g-dev libncurses5-dev libgdbm-dev libnss3-dev libssl-dev libreadline-dev libffi-dev libsqlite3-dev wget libbz2-dev liblzma-dev

Download the source code from the Python download page using wget :
Terminal
```
wget https://www.python.org/ftp/python/3.14.4/Python-3.14.4.tgz
```
Extract the archive :
Terminal
```
tar -xf Python-3.14.4.tgz
```
Navigate to the source directory and run the configure script:
Terminal
```
cd Python-3.14.4
./configure --enable-optimizations
```
The --enable-optimizations flag runs profile-guided optimization tests, which makes the build slower but produces a faster Python binary.
Start the build process:
Terminal
```
make -j $(nproc)
```
The -j $(nproc) option uses all available CPU cores for a faster build.
Install the Python binaries using altinstall. Do not use install, as it overwrites the system python3 binary and can break system tools that depend on it:
Terminal
```
sudo make altinstall
```
Verify the installation:
Terminal
```
python3.14 --version
```
output
```
Python 3.14.4
```

Setting Up a Virtual Environment

After installing a new Python version, create a virtual environment for your project to keep dependencies isolated:

Terminal
python3.13 -m venv myproject

Activate the virtual environment:

Terminal
source myproject/bin/activate

Your shell prompt will change to show the environment name. Inside the virtual environment, python and pip point to the version you used to create it.

For a source-built Python 3.14 installation, use the versioned command:

Terminal
python3.14 -m venv myproject

To deactivate the virtual environment:

Terminal
deactivate

For more details, see our guide on how to create Python virtual environments .

Optional: Uninstalling the PPA Version

To remove the PPA version:

Terminal
sudo apt remove python3.13 python3.13-venv

To remove the PPA itself:

Terminal
sudo add-apt-repository --remove ppa:deadsnakes/ppa

Troubleshooting

python3 already exists after installation
This is expected. Ubuntu 26.04 includes Python 3.14 by default, so the default setup usually adds missing tools such as pip3 or venv.

pip reports an externally managed environment
Ubuntu protects system-managed Python packages. Create a virtual environment with python3 -m venv myproject, activate it, and install packages with python -m pip install package-name inside the environment.

No module named venv
Install the matching venv package. For Ubuntu’s default Python, run sudo apt install python3-venv. For Python 3.13 from the PPA, run sudo apt install python3.13-venv.

Unable to locate package python3.13 or python3.15
Run sudo apt update after adding the deadsnakes PPA. If the package is still unavailable, check that the PPA supports your Ubuntu release and CPU architecture.

python3 still shows Python 3.14
The python3 command should continue to use Ubuntu’s default interpreter. Run the alternate version with its versioned command, such as python3.13 or python3.15.

Python 3.15 shows an alpha version
Python 3.15 is still a preview release. Use it for testing compatibility, and use Python 3.14 or another stable release for production projects.

FAQ

Should I use the PPA or build from source?
Use the Ubuntu packages if Python 3.14 is enough. Use the deadsnakes PPA when you need an alternate packaged interpreter such as Python 3.13 or a Python 3.15 preview. Build from source only if you need a specific upstream patch release or a custom build configuration.

Will installing a new Python version break my system?
No. Both methods install the new version alongside the system Python 3.14. The system python3 command is not affected. You access the alternate version with python3.13, python3.15, or another explicit version command.

How do I make the new Python version the default?
You can use update-alternatives to configure it, but this is not recommended. Many Ubuntu system tools depend on the default python3 being the version that shipped with the OS. Use virtual environments instead.

How do I install pip for the new Python version?
The recommended approach is to use a virtual environment. Install the matching venv package, create a venv, activate it, and use python -m pip inside the environment.

What is the difference between install and altinstall when building from source?
altinstall installs a versioned binary such as python3.14 without creating a python3 symlink. install creates the symlink, which overwrites the system Python and can break Ubuntu system tools.

Does Ubuntu 26.04 include pip by default?
Ubuntu 26.04 includes Python 3.14 but does not include pip in the base installation. Install it with sudo apt install python3-pip. For alternate Python versions, use python -m pip inside a virtual environment.

Conclusion

Stick with Ubuntu’s Python 3.14 plus python3-pip and python3-venv for most projects. Reach for the deadsnakes PPA when a project pins to 3.13 or wants to test the 3.15 preview, and build from source only for a specific upstream patch.

For more on Python package management, see our guide on how to use pip .

fdisk Cheatsheet

hello@linuxize.com (Linuxize) — Thu, 07 May 2026 12:10:00 +0200

Basic Usage

Open a disk or print partition tables.

Command	Description
`sudo fdisk /dev/sdX`	Open a disk in interactive mode
`sudo fdisk -l`	List all detected partition tables
`sudo fdisk -l /dev/sdX`	List one disk partition table
`sudo fdisk --help`	Show command-line options
`sudo fdisk --version`	Show fdisk version

List Disks

Identify the correct device before changing partitions.

Command	Description
`lsblk`	Show disks, partitions, and mount points
`lsblk -d -o NAME,SIZE,MODEL`	Show whole disks only
`lsblk -f`	Show filesystems and UUIDs
`sudo fdisk -l`	Show partition tables with disk labels
`sudo fdisk -x /dev/sdX`	Show detailed partition information

Interactive Commands

Commands used inside the fdisk prompt.

Command	Description
`m`	Show help menu
`p`	Print the current partition table
`n`	Create a new partition
`d`	Delete a partition
`t`	Change partition type
`l`	List available partition types
`w`	Write changes and exit
`q`	Quit without saving

Partition Tables

Create a new disk label before adding partitions on a blank disk.

Command	Description
`g`	Create a new GPT partition table
`o`	Create a new MBR (DOS) partition table
`p`	Review the current table before saving
`w`	Write the new table to disk
`q`	Exit without writing changes

Create Partitions

Common answers while creating a new partition with n.

Input	Description
`n`	Start a new partition
`Enter`	Accept the default partition number
`Enter`	Accept the default first sector
`+1G`	Create a 1 GiB partition
`+100G`	Create a 100 GiB partition
`Enter`	Use the rest of the available disk space
`p`	Print the proposed layout
`w`	Save the changes

Partition Types

Set the partition type when the partition is not a regular Linux data partition.

Input	Description
`l`	List partition types
`t`	Change a partition type
`Linux filesystem`	Regular Linux data partition (GPT)
`Linux swap`	Swap partition (GPT)
`EFI System`	EFI System partition (GPT)
`Linux LVM`	LVM physical volume (GPT)
`Linux RAID`	Linux RAID member (GPT)
`83`	Regular Linux partition (MBR)
`82`	Swap partition (MBR)
`8e`	LVM partition (MBR)

Review and Save

Check the in-memory table before writing it to disk.

Command	Description
`p`	Print the pending partition table
`v`	Verify the partition table
`i`	Show details about a partition
`w`	Write changes to disk and exit
`q`	Quit without saving changes

Format and Mount

After writing the partition table, create a filesystem and mount the partition.

Command	Description
`sudo mkfs.ext4 /dev/sdX1`	Format a partition as ext4
`sudo mkswap /dev/sdX2`	Create swap on a partition
`sudo swapon /dev/sdX2`	Enable swap
`sudo mkdir -p /mnt/data`	Create a mount point
`sudo mount /dev/sdX1 /mnt/data`	Mount the partition
`lsblk -f`	Confirm filesystem and mount details

Safety Checks

Commands that help avoid editing the wrong disk.

Command	Description
`lsblk -d -o NAME,SIZE,MODEL`	Compare disk names, sizes, and models
`lsblk -f`	Check existing filesystems and mount points
`sudo fdisk -l /dev/sdX`	Review the current table before editing
`mount \| grep /dev/sdX`	Check whether partitions are mounted
`sudo umount /dev/sdX1`	Unmount a partition before changing it
`sudo partprobe /dev/sdX`	Ask the kernel to re-read the table

References for the full workflow around disks and partitions.

Tool	Description
`mount`	Mount and unmount filesystems
`mkfs.ext4`	Format a partition with a filesystem
`df`	Check filesystem disk usage
`fsck`	Check and repair filesystems

SFTP Cheatsheet

hello@linuxize.com (Linuxize) — Thu, 07 May 2026 07:00:00 +0100

Connect and Authenticate

Open an SFTP session against a remote host.

Command	Description
`sftp user@hostname`	Connect to remote server
`sftp user@192.168.1.10`	Connect by IP
`sftp -P 2222 user@hostname`	Connect to a custom SSH port
`sftp -i ~/.ssh/id_ed25519 user@hostname`	Connect with a specific key
`sftp -b commands.txt user@hostname`	Run commands from a batch file
`quit`	Quit session
`bye`	Quit session (alias for `quit`)

Local and Remote Paths

Navigate directories on both sides of the session.

Command	Description
`pwd`	Show remote working directory
`lpwd`	Show local working directory
`cd /remote/path`	Change remote directory
`lcd /local/path`	Change local directory
`ls`	List remote files
`lls`	List local files
`ls -la`	Long listing of remote files

Download Files

Pull files from the remote server to the local system.

Command	Description
`get file.txt`	Download one file
`get remote.txt local.txt`	Download and rename locally
`get -r remote_dir`	Download a directory recursively
`get -P file.txt`	Preserve file permissions and timestamps
`mget *.log`	Download multiple files matching a pattern
`reget large.iso`	Resume an interrupted download

Upload Files

Push local files to the remote server.

Command	Description
`put file.txt`	Upload one file
`put local.txt remote.txt`	Upload with a remote name
`put -r local_dir`	Upload a directory recursively
`put -P file.txt`	Preserve permissions and timestamps
`mput *.txt`	Upload multiple files
`reput large.iso`	Resume an interrupted upload

Remote File Management

Manage files and directories on the SFTP server.

Command	Description
`mkdir dirname`	Create remote directory
`rmdir dirname`	Remove empty remote directory
`rm file.txt`	Delete remote file
`rename old.txt new.txt`	Rename remote file
`ln source link`	Create a hard link on the remote
`ln -s source link`	Create a symbolic link on the remote
`df -h`	Show remote filesystem usage

Permissions and Ownership

Adjust permissions and ownership on remote files.

Command	Description
`chmod 644 file.txt`	Change remote file mode
`chown 1000 file.txt`	Change remote owner by UID
`chgrp 1000 file.txt`	Change remote group by GID
`umask 022`	Set default permission mask

Session Helpers

Inspect and control the active session.

Command	Description
`!command`	Run a local shell command
`!`	Drop into a local shell
`version`	Show SFTP protocol version
`progress`	Toggle transfer progress meter
`help` or `?`	List available SFTP commands

Non-Interactive and Scripting

Use SFTP from scripts and automated jobs.

Command	Description
`sftp -b script.txt user@host`	Run a batch file of commands
`sftp -q user@host`	Quiet mode (suppress banner and progress)
`sftp -o IdentityFile=key user@host`	Pass any `ssh_config` option
`echo "get file.txt" \| sftp -b - user@host`	Pipe commands via stdin

Other ways to move files between systems.

Tool	Description
`scp`	Secure copy over SSH
`rsync`	Efficient sync and incremental transfer
`ssh`	Underlying secure shell protocol
`ftp`	Legacy unencrypted file transfer

Bash Split String: Split a String by Delimiter

hello@linuxize.com (Linuxize) — Tue, 05 May 2026 15:30:00 +0200

When a script reads a CSV row, a colon-separated config line, or a piece of user input, one of the first things you usually need to do is break that string into its individual fields. Bash does not have a dedicated split function, but the shell gives you several ways to do the job with nothing more than built-ins and common core utilities.

This guide explains how to split a string by a delimiter in Bash using read, the IFS variable, tr, awk, and parameter expansion, with safe examples you can drop straight into a script.

The IFS Variable

Word splitting in Bash is controlled by the internal field separator, stored in the IFS variable. By default, IFS contains a space, a tab, and a newline, which is why unquoted expansions split on whitespace. When you set IFS to a single character such as a comma or a colon, Bash uses that character to decide where one field ends and the next begins.

Most of the techniques below work by changing IFS for one command only, so the rest of the script keeps the default behavior.

Splitting a String with read

The cleanest way to split a string into named variables is the read built-in combined with a temporary IFS:

sh
#!/bin/bash

STR="ubuntu:debian:fedora:arch"
IFS=":" read -r first second third fourth <<< "$STR"

echo "$first"
echo "$second"
echo "$third"
echo "$fourth"

Running the script produces one field per line:

output

ubuntu
debian
fedora
arch

The IFS=":" assignment applies only to the read command that follows it, so the global IFS stays untouched. The here-string (<<<) feeds the string into read on standard input, and -r keeps backslashes literal so they are not treated as escape characters.

Splitting Into a Bash Array

When the number of fields is not known ahead of time, split the string into an array instead of a fixed list of variables. Pass -a to read to tell it the target is an array:

sh
#!/bin/bash

STR="1,2,3,4,5"
IFS="," read -r -a numbers <<< "$STR"

for n in "${numbers[@]}"; do
 echo "$n"
done

The numbers array now holds one value per comma-separated field, and the loop prints each one on its own line. Always expand arrays with "${numbers[@]}" inside double quotes so elements that contain spaces stay intact.

For a deeper look at what else arrays can do, see our guide on Bash arrays .

Splitting With a Multi-Character Delimiter

IFS treats each character in its value as a separate delimiter, so setting IFS="::" will still split on single colons. For a multi-character delimiter such as :: or -, convert it to a single character first with sed or use parameter expansion:

sh
#!/bin/bash

STR="alpha::beta::gamma"
IFS="|" read -r -a parts <<< "${STR//::/|}"

for p in "${parts[@]}"; do
 echo "$p"
done

The ${STR//::/|} expansion replaces every occurrence of :: with a pipe character, and then read splits the resulting string on the pipe. Pick a placeholder character that you are sure the input does not contain.

Splitting With tr

When you only need the fields printed one per line, tr is often enough. It translates the delimiter into a newline:

Terminal
printf '%s\n' "red,green,blue" | tr ',' '\n'

output

red
green
blue

This approach pairs well with pipelines. For example, you can count the number of fields by piping the output into wc -l, or loop over the values with a while read block:

sh
#!/bin/bash

STR="red,green,blue"

while IFS= read -r color; do
 echo "Color: $color"
done < <(printf '%s\n' "$STR" | tr ',' '\n')

The process substitution <(...) sends the output of the pipeline into the loop without using a subshell for the loop body, so any variables you set inside the loop remain available after it ends.

Splitting With awk

For more structured splitting, awk is the right tool. It reads input one record at a time and exposes each field as $1, $2, and so on. Use -F to set the field separator:

Terminal
echo "jane:x:1001:1001:Jane Doe:/home/jane:/bin/bash" | awk -F':' '{ print $1, $5 }'

output

jane Jane Doe

awk is also a good pick when the delimiter is a regular expression, when you need to skip a header line, or when you want to act on a specific field without touching the rest. For more patterns, see our awk command guide .

Splitting With Parameter Expansion

Bash parameter expansion can pull a prefix or a suffix off a string without calling any external command. This is the fastest option when you only need one part, not all of them:

sh
#!/bin/bash

PATH_LINE="/usr/local/bin/script.sh"

BASE="${PATH_LINE##*/}"
DIR="${PATH_LINE%/*}"

echo "Directory: $DIR"
echo "Basename: $BASE"

output

Directory: /usr/local/bin
Basename: script.sh

##*/ strips the longest match of */ from the start of the string, leaving the basename. %/* strips the shortest match of /* from the end, leaving the directory. The same pattern works for any delimiter, not only the slash.

For full coverage of these expansions, see our guide on Bash string manipulation .

Preserving Empty Fields

A common surprise with read is that trailing empty fields can be dropped. Consider the string a,,b,:

sh
#!/bin/bash

STR="a,,b,"
IFS="," read -r -a fields <<< "${STR},"

echo "Count: ${#fields[@]}"
printf '[%s]\n' "${fields[@]}"

output

Count: 4
[a]
[]
[b]
[]

Bash keeps empty fields in the middle, but read -a drops a trailing empty field when the delimiter is the last character. Appending one extra delimiter before reading gives read a final empty value to assign, which preserves the trailing field from the original string.

Quick Reference

The table below summarizes which technique to reach for based on what the script needs to do.

Goal	Technique
Split into named variables	`IFS=":" read -r a b c <<< "$STR"`
Split into an array	`IFS="," read -r -a arr <<< "$STR"`
Multi-character delimiter	Replace with `${STR//::/\|}` first, then split
Print one field per line	`printf '%s\n' "$STR" \| tr ',' '\n'`
Select specific fields	`awk -F',' '{ print $2 }'`
Take prefix or suffix only	`${STR%%...}` / `${STR##...}`

For a printable quick reference, see the bash cheatsheet .

FAQ

How do I split a string by whitespace in Bash?
Leave IFS at its default and use read -r -a arr <<< "$STR". Any run of spaces, tabs, or newlines will act as a separator.

Why does my array lose the last empty field?
If the delimiter is at the very end of the string, read -a can drop the trailing empty element. Append one extra delimiter before reading, for example IFS=',' read -r -a arr <<< "${STR},", when the trailing empty field matters.

Can I split on a newline?
Yes. For line-based strings, use mapfile -t lines <<< "$STR" so each input line becomes one array element. Plain read stops at the first newline unless you change how it reads the input.

Is there a built-in split function in Bash?
No. Word splitting driven by IFS plus the read built-in is the idiomatic replacement for a dedicated split function.

Conclusion

Splitting strings in Bash comes down to picking the right tool for the shape of the input: read with IFS for structured parsing, tr or awk for pipelines, and parameter expansion for quick prefix or suffix work. When the input is untrusted, quote every expansion and handle empty fields on purpose rather than by accident.

cd Cheatsheet

hello@linuxize.com (Linuxize) — Sun, 03 May 2026 22:55:00 +0200

Basic Syntax

Core command forms for changing directories.

Command	Description
`cd [DIRECTORY]`	Change to a directory
`cd`	Change to your home directory
`cd -- DIRECTORY`	Change to a directory whose name may start with `-`
`pwd`	Print the current working directory

Common ways to move around the filesystem.

Command	Description
`cd /etc`	Change to an absolute path
`cd Downloads`	Change to a relative path
`cd ..`	Move up one directory
`cd ../..`	Move up two directories
`cd ./scripts`	Change to a directory under the current directory

Home Directories

Use shell shortcuts for your home directory and other users’ homes.

Command	Description
`cd ~`	Change to your home directory
`cd ~/Downloads`	Change to `Downloads` inside your home directory
`cd ~username`	Change to another user’s home directory
`cd "$HOME"`	Change to the directory stored in `$HOME`

Relative Paths

Build paths from your current directory.

Command	Description
`cd .`	Stay in the current directory
`cd ..`	Move to the parent directory
`cd ../src`	Move up one level, then into `src`
`cd ../../var`	Move up two levels, then into `var`
`cd project/docs`	Move through nested directories

Previous Directory

Switch between recently used directories.

Command	Description
`cd -`	Change to the previous working directory
`echo "$OLDPWD"`	Show the previous working directory
`cd "$OLDPWD"`	Change to the previous directory without using `cd -`
`pushd /path`	Change directory and save the old one on the stack
`popd`	Return to a directory from the stack

Paths with Spaces

Quote or escape paths that contain spaces or shell metacharacters.

Command	Description
`cd "Project Files"`	Quote a directory name with spaces
`cd 'Project Files'`	Use single quotes for a literal path
`cd Project\ Files`	Escape the space with a backslash
`cd -- "-reports"`	Enter a directory whose name starts with `-`

Symlinks and Physical Paths

Control whether cd follows logical or physical paths.

Command	Description
`cd -L linkdir`	Follow symbolic links (default in Bash)
`cd -P linkdir`	Resolve to the physical directory path
`pwd`	Show the shell’s logical current directory
`pwd -P`	Show the physical current directory
`cd -P ..`	Move using the physical directory structure

CDPATH

Search extra base directories when changing by name.

Command	Description
`export CDPATH=.:~/projects:/opt`	Search current directory, `~/projects`, and `/opt`
`cd myapp`	Try matching `myapp` in each `CDPATH` entry
`unset CDPATH`	Disable `CDPATH` for the current shell
`CDPATH= cd myapp`	Run one `cd` command without `CDPATH`

Troubleshooting

Quick checks for common directory-change errors.

Issue	Check
`No such file or directory`	Verify the path with `ls -ld path`
`Permission denied`	Check execute permission on the directory
Path with spaces fails	Quote the path or escape spaces
`cd -` fails	`$OLDPWD` is not set yet
Unexpected target with `CDPATH`	Run `unset CDPATH` or use an absolute path
Symlink path looks different	Compare `pwd` and `pwd -P`

Use these guides for detailed directory navigation workflows.

Guide	Description
`cd Command in Linux: Change Directories`	Full `cd` guide with examples
`How to Get the Current Working Directory in Linux`	Use `pwd` and understand the current directory
`pushd and popd Commands in Linux`	Work with the directory stack
`Linux Commands Cheatsheet`	General Linux command quick reference

Initial Server Setup on Ubuntu 26.04

hello@linuxize.com (Linuxize) — Sun, 03 May 2026 09:30:00 +0200

A fresh Ubuntu 26.04 server ships with root SSH access, no regular user, and no firewall rules. That works for the first login, but it is not a safe state to leave running on a public VPS.

This guide walks through the first tasks to perform on a new Ubuntu 26.04 server: creating a sudo user, enabling SSH key authentication, locking down SSH, configuring UFW, setting the hostname and timezone, and applying package updates.

Quick Reference

Task	Command or file
Log in as root	`ssh root@server_ip_address`
Create a user	`adduser username`
Grant sudo access	`usermod -aG sudo username`
Copy root SSH keys	`rsync --archive --chown=username:username /root/.ssh /home/username`
Add a local key	`ssh-copy-id username@server_ip_address`
SSH hardening file	`/etc/ssh/sshd_config.d/99-hardening.conf`
Test SSH config	`sudo sshd -t`
Allow SSH in UFW	`sudo ufw allow OpenSSH`
Set hostname	`sudo hostnamectl set-hostname server-name`
Set timezone	`sudo timedatectl set-timezone Europe/Berlin`

Prerequisites

Before starting, make sure you have:

A new Ubuntu 26.04 server with a public IP address.
Root access over SSH, either with a password or a provider-supplied key.
A local SSH key pair on your workstation. If you do not have one yet, see how to generate SSH keys on Linux .
Access to the provider web console as a backup path in case SSH access stops working.

Keep your original root SSH session open until you have tested the new user login and the hardened SSH configuration.

Log In as Root

Open a terminal on your local machine and connect to the server using the public IP address from your hosting provider:

Terminal
ssh root@server_ip_address

Accept the host key when prompted and enter the root password if password authentication is still enabled. If your provider created the server with an SSH key, the connection should use that key automatically.

Create a New Sudo User

Working as root for daily administration is risky because every command runs with full privileges. Create a regular user account and give it administrative access through the sudo group.

Replace username with the account name you want to use:

Terminal
adduser username

The command prompts for a password and optional user details. Enter a strong password, then press Enter to skip any fields you do not need.

Add the new user to the sudo group:

Terminal
usermod -aG sudo username

The account can now run administrative commands with sudo.

Set Up SSH Key Authentication

SSH keys are safer than password logins and are easier to use once configured. The exact command depends on where your public key is currently stored.

If your public key is already present under the root account, copy the root SSH directory to the new user:

Terminal
rsync --archive --chown=username:username /root/.ssh /home/username

If you need to copy a key from your local workstation, run this command from the local machine:

Terminal
ssh-copy-id username@server_ip_address

Open a new terminal window and test the login before changing the SSH server configuration:

Terminal
ssh username@server_ip_address

The connection should succeed as the new user. Keep both the root session and the new user session open while you continue.

After key-based login works, configure OpenSSH to reject direct root logins and password authentication. Ubuntu includes files from /etc/ssh/sshd_config.d/, which keeps local changes separate from the main SSH configuration file.

Create a hardening snippet:

Terminal
sudo nano /etc/ssh/sshd_config.d/99-hardening.conf

Add the following lines:

/etc/ssh/sshd_config.d/99-hardening.conftxt
PermitRootLogin no
PasswordAuthentication no

Save the file and test the SSH configuration syntax:

Terminal
sudo sshd -t

If the command prints no output, the configuration is valid. Reload SSH to apply the change:

Terminal
sudo systemctl reload ssh

Open another terminal and confirm that you can still log in as the regular user:

Terminal
ssh username@server_ip_address

Do not close your existing sessions until this test succeeds.

Set Up the Firewall with UFW

Ubuntu uses UFW (Uncomplicated Firewall) as a simple front-end for managing host firewall rules. Start by allowing SSH so the firewall does not block your current access:

Terminal
sudo ufw allow OpenSSH

Enable the firewall:

Terminal
sudo ufw enable

Confirm the prompt with y, then check the active rules:

Terminal
sudo ufw status

The output should show that OpenSSH is allowed:

output

Status: active
To Action From
-- ------ ----
OpenSSH ALLOW Anywhere
OpenSSH (v6) ALLOW Anywhere (v6)

When you install services such as Nginx or Apache, open their profiles before expecting traffic to reach them. For example, an Nginx server that should accept HTTP and HTTPS traffic needs:

Terminal
sudo ufw allow 'Nginx Full'

For more examples, see how to set up a firewall with UFW .

Set the Hostname

A descriptive hostname makes logs, shell prompts, monitoring alerts, and dashboards easier to read. Set the hostname with hostnamectl:

Terminal
sudo hostnamectl set-hostname server-name

Replace server-name with a short name that matches the server role, such as web-01 or db-01.

Check the result:

Terminal
hostnamectl

You can update DNS records or your local SSH config separately if you want to connect by name instead of IP address.

Set the Timezone

Set the server timezone so logs, cron jobs, and timestamps match the region you use for operations:

Terminal
sudo timedatectl set-timezone Europe/Berlin

List available zones if you are unsure of the exact name:

Terminal
timedatectl list-timezones

See how to set or change the timezone on Ubuntu for a deeper explanation.

Update the System

Refresh the package index and install pending updates:

Terminal
sudo apt update
sudo apt upgrade

If the upgrade installed a new kernel or core system libraries, reboot the server:

Terminal
sudo reboot

After the reboot, reconnect as the regular sudo user:

Terminal
ssh username@server_ip_address

Troubleshooting

Locked out after disabling password authentication
Use your provider web console or recovery mode to log in. Edit /etc/ssh/sshd_config.d/99-hardening.conf, temporarily set PasswordAuthentication yes, run sudo sshd -t, reload SSH, and test key login again before disabling passwords.

usermod: group 'sudo' does not exist
Some minimal images may not include the sudo package. Install it with apt install sudo, then rerun usermod -aG sudo username.

sshd -t reports an error
Read the line number in the error message, fix the snippet in /etc/ssh/sshd_config.d/99-hardening.conf, and run sudo sshd -t again. Do not reload SSH until the syntax test passes.

UFW blocks an expected service
Check the active rules with sudo ufw status. Allow the needed service profile or port, such as sudo ufw allow 'Nginx Full' for Nginx web traffic, then test the connection again.

Conclusion

You now have an Ubuntu 26.04 server with a sudo user, key-based SSH access, direct root logins disabled, a basic firewall, and current packages. A good next step is to enable automatic security updates before installing the rest of your stack.

netstat Cheatsheet

hello@linuxize.com (Linuxize) — Sat, 02 May 2026 10:30:00 +0100

Basic Syntax

Core netstat command forms and output controls.

Command	Description
`netstat`	Show active non-listening sockets
`sudo netstat -a`	Show all sockets
`sudo netstat -n`	Show numeric addresses and ports
`sudo netstat -p`	Show PID and program name where available
`sudo netstat -c`	Refresh output every second

Listening Ports

Find services that are accepting local connections.

Command	Description
`sudo netstat -tuln`	Show TCP and UDP listening sockets
`sudo netstat -tulnp`	Show listening sockets with PID and process name
`sudo netstat -tnlp`	Show listening TCP sockets only
`sudo netstat -unlp`	Show listening UDP sockets only
`sudo netstat -tulnp \| grep ':80'`	Find the process listening on port 80

Connections and TCP States

Inspect active connections and common TCP states.

Command	Description
`sudo netstat -at`	Show all TCP sockets
`sudo netstat -au`	Show all UDP sockets
`sudo netstat -ant`	Show TCP sockets with numeric addresses
`sudo netstat -ant \| grep ESTABLISHED`	Show established TCP connections
`sudo netstat -ant \| grep TIME_WAIT`	Show TCP connections in `TIME_WAIT`
`sudo netstat -atnc`	Watch TCP connection output continuously

Counts and Filters

Use shell filters with netstat output.

Command	Description
`sudo netstat -ant \| wc -l`	Count TCP output rows
`sudo netstat -ant \| grep ':80' \| wc -l`	Count TCP connections involving port 80
`sudo netstat -ant \| grep ESTABLISHED \| wc -l`	Count established TCP connections
`sudo netstat -tulnp \| grep nginx`	Find sockets owned by `nginx`
`sudo netstat -ant \| grep 203.0.113.10`	Filter connections by remote IP address

Routes, Interfaces, and Stats

Show routing, interface, and protocol information.

Command	Description
`netstat -rn`	Show the routing table with numeric addresses
`netstat -r`	Show the routing table with name resolution
`netstat -i`	Show interface counters
`netstat -ie`	Show extended interface details
`netstat -s`	Show protocol statistics
`netstat -st`	Show TCP protocol statistics
`netstat -su`	Show UDP protocol statistics

Modern Replacements

Use current Linux tools for new workflows and scripts.

netstat Command	Modern Command
`netstat -tuln`	`ss -tuln`
`sudo netstat -tulnp`	`sudo ss -tulnp`
`netstat -rn`	`ip route`
`netstat -i`	`ip -s link`
`netstat -s`	`ss -s`

Troubleshooting

Common netstat issues and quick fixes.

Issue	Check
`netstat: command not found`	Install the `net-tools` package or use `ss`
Process column is empty	Run with `sudo` when using `-p`
Output is slow	Add `-n` to disable name resolution
Port lookup matches too much	Search with a colon, such as `grep ':80'`
Need listeners only	Add `-l` with protocol flags such as `-tuln`

Use these guides for full walkthroughs and modern alternatives.

Guide	Description
`netstat` Command in Linux	Full `netstat` guide with examples
`ss` Command in Linux	Modern socket inspection tool
`ip` Command in Linux	Modern routes and interface management
How to Check Listening Ports in Linux	Compare `ss`, `netstat`, and `lsof`
`lsof` Command in Linux	Tie sockets and files back to processes

netstat Command in Linux: Network Connections and Statistics

hello@linuxize.com (Linuxize) — Sat, 02 May 2026 09:00:00 +0100

When something on a server is holding port 80, a connection is refusing to close, or a service is not reachable from the outside, the first question is almost always the same: what is actually listening, and who is talking to whom. For years, the answer on Linux was the netstat command.

netstat is part of the classic net-tools package and prints network connections, listening ports, routing tables, interface counters, and per-protocol statistics. It has been deprecated in favor of ss and ip , but it is still installed on many systems and the tool many sysadmins reach for first. This guide explains how to read its output and which flags cover the cases you run into day to day.

Install netstat

On most modern distributions, net-tools is not installed by default. If netstat is not available, install it with your package manager.

On Ubuntu, Debian, and Derivatives:

Terminal
sudo apt install net-tools

On Fedora, RHEL, and Derivatives:

Terminal
sudo dnf install net-tools

Once the package is installed, verify the binary is on your path:

Terminal
netstat --version

netstat Syntax

The general form of the command is:

txt
netstat [OPTIONS]

Run without options, netstat prints a list of open non-listening sockets, which is rarely what you want. In practice, you almost always pass a combination of flags that describe what kind of sockets you care about (TCP, UDP, Unix), what state they are in, and how you want the output formatted.

List All Connections

To list every connection, both listening and established, use the -a option:

Terminal
sudo netstat -a

The output is divided into two parts. The top lists Internet sockets with columns for protocol, receive and send queue sizes, local and foreign address, and state. The bottom lists Unix domain sockets used for local inter-process communication.

Running netstat with sudo is recommended because without it, the command cannot read socket ownership for processes that belong to other users.

Show TCP and UDP Connections

The -t and -u flags filter the output by protocol. To show only TCP connections:

Terminal
sudo netstat -at

To show only UDP connections:

Terminal
sudo netstat -au

You can combine both flags to get TCP and UDP together:

Terminal
sudo netstat -atu

Show Listening Ports

When you want to know which services are accepting new connections, use the -l option. For TCP, it restricts the output to sockets in the LISTEN state. UDP does not use the same connection states, but UDP sockets that are ready to receive traffic are still shown.

Terminal
sudo netstat -tuln

The combined flags read as: show TCP (-t) and UDP (-u) sockets that are listening (-l), with numeric addresses and ports (-n). The output looks similar to this:

output

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN
tcp6 0 0 :::80 :::* LISTEN
udp 0 0 0.0.0.0:68 0.0.0.0:*

From the output, we can see that SSH is listening on all interfaces on port 22, MySQL is bound to localhost only on port 3306, and a web server is listening on port 80 over IPv6.

Show the Process Using a Port

To find out which program owns a socket, add the -p option. It prints the PID and the process name next to each connection:

Terminal
sudo netstat -tulnp

output

Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 812/sshd
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 1034/mysqld
tcp6 0 0 :::80 :::* LISTEN 1591/nginx: master

The PID/Program name column ties each listening port to a process. This is the quickest way to find out which service is holding a port when you get an Address already in use error.

To check one specific port, pipe the output to grep :

Terminal
sudo netstat -tulnp | grep ':80'

If the command prints a row, a process is listening on port 80. If it prints nothing, no TCP or UDP listener matched that port on the local system.

Show Numeric Output

By default, netstat resolves IP addresses to hostnames and port numbers to service names (for example, 22 becomes ssh). On a busy system, this can be slow because each address needs a DNS lookup.

The -n option disables name resolution and prints raw numbers:

Terminal
sudo netstat -n

Numeric output is also easier to pipe into other tools such as grep or awk, because the field values are predictable.

Continuous Monitoring

The -c option tells netstat to print the output every second until you stop it with Ctrl+C. It is useful when you want to watch a connection appear, change state, and close:

Terminal
sudo netstat -atnc

Each iteration prints the full table again, so it is best used together with a filter such as grep to isolate a single connection.

Show TCP Connection States

TCP connections move through states such as ESTABLISHED, LISTEN, TIME_WAIT, and CLOSE_WAIT. To show active TCP sockets with numeric addresses, run:

Terminal
sudo netstat -ant

The State column tells you where each connection is in the TCP lifecycle:

output

Proto Recv-Q Send-Q Local Address Foreign Address State
tcp 0 0 192.168.1.10:22 192.168.1.5:52710 ESTABLISHED
tcp 0 0 192.168.1.10:80 203.0.113.25:51422 TIME_WAIT
tcp 0 0 127.0.0.1:3306 127.0.0.1:41834 CLOSE_WAIT

ESTABLISHED means the connection is active. TIME_WAIT is normal after a connection closes. A large number of CLOSE_WAIT entries can mean the local application is not closing sockets correctly.

To show only established TCP connections, filter the output:

Terminal
sudo netstat -ant | grep ESTABLISHED

For new troubleshooting work, ss gives better built-in state filters, such as ss -tn state established.

Count Connections

On busy web servers, you may want a quick count instead of a full connection table. To count all current TCP connections that involve port 80, run:

Terminal
sudo netstat -ant | grep ':80' | wc -l

To count only established connections on port 80, add the TCP state to the filter:

Terminal
sudo netstat -ant | grep ':80' | grep ESTABLISHED | wc -l

These counts are useful as a quick signal, but they are not a replacement for application metrics. The number can change while the pipeline is running, especially on high-traffic systems.

Display the Routing Table

To print the kernel IP routing table, use the -r option:

Terminal
netstat -rn

output

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
0.0.0.0 192.168.1.1 0.0.0.0 UG 0 0 0 eth0
192.168.1.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0

The first row is the default route, which sends all traffic not matching another rule to 192.168.1.1. The ip route command from ip is the modern equivalent and is what you should use on new systems.

Interface Statistics

The -i option prints a per-interface summary that includes received and transmitted packets, errors, drops, and the MTU:

Terminal
netstat -i

output

Kernel Interface table
Iface MTU RX-OK RX-ERR RX-DRP TX-OK TX-ERR TX-DRP Flg
eth0 1500 2345678 0 12 1987654 0 0 BMRU
lo 65536 55432 0 0 55432 0 0 LRU

A growing RX-ERR or TX-ERR column is a hint that you have a cabling, duplex, or driver issue on that interface.

Protocol Statistics

To print a summary of statistics for each protocol, use -s:

Terminal
netstat -s

The output is long and grouped by protocol (Ip, Tcp, Udp, and so on). It includes counters such as total packets received, segments retransmitted, and connection resets. You can narrow the output to a single protocol by combining -s with -t or -u:

Terminal
netstat -st

netstat vs ss

On modern Linux distributions, ss is the recommended replacement for netstat. It is faster and reads information directly from the kernel through Netlink, with richer filter support. The ip command replaces the routing and interface parts of netstat.

A few common translations:

netstat -tuln is equivalent to ss -tuln
netstat -tulnp is equivalent to sudo ss -tulnp
netstat -s maps to ss -s (a much shorter summary)
netstat -i maps to ip -s link
netstat -r maps to ip route

For a full walkthrough of the replacement tool, see the guide on the ss command .

Quick Reference

For a printable quick reference, see the netstat cheatsheet .

Command	Description
`netstat`	Show active non-listening sockets
`sudo netstat -a`	Show all listening and non-listening sockets
`sudo netstat -at`	Show all TCP sockets
`sudo netstat -au`	Show all UDP sockets
`sudo netstat -tuln`	Show TCP and UDP listening sockets with numeric output
`sudo netstat -tulnp`	Show listening sockets with PID and process name
`sudo netstat -tulnp \| grep ':80'`	Find the process listening on port 80
`sudo netstat -ant`	Show all TCP sockets with numeric addresses
`sudo netstat -ant \| grep ESTABLISHED`	Show established TCP connections
`sudo netstat -ant \| grep ':80' \| wc -l`	Count TCP connections involving port 80
`sudo netstat -atnc`	Refresh TCP connection output every second
`netstat -rn`	Show the routing table with numeric addresses
`netstat -i`	Show interface statistics
`netstat -s`	Show protocol statistics
`netstat -st`	Show TCP protocol statistics

Troubleshooting

netstat: command not found
The net-tools package is not installed. Install it with your package manager, or use ss instead.

No PID/Program name column shown
You need to run the command with sudo. Without root privileges, netstat cannot read process information for sockets owned by other users.

Output is slow or hangs
DNS resolution is slow or failing. Add the -n option to disable name lookups and print numeric addresses and ports.

A port shows up as LISTEN on :: but not on 0.0.0.0
The service is listening on the IPv6 wildcard address. On systems with dual-stack enabled, this accepts IPv4 traffic too. Check your IPv6 configuration if only IPv4 clients are failing.

FAQ

Is netstat deprecated?
Yes. The net-tools suite, which includes netstat, ifconfig, and route, has been deprecated for years in favor of the iproute2 tools ss and ip. It is still functional and still shipped by most distributions, but new scripts should target ss and ip.

What is the difference between netstat on Linux and Windows?
The command name is the same, and the general idea is the same, but the flags are different. This guide covers the Linux version from net-tools. On Windows, the closest equivalents to netstat -tulnp are netstat -ano and Get-NetTCPConnection in PowerShell.

How do I find what process is using a specific port?
Run sudo netstat -tulnp | grep ':PORT', replacing PORT with the port number. The last column shows the PID and program name. With ss, the same query is sudo ss -tulnp 'sport = :PORT'.

Why is a port still TIME_WAIT after I stopped the service?
TIME_WAIT is a normal TCP state that keeps a closed connection around for a short period so late packets can be handled safely. The kernel clears these entries automatically, usually within one or two minutes.

Conclusion

netstat remains useful when you need to inspect network connections on systems that still have net-tools installed. For new scripts and current Linux systems, prefer ss for sockets and ip for routes and interface statistics.

Dejan-Panovski on Linuxize

Linux Pipes Explained: How to Use the | Operator

Pipe Syntax #

How a Pipe Works #

A First Example #

Pipes Pass Data, Not Files #

Combining Pipes with xargs #

Reading the Exit Status of a Pipeline #

Pipes and Standard Error #

Named Pipes (FIFOs) #

Process Substitution #

Useful Pipe-Based One-Liners #

Quick Reference #

Troubleshooting #

Conclusion #

How to Deploy a Node.js Application on Ubuntu 26.04

Prerequisites #

Step 1: Install Node.js #

Step 2: Prepare a Deploy User and Directory #

Step 3: Get the Application onto the Server #

Step 4: Install PM2 and Run the App #

Step 5: Install and Configure Nginx #

Step 6: Add HTTPS with Certbot #

Step 7: Manage the App with PM2 #

Troubleshooting #

FAQ #

Conclusion #

Bash Array Operations: Length, Search, Slice, and Reverse

Sample Array #

Get the Array Length #

Check If an Array Contains a Value #

Slice an Array #

Reverse an Array #

Iterate Over Values and Indices #

Append and Prepend Elements #

Remove Array Elements #

Quick Reference #

Common Pitfalls #

Conclusion #

pnpm Command: Install and Manage Node.js Packages

Syntax #

How pnpm Stores Packages #

Install pnpm #

Install with Corepack #

Install with npm #

Install the Standalone Version #

Initialize a Project #

Install Packages #

Install Global Packages #

Update and Inspect Packages #

Remove Packages #

Run Scripts and Package Binaries #

Migrate a Project from npm #

Use pnpm Workspaces #

Quick Reference #

Troubleshooting #

Conclusion #

How to Install Ansible on Ubuntu 26.04 and Write Your First Playbook

Quick Reference #

Prerequisites #

Step 1: Install Ansible #

Step 2: Create an Inventory File #

Step 3: Test the Connection #

Step 4: Write Your First Playbook #

Step 5: Run the Playbook #

Step 6: Use ansible-vault for Secrets #

Troubleshooting #

FAQ #

Next Steps #

Ansible Cheatsheet

Install & Verify #

Inventory #

Inventory File (INI) #

Ad Hoc Commands #

Running Playbooks #

Common Modules #

Playbook Keywords #

Ansible Vault #

Galaxy & Collections #

OpenSSL Cheatsheet

Pipe Syntax

How a Pipe Works

A First Example

Pipes Pass Data, Not Files

Combining Pipes with xargs

Reading the Exit Status of a Pipeline

Pipes and Standard Error

Named Pipes (FIFOs)

Process Substitution

Useful Pipe-Based One-Liners

Quick Reference

Troubleshooting

Conclusion

Prerequisites

Step 1: Install Node.js

Step 2: Prepare a Deploy User and Directory

Step 3: Get the Application onto the Server

Step 4: Install PM2 and Run the App

Step 5: Install and Configure Nginx

Step 6: Add HTTPS with Certbot

Step 7: Manage the App with PM2

Troubleshooting

FAQ

Conclusion

Sample Array

Get the Array Length

Check If an Array Contains a Value

Slice an Array

Reverse an Array

Iterate Over Values and Indices

Append and Prepend Elements

Remove Array Elements

Quick Reference

Common Pitfalls

Conclusion

Syntax

How pnpm Stores Packages

Install pnpm

Install with Corepack

Install with npm

Install the Standalone Version

Initialize a Project

Install Packages

Install Global Packages

Update and Inspect Packages

Remove Packages

Run Scripts and Package Binaries

Migrate a Project from npm

Use pnpm Workspaces

Quick Reference

Troubleshooting

Conclusion

Quick Reference

Prerequisites

Step 1: Install Ansible

Step 2: Create an Inventory File

Step 3: Test the Connection

Step 4: Write Your First Playbook

Step 5: Run the Playbook

Step 6: Use ansible-vault for Secrets

Troubleshooting

FAQ

Next Steps

Install & Verify

Inventory

Inventory File (INI)

Ad Hoc Commands

Running Playbooks

Common Modules

Playbook Keywords

Ansible Vault

Galaxy & Collections

Version and Help

Private Keys

Certificate Signing Requests

Self-Signed Certificates

Certificate Inspection

Match Key, CSR, and Certificate

Format Conversion

TLS Connection Testing