DEV Community: Dharamraj Yadav

Mastering systemd, SSH, and Package Management

Dharamraj Yadav — Sun, 19 Jul 2026 11:39:17 +0000

Week 5 of My DevSecOps Journey — systemd, SSH & Package Management

This week was all about how a Linux server actually works behind the scenes. Three big things: how Linux runs services in the background (systemd), how you securely log into remote servers (SSH), and how you manage software on a server (package management). I also did real hands-on stuff on my own EC2 — building a service, setting up tunnels, and hardening SSH. Here's everything in my own words.

systemd: The Boss Process (PID 1) — what it is and why it exists

systemd is the first process that starts when linux boots, and it runs as PID 1. It's the parent of every other process in the system. systemd supervises them while the machine is on and restarts them if they crash. Because it's designed never to fail, if it died the whole system would go down with it.

That's the "why it exists" part — when a computer boots, something has to bring the whole system up (networking, logging, ssh) and keep it alive with no human sitting there. systemd is that something.

You can see it yourself:

ps -p 1        # this shows PID 1, and it will say systemd

Units and Their Four Types

A unit is one thing that systemd manages — "unit" is the general word, and there are several types. The four common ones:

.service = a running program / background job (e.g. a web server). This is where you declare what to run and how. The main type you'll use.
.target = a checkpoint that groups other units together. It runs nothing itself, it just means "this whole group of services should be on by now" (like multi-user.target).
.timer = a scheduler that starts another unit at a set time or interval. A modern replacement for cron.
.socket = a doorway that starts a service on demand, only when a connection actually arrives, instead of keeping it running all the time.

The way I think about it: a service is a doer (a program doing a job), and a target is a checkpoint (a milestone that just says a group of stuff is up).

You can list them:

systemctl list-units --type=service
systemctl list-units --type=target
systemctl status <name>

Old Init Systems vs systemd

The old init system — called SysV init — had several problems. It started services one at a time, sequentially, by running startup scripts, which made booting slow. It also didn't have any auto-restart mechanism — once a script ran, init forgot about it, so if the service crashed nobody noticed. And it could only control the order things started, not real dependencies.

New systemd fixed all of this. It runs services in parallel (much faster), it supervises them and restarts them if they crash, and it understands real dependencies. That's why the world moved from old systems to systemd.

Writing Your First Custom Service File

To register your own program with systemd, you write a small .service file. It's basically a form with three sections:

[Unit] = what it is
[Service] = how to run it
[Install] = when it starts

I created one for my own monitor script (it checks CPU, memory and disk usage). The file goes in /etc/systemd/system/:

sudo vim /etc/systemd/system/monitor.service

Inside:

[Unit]
Description=System monitor script (CPU, memory, disk)

[Service]
Type=oneshot
ExecStart=/home/aadi/system-monitoring/monitor.sh

[Install]
WantedBy=multi-user.target

One important thing here is Type=oneshot. My script runs once, does its job, and exits — it's not a forever-running program like a web server. oneshot tells systemd "this one runs once and finishes, that's normal, don't think it crashed."

After creating or editing the file, you have to tell systemd to re-read it (it doesn't notice new files automatically):

sudo systemctl daemon-reload        # always run this after editing a unit file
sudo systemctl start monitor        # run it now
systemctl status monitor            # check it
sudo systemctl enable monitor       # make it start at boot

Note: start and enable are two different things. start runs it right now. enable makes it start automatically at boot. When you enable a service, systemd just creates a symlink inside multi-user.target.wants/ — that folder is the target's "guest list," and at boot the target starts everything in it.

Also — use full paths in your script. systemd doesn't run inside your folder, so a relative path like ./logs will break. Always use the absolute path.

Dependencies — After, Requires, Wants

This is the part that confuses people, so I want to get it right. In a service file, order and requirement are two completely separate things:

After=X → start this after X. This is only about order, it doesn't mean you need X.
Wants=X → weak dependency: pull X in too, but start even if X fails.
Requires=X → strong dependency: if X fails or stops, stop this too.

The trap: Requires= says nothing about order. So Requires=postgresql.service on its own will start your app and the database at the same time — and your app might try to connect before the DB is ready. That's why you usually pair them:

Requires=postgresql.service
After=postgresql.service

Requirement says whether, ordering says when. You normally need both.

Reading Logs with journalctl

Every service that systemd runs writes its logs to one central place, and journalctl is the tool to read them. Think of it like the machine's diary.

The whole skill is filtering — you never read everything. The most useful command is -u, which shows only one service:

journalctl -u monitor.service      # only this service's logs
journalctl -u ssh -f               # follow live (Ctrl+C to exit)
journalctl -u ssh --since today    # only today's logs
journalctl -n 20                   # last 20 lines

Without -u, you get every program mixed together and it's unreadable. So -u <service> is what actually makes journalctl useful.

Timers — the Modern Cron

A timer is like an alarm clock that starts a service on a schedule. It comes as a pair: a .timer file (the when) and a .service file (the work). And if they have the same name — monitor.timer and monitor.service — systemd links them automatically.

I made a timer to run my monitor script every 2 minutes:

[Unit]
Description=Run system monitor every 2 minutes

[Timer]
OnBootSec=2min
OnUnitActiveSec=2min

[Install]
WantedBy=timers.target

OnBootSec = first run after boot. OnUnitActiveSec = repeat interval. For calendar-based scheduling (like "every night at 2am") you'd use OnCalendar instead.

One important thing: you start the timer, not the service:

sudo systemctl daemon-reload
sudo systemctl start monitor.timer
systemctl list-timers               # shows next fire time + which service it triggers

The cool part was opening journalctl -u monitor.service -f and watching my script fire on its own every 2 minutes, with nobody touching anything. That's when it clicked — my machine was monitoring itself automatically.

SSH — Key-Based Authentication

SSH (Secure Shell) lets you get a terminal on another machine over the network. Instead of logging in with a password (which bots can guess and which travels over the network), you use a key pair.

The way I understand it — think of a padlock and its key:

Public key (.pub) = the padlock. You can share it freely, and it goes on the server.
Private key = the secret key. It stays on your laptop and you never share it.

The server locks a challenge with your padlock, and only your private key can open it — and it does that on your own machine. So the secret never travels over the network. That's the whole win over passwords.

Generate a key:

ssh-keygen -t ed25519 -C "my laptop key"
ssh-copy-id user@host        # copies your public key onto the server

Fun fact: on AWS EC2, the .pem file AWS gives you is a private key. AWS already put the public half on the instance. So ssh -i key.pem ubuntu@IP is already key-based auth — I was doing it without realizing it.

The SSH Config File

Typing the full command every time is painful:

ssh -i ~/Downloads/testawsmachine.pem ubuntu@16.170.254.209

So you save all of that under a nickname in ~/.ssh/config:

Host testaws
    HostName 16.170.254.209
    User ubuntu
    IdentityFile ~/Downloads/testawsmachine.pem

Now I just type:

ssh testaws

It's not magic — SSH reads the config, expands the nickname back into the full command, and logs in with the key. Host is the nickname you type, HostName is the real address, User is the username, IdentityFile is the key.

SSH Tunneling — -L, -D, -R

This one bends your brain a bit. The core idea: one SSH connection can do two jobs at once — carry your terminal and carry other network traffic through the same encrypted connection.

The trick to remembering the flags: local = your laptop, remote = the server.

-L (local forwarding) → your laptop reaches into the server. Good for reaching a service on the server that isn't open to the internet (like a database).

ssh -L 8080:127.0.0.1:8080 testaws

I ran a tiny web server on my EC2 bound to 127.0.0.1 (so only the EC2 could see it), and using -L I opened it in my laptop's browser — reaching a "locked inside" service through SSH.

-D (dynamic forwarding = SOCKS proxy) → route anything through the server, so the world sees the server's IP instead of yours.

ssh -D 1080 testaws
curl --socks5 127.0.0.1:1080 https://api.ipify.org

When I ran that curl, it showed my EC2's IP, not my home IP — proof my traffic was going out through the server in Europe. This is how you'd route your browser through your own server.

-R (remote forwarding) → the mirror of -L. The server reaches back into your laptop. Good for exposing something running on your laptop through the server's public address.

ssh -R 9090:127.0.0.1:9090 testaws

I ran a server on my laptop and fetched it from inside the EC2 — a server in a data center reading files off my laptop, through the tunnel. Mind-bending but cool.

Quick summary:

-L → laptop into server (one fixed target)
-D → laptop to anywhere through the server (proxy)
-R → server back into laptop

There's also ssh-agent (holds your unlocked key in memory so you type the passphrase once) and the -A flag (agent forwarding, to carry your key identity to another server) — but only use -A with servers you trust.

Package Management — apt & dnf/yum

A server has no app store with buttons, so you install software by command. On Ubuntu that command is apt.

The thing that confused me at first is that it's a two-step process:

apt update = refresh the list of available software. This installs nothing.
apt upgrade = actually update the software you already have.
apt install X = install a new program.

sudo apt update              # do this FIRST
sudo apt upgrade             # update everything
sudo apt install tree        # install a package
sudo apt remove tree         # uninstall

If you skip apt update, apt might say "Unable to locate package" even for real software — because its list is stale. So always update first. (This actually happened to me.)

Other distros use different tools for the same job. Red Hat family (Amazon Linux, CentOS, Fedora) use yum or dnf:

apt update → dnf check-update
apt install X → dnf install X
apt upgrade → dnf upgrade

One gotcha: in dnf/yum, update means "install upgrades" — the opposite of apt's update. And dnf is just the newer version of yum.

SSH Hardening

This is where DevSecOps really starts — locking down the SSH server so attackers can't get in. The settings live in a file called sshd_config.

⚠️ The golden rule (learned this the important way): never lock yourself out. Always keep your working session open, test the config before restarting, and test a new login in a second terminal — and only close the original session once the new login works.

The two main changes:

PasswordAuthentication no → only key logins allowed. This kills password-guessing bots completely.
PermitRootLogin no → block direct login as root. "root" is the one username every attacker tries, so blocking it removes the obvious target.

The clean way I did it was to create my own config file (so I don't mess with what AWS set up). Files in /etc/ssh/sshd_config.d/ are read in order and the first setting wins, so a lower number wins:

sudo vim /etc/ssh/sshd_config.d/10-hardening.conf

PermitRootLogin no
PasswordAuthentication no

Then the safe workflow:

sudo sshd -t                      # test config (silent output = OK)
sudo systemctl restart ssh
# in a SECOND terminal, confirm you can still log in:
ssh testaws                       # should work
ssh root@testaws                  # should be DENIED — proof it worked

When I tried ssh root@testaws and got "Permission denied," that was the proof my hardening actually worked.

One real lesson: always check the current settings before changing them. On my EC2, AWS had already turned off password login by default — so I would've been "fixing" something that was already done. Check first, don't assume.

fail2ban — the Automatic Bouncer

Even with hardening, bots constantly hammer a public server trying to log in. fail2ban is an automatic bouncer for exactly this: it watches the login logs, and if one IP fails to log in too many times too fast, it automatically bans that IP at the firewall.

Its decision comes down to a few settings:

maxretry = how many failures before a ban
findtime = the time window those failures must happen in
bantime = how long the ban lasts
ignoreip = IPs that are never banned (put your own home IP here so you don't lock yourself out)

So the rule is basically: X failures within Y minutes → ban for Z minutes. A typical default is 5 failures in 10 minutes → ban.

The clever bit is that it's really rate-limiting — a human fumbling a login once in a while never trips it, but a bot firing thousands of attempts a second trips it instantly. Hardening makes attacks fail; fail2ban makes attackers go away. Two layers = defense in depth.

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

Wrap-up

That was Week 5. By the end of it I'd built a service that monitors my own machine, put it on a timer so it runs automatically, learned to read logs with journalctl, set up key-based SSH with config aliases, tunneled traffic three different ways, managed packages, and hardened my EC2 so root and password logins are blocked.

The biggest lesson wasn't any single command — it was that all this abstract stuff finally made sense when I did it with my own hands and watched it work on a real server. On to Week 6.

My First Bash Scripts: From Zero to Production-Quality

Dharamraj Yadav — Sat, 11 Jul 2026 16:15:43 +0000

What a bash script is

Bash script is a box of commands that used to run multiple commands at a time.

The Shebang (#!/bin/bash)

This is the very first line of the script that determine the shell, and based on the it'll execute the commands.

Making a script executable

When you create a script file you didn't have execute permission on that script file so you need to make that executable.

chmod u+x filename.sh

Variables

You can create variable like this

name="Dharam"

Make sure in the whole line don't have space if you add space anywhere that is not variable, and you can use the variable using the $ sign.

echo $name

And variable names are case-sensitive so if you use capital or small letter both are different variables.

name="Dharam"
Name="Aadi"

if you want to use the variable with text you we have double quote or single quote

Double Quote

name="Dharam"
echo "Hello my name is $name"
## it print this **Hello my name is Dharam**

when you use double quote it mean the doller sign represent the variable.

Single Quote

name="Dharam"
echo 'Hello my name is $name'
## it print this "Hello my name is $name"

Single quote use as a literal.

Arithmetic

When you want to do arithmetic operation you need to use

$((  ))

Conditions

Age determine script

#!/bin/bash
age=18

if [ "$age" -gt 20 ]
then
     echo "You are an adult"
fi

This is a very very simple conditions it only determine one condition. if you want to add multiple condition you need to use elif.

#!/bin/bash
marks=75

if [ "$marks" -ge 80 ]
then
     echo "You got a first division"
elif [ "$marks" -ge 60 ]
then
     echo "You got a second division"
elif [ "$marks" -ge 38 ]
then
     echo "You got a third division"
else
     echo "You are fail!"
fi

Condition Number comparisons

-ge, -gt, -le, -lt, -eq, -ne

case, esac and *) also use to for one value.

Loops

For Loop

#!/bin/bash

for num in {1..10}
do
    echo $num
done

This will print 1 to 10. for loop used to a fixed range we know the range.

While Loop

#!/bin/bash

count=0

while [ $count -lt 10 ]
do
    echo $count
    count=$(( count + 1 ))
done

While loop used to we don't know when the condition fullfill.

Until Loop

#!/bin/bash
count=1

until [ $count -gt 10 ]
do
    echo $count
    count=$(( count + 1 ))
done

The count loop is opposite of the while loop, it stops when the condition become true.

Functions

#!/bin/bash

name="Dharam"

greet(){
    echo "Hello My name is $name"
}

greet

The functions are used to do some certain tasks. and we can also pass the arguments to the functions:-

#!/bin/bash

greet(){
    echo "Hello My name is $1"
    echo "I'm learning the $2"
}

greet Dharam DevSecOps

The $1, $2 are the arguments value.

Error Handling (Production-Quality)

Remember we have two type of code one is 0 and second is except 0, 0 mean command run succeed properly if the exit code is not 0 it mean command failed.

Exit Code

if you want to see your last command exit code you can use the $? this'll shows the last command exit code

echo $?

&& And ||

&&

This used to if the first command is run with exit code 0 then run second one otherwise not.

cd /folder/not/exists && rm -rf *

if we didn't use the && and the command before && fails the second command also run, so we use the && to prevent second command to run if first command is fail.

||

This used to if the command is failed then run the second one.

cd /myfol || echo "Do not entered in the folder"

set -e

This is very important to use in bash script.

#!/bin/bash

set -e

echo "First Command"

cd /folder/not/exists

rm -rf *

The set -e stop the script if the any command failed. this is lifesaver.

set -u

Stop the script if the variable is undefined. use it like set -e.

set -o pipefail

set -o pipefail makes the whole pipe count as failed if any command in it fails (not just the last). So the failure shows up in the exit code instead of being hidden.

set -euo pipefail

You can use the all options together.

trap

This mean run the command if the script fail or succeed, it is very helpful when we want to clear something if you script fail or succeed. and also if you press ctrl c then also it run.

Understanding File Descriptors & Redirection in Linux

Dharamraj Yadav — Mon, 06 Jul 2026 18:35:04 +0000

File Descriptors

What is a File Descriptors

A file descriptor is simply a non-negative integer that the opreting system uses to identify an open file or I/O resources. in linux eveything is treating as a file, including a regular file, pipes, sockets, and devices. Every process starts with three standard file descriptor.

0 – stdin (standard input)
1 – stdout (standard output)
2 – stderr (standard error)

Redirection in Linux

>

single greater-than (>) redirection in linux used to overwrite the file. for example:-

echo "Hello" > file.txt

>>

double greater-than (>>) used to append in the file. for example:-

echo "My Name is Dharam" >> file.txt

<

less-than use to input from a file. for example:-

wc -c < file.txt

2>

redirect error to a file

ls -la not-exist-file.txt 2> error.log

2>&1

redirect error and without error output

ls -l file.txt test.txt > output.txt 2>&1

&> and &>>

sort version of 2>&1, this redirection also use to output and error.

tee

tee command used to view and redirect output.

ls -l testfile.txt | tee output.txt

| - Pipe

Pipe (|): Sends the output of one command directly as the input to another command.

How Linux Actually Runs Your Programs: Processes, Signals & systemd in Plain English

Dharamraj Yadav — Sat, 27 Jun 2026 16:32:16 +0000

Signals

What is signlas

Signals are mechanism to communicate between kernel and processes, and between processes. For example if we want to STOP the process we send SIGSTOP(kill STOP ) Signal and kernel deliver that signal to process.

Examples Of Signals

SIGTERM - Terminate the process
SIGSTOP - Stop The process
SIGKILL - Forcefully Kill a process
SIGINT - Interup the process

The kill command

kill command use for process to kill,terminate,stop etc.

Job Control & background processes

Foreground and Background

Foreground mean a process running on the screen right now and blocks the terminal and this is default behavior of the commands and background mean a process running in the background that not block the terminal

command &

for run process in background.

The & Operator

The & operator is used to run a process in the background. For Example:-

sleep 300 &

jobs, fg, bg commands

jobs - Displays the jobs running or stopped in the current shell.
fg - Brings a background and stopped job in the foreground.
bg - Resumes a stopped job in the background.

nohup command

nohub stand for No Hang Up. it allows a process to continue running even your terminal is closed or your SSH session disconnects.

nohup sleep 300

The process will keep running even if you close the terminal or disconnect your SSH session.

Viewing & monitoring processes

ps

Displays a snapshot of the processes running in the current terminal(current shell session).

ps aux

Displays a snapshot of the all running processes with details such as user,pid,CPU usage,memory usage,process state,time,command etc.

top

Displays a live, real time running processes with CPU and memory usage.

htop

Displays a live running processes in a interactive view. it is more user friendly version of top.

The State column in processes

Every process has a state that indicate its current status. The kernel maintain this state, and commands like ps and top display it to user:-

S - Sleeping
R - Running/Runnable
D - Uninterruptible Sleep (usually waiting for I/O)
I - Idle
Z - Zombie
T - Stops

and process state have some flags like:-

- - Running in the foreground
< - High Priority
l - Multi Threaded
s - Session leader
N - Low Priority
L - Pages locked in memory

Finding the top CPU processes

ps aux --sort=-%cpu

and if you want to see top memory consumer

ps aux --sort=-%mem

CPU vs Memory

CPU vs RAM

The CPU is the brain of the computer, The CPU executes instructions and performs calculations.
RAM is the computer's main memory, it stores the data and instructions that program are currently using.

Slow vs Crash

A System Slow indicates that one or more resources(CPU, RAM, Disk, Network) are heavily utilized, causing program to response slowly.
A System Crash occurs when the operating system and a application stops functioning correctly. one possible cause of out of memory.

The OOM Killar

The OOM is a linux kernel mechanism that is triggered when the system is out of memory. instead of allowing the system to become completely unresponsive, the kernel select a high usage CPU and kill that.

How many processes runs at a time?

Thousands of the process can exists in the system, but number of the process that can execute simultaneously depends on the number of logical CPU cores

Programs, Processes & Memory

Programs

Program is a set of of the instructions that store on disk.

Processes

Process is a running instance of the program.

Memory

Memory stores data and instructions that the CPU needs while executing a process.

Swap

Swap is a portion of disk space that linux uses as virtual memory when RAM becomes full.

Systemd

What is systemd

systemd is the first process that runs after the system boot. it ensure that all other essential processes and services are started. and it's PID is 1.

Process scheduling

Priority & the scheduler

Priority:- Every Process has priority for decide who run next. and that priority decide from nice if nice value is -20 it mean this is top priority and if process nice is 19 it mean it has low priority.
Scheduler:- A CPU Core only execute a process (or thread) at a time. the scheduler is just manage the who runs next and how much CPU time each process gets.

nice Value

The nice value determines the scheduling priority of a normal process. Every normal process has a nice value ranging from -20 to 19. A nice value of -20 gives the process highest priority, while 19 gives it the lowest priority.

nice and renice command

nice:- Sets the nice value (priority) of a process when starting the process.
renice:- Changes the nice value (priority) of a running process.

taskset command

The taskset command used to set or view the CPU affinity of a process. It allows you to specify which CPU core or cores a process is allowed to run on.

I Thought I Knew Linux — Then I Actually Learned It (Week 1)

Dharamraj Yadav — Sun, 21 Jun 2026 05:10:22 +0000

The Big Picture

Before you read this doc you must know english is my second language and this doc is have completely my own words not any AI, translator etc.

What an OS really is

An Operating System is software that manage every system resources and it also manage - Hardware, Kernel, and User space.

Kernel mode and User mode

Kernel mode handle every hardware related work and this is only thing that manage hardware. User mode is just showing us to running programs like right now you are in User mode, you never touch any hardware related things.

The Kernel's 4 Jobs

Process Management - Kernel manage every running process.
Memory Management - Kernel decides which process get how much memory.
Device Drivers - This is important job of kernel to manage devices(hardware, virtual).
System Calls - A system call is a how a program asks the kernel to do something fot it.

Users

Users are very important part of the OS bcz it create wall of processes and a single server can manage multiple users.

UID

Every user gets a UID so the kernel identify the user.

root

This is the BOSS of the system he can do anything in the system without any confirmation model and one more thing the root can do anything but it doesn't mean root have kernel mode this is steel in the user mode.

Groups

Every user have a group and we can manage the permissions on the group so we easily add/remove users from group.

The Shell & Basic Commands

What the shell actually is

The shell is a program where we run commands. shell is a interface between kernel and users.

Commands Structure

program + options + argument. ls -l /home
ls - program
-l - option
/home - argument

Core Commands

ls - list the data(files & Directories)
cat - View the inside file
echo - print something
touch - create a file
cp - copy anything
mv - move anything
rm - remove anything(you only remove files & directories that access you have)

Navigation

pwd - present working directory
cd - change directory
mkdir - create directory
rmdir - remove empty directory

Absolute & Relative Path

Absolute path mean full path of the file for example:- /home/user/directory/test.txt

Relative path mean only current folder path for example:- directory/test.txt

Wildcards(globbing)

- ls *.txt(now * mean find only .txt files) ? - ls filen?ame.txt(it mean now the ? find only one single letter)

Intermediate Commands

Searching/Viewing

grep - this cmds grep the exact line what we want(grep "findme" file.txt). -i(case insensitive) and -v(this exclude lines that containing findme) is options of this cmd.
sort - sort lines alphabetically.
head - bydefault print 10 top lines(head filename.txt)
tail - bydefault print 10 bottom lines(tail filename.txt)
less - not print everything in single time it wait for your keys(up, down, q etc.)

Finding/inspecting

find - this find in the subfolders also(but ls find only on the current directory)
locate - quickly find files and direcotries
diff - check differences between two files
file - details of any file

Variables & PATH

Shell Variables & Environment Variables

Shell variable are the private variables of the shell we can't use them in child programs but environment variable can do but before it we need to export that.

How shell finds commands

shell find cmds on the $PATH not in the whole system if sometime the program is installed but the shell throe error like (command not find) it mean that cmd is not in the $PATH

Editing, Help, Input/Output & Errors

Editing in the terminal

vi, vim, nano, these are the terminal editors.(vim filename.txt)
Getting Help: man, man -k, --help. (-k mean search keyword)
Redirection & Pipes: >(> mean overwrite the content), >>(>> mean append the text), | (| mean get output preview cmd)

Processes

What is process

Process is a running instance of the program and every process have a PID(we can kill the process by their PID)

Process Commands

ps: Show running Processes
ps aux: Show running processes with details
kill : kill process by their PID
kill -9 : forcefully kill the process
cmd &: & used for run process in background
ctrl c: stop running process from screen that running right now on screen

File Permissions

When we run the ls -l command you see something like this:-
-rwx-w-rw- 1 username groupname so on....
Breakdown of this:-

-> -(hyphen) mean this is a file rwx - r stand for read, w stand for write, x stand for execute. first 3 letter for owner, then 3 letter for group, and last three letter for others(other users). in our output(-rwx-w-rw-) you see -(hyphen) it mean this is file. then you see rwx it mean owner have read,write,execute permission. then you see (-w-) it mean group have only write permission not read not execute. and last 3(rw-) it mean others have read and write permission not execute.

Change the permission

chmod - it mean change mode so you can change the permissions like chmod 747. each permission have a number:-
read - 4
write - 2
execute - 1
if we want read(4) and write(2) permission to owner just run this command chmod 600. 00 mean no permission to group and other.
and we use something like chmod u+x, u+r. it mean please add execute and read permission for user(owner).

Symbolic Links

Symbolic link just like shortcut in window and alias in mac.
Commands for linux:-
ln -s target linkname
the -s stand for symbolic link OR soft link.

Archiving

tar command

tar mean bundle of the files & directories.
if you want to create a bundle just run this cmd:- tar -czf filename.tar yourstuffs
Options of the cmd:-
-czf - mean create
-tzf - mean show the list inside bundle
-xzf - mean extract the bundle

gzip command

gzip mean compress the file size of the bundle. it only used for create bundle + compress the size.
.tar.gz

Filesystem in Linux

In linux root you see this directories:-
etc, home, var, usr, tmp etc.

etc

This directory have only configuration related data.

home

This is only for users. how many users with there personal data.

var

This directory for the logs of the system and logs are inside /var/log

usr

This directory have most installed programs and /usr/bin have linux commands.

tmp

This directory have temporary data as it name.

Running Commands as super user(sudo)

Every linux user should know about this topic. coz it is very important to know. in linux you can't delete,view,run anything without permission and every user have permissions to what to do or not. some users have sudo access it mean they can install, delete anything in system without any permission bcz they have root access sudo stand for super user.

My First CI/CD Pipeline with YAML and Docker on AWS

Dharamraj Yadav — Tue, 17 Mar 2026 13:41:32 +0000

Hello everyone, today I want to share how I added my first CI/CD pipeline using YAML and Docker on AWS. First, I forked a React project on my GitHub because I didn’t want to waste time setting up React and adding a very simple app, so I decided to fork a project. Then I cloned that repository and added .dockerignore and Dockerfile files in my project’s root directory, and this is the code you can see in the screenshots:

After that, I created an EC2 instance to run my project and installed Docker. I added my Ubuntu user to Docker because Docker runs as root and the Ubuntu user doesn’t have access to that, so I added the user to the Docker group. Look at the screenshot I attached:

After that, I worked on the YAML for CI/CD. I created a .github folder in the root directory of my project, then created another folder called workflows, and in this folder I created a deploy.yml file. In this file, first I added the project name, after that I added on for when I push code to the main branch, then it triggers the action, and in the last I added my jobs. First, I used Ubuntu, then I checked out the code in that Ubuntu machine. After that, I copied this code to my EC2 machine, then SSH into my Ubuntu machine, then cd into my project, stop the running Docker container, build a new one, and run it. When I pushed the code, I saw my project was still not running, then I added an inbound rule in my EC2 machine because by default EC2 blocks other access points, so I added an inbound rule so everyone can access it.

Look at the YAML code screenshot and running project screenshot:

Learning Docker: Dockerfiles, .dockerignore, and Port Mapping 🐳

Dharamraj Yadav — Sat, 07 Mar 2026 10:56:14 +0000

Hey everyone! Here’s a quick update on what I learned last week. I finally got hands-on with two essential Docker files: the Dockerfile and .dockerignore.

First up, let's talk about the .dockerignore file. If you've used Git, this works exactly like .gitignore. When we build an image, this file prevents Docker from copying over unnecessary files and folders, which helps keep our final image clean and lightweight.
Here is my setup:

Next, I created the Dockerfile. This is basically the instruction manual for your project. We write down all the necessary commands in here, and Docker uses this file as the blueprint to build our custom image.
Take a look at the code:

After building the image, it was time to run it. This is where I learned how port mapping works. Port mapping is simply telling the Docker container, "Hey, forward your internal project port to this specific port on my local system."

In my setup below, I mapped the ports so my project runs on port 5173 inside the container's terminal, but I can actually access it in my local browser using port 3200.
Check out the terminal and browser screenshots:

Getting Started with Docker: Images, Containers, Volumes, and Networks 🐳

Dharamraj Yadav — Tue, 24 Feb 2026 11:15:43 +0000

Hello Everyone as part of my journey transitioning to DevSecOps, today i dove into Docker.

In simple terms Docker is a software platform that allows you to build, test and deploy your applications quickly. Today i learned about four core concept of Docker, and i want to share my understanding with you all.

1. Docker Images (The Blueprint)
An image is basically the blueprint for a container.We create this blueprint by writing some instructions inside a file called a Dockerfile. it contains everything your application needs to run - the code, runtime, libraries, and environment variables.

2. Docker Container (The Running App)
If an image is a blueprint, then a container is the actual building. A container is simply the running instance of a Docker Image. You can start, stop, or delete a container anytime without affecting the original image.

3. Docker Volume (Permanent Storage)
By default, data inside the container temporary. this is where a volume come in. Volumes provide permanent storage for your container's data by saving it directly to your hard drive.

Real World Example: Suppose we host a database(like mongoDB) inside a container, and we have 1,000 users registered. if we delete or restart the container, all the users data will be lost. To prevent this we use a volume to safety store that database information permanently on the host machine.

4. Docker Network (The Communication Bridge)
When we create and run multiple containers at the same time, they are completely isolated from each other by default for security.
However in real applications, they need to communicate. For example if i have a Node.js backend running in one container and a database in another container, they need to talk each other. We Use Docker Networks to create a secure connection between these isolated containers.

My Journey Continues
Understanding these four concepts completely changed how I look at deployments. No more "It work's on my machine".

Hello World: My Journey from MERN Stack to DevSecOps 🚀

Dharamraj Yadav — Sat, 21 Feb 2026 04:13:32 +0000

Hello everyone!

My name is Dharamraj Yadav, and this is my first post on this platform. I am currently working as a MERN Stack Developer, where I build web applications and craft APIs using Node.js. I have gained solid experience working across the MERN stack.

Recently, I’ve been observing my seniors handle server management, specifically focusing on reducing AWS infrastructure costs. Watching them work over the last three months really inspired me. I realized that with a bit of effort, I have the confidence to learn these new concepts myself.

So, I started using AI tools like Gemini to deeply understand how servers, deployments, and cloud infrastructure actually work.

Now, I have officially decided to start my #LearnInPublic journey—transitioning from a MERN Stack Developer to DevSecOps. ⚙️🛡️

Please connect with me to follow my journey, and stay tuned for more updates and learnings from the tech field!

DevSecOps #MERN #AWS #LearnInPublic #DevOpsJourney