In one of my new years resolution for 2026 I said to myself that I’d be reading more books, to further my vocabulary and skills. That is a ever evolving aspect I’d like to chase my whole life.
In that pursuit I recently picked up a Book called “How Linux works: What every superuser should know” from Brian Ward:
It goes pretty deep into, what a coincidence, Linux in general. And the heart of it all is obviously the Linux Kernel – since I have always heard about “Kernels” but never really understood it in detail, I gave myself the challenge to break this down in this blog.
/introduction
If you have ever used an Android phone, browsed a website or streamed a movie, you’ve almost certainly relied on Linux without even knowing about it – Friends and Family today don’t even know that most of the Internet runs on something called Linux. It runs quietly in the background of it all in modern technology. And as previously mentioned, in the center of it all, that does most of the heavy lifting is the kernel
/what is the linux kernel?
A kernel is a program in the core of an operating system. It’s the second thing that loads when your computer boots, and keeps it running the entire time your machine is on. The first, just fyi, is the bootloader. That in itself does a lot of things but one part is, fetching the Kernel and copying it into the RAM.
Here’s a common point of confusion: Linux and the Linux Kernel aren’t quite the same thing. Strictly speaking, “Linux” is the kernel. What most people, and me included, call “Linux” (Ubuntu, Fedora, Debian etc.) is a complete operating system built around that kernel and bundled with a desktop, applications and tools. Those bundles are called distributions, or also refered as distros. Every one of them, no matter how different they look, runs the same family of kernel underneath.
A metaphor I’d use to describe it simpler is: Think of the kernel as the manager of a busy restaurant. Customers (the applications you’re running) place orders but they never walk into the kitchen themselves. The manager takes every request, decides who gets served first, talks to the kitchen staff (the hardware), and makes sure nobody walks off with someone else’s meal.
-> Without the manager, everything here would be chaos, and thats the kernel.
/what does the kernel actually do?
The kernel as people in the industry may know, does a lot of things at once. We could group them into:
CPU and process management – Your computer runs a dozens of programs perceived as “at the same time”, but a process can only do so much in any given moment. Here I’d like to reference and quote the book above: “Consider a system with one-core CPU. Many processes may be able to use the CPU, but only one process can actually use the CPU at any given time. In practice, each process uses the CPU for a small fraction of a second; then another process uses the CPU for another small fraction of a Second, then pauses; then another makes a turn , and so on“
This behavior of one process giving up control of the CPU and pausing etc. is called a “context switch”, and each piece of time in this procedure is called “time slice”. It gives a process the right amount of time and significant computation.
Memory management – Ever running program needs space in the RAM. Every context switch from the process management before needs memory management. The kernel hands out that space, tracks who has what, and reclaims it when a program closes, a bit like a librarian assigning desks and clearing them when people leave.
Device Drivers and Management – Beyond just translating, the kernel keeps track of every device over its whole life on your system. It detects hardware the moment it appears, loads the matching driver, hands out the resources the devices needs and cleans up when it’s unplugged. This is what makes plug and play work, like using an USB.
Good to know is, that the devices are normally accessible only in kernel mode because if something bad would access, for example the process of asking to turn off the power, the system could crash the machine.
System Calls – Since appss aren’t allowed to touch hardware directly, the kernel offers a fixed menu of services they can request. Things like “open this file”, “give me more memory”, or “start a new program”. A request like this is called a system call (or short syscalls), and handling them is one of the kernel’s core jobs. It checks that the request is allowed, does the privileged work and passes the result back.
There are two syscalls that are important to understand:
– fork(): this syscall creates an almost identical copy of the process it needs
– exec(): when this syscall is called, the kernel loads and starts the program, replacing the current process
When you enter “ls” into the command line to show a content of a folder, the terminal calls fork() to create a copy of the shell. Then the new copy of the shell calls exec(ls) to run “ls” in your terminal.
In the book there is a handy picture that looks like this (badly drawn by my ASCII skills):
/why the linux kernel is important
There are a lot of reasons for why this matters in practice:
- Performance. A well-built kernel squeezes the most out of your hardware, which is why Linux powers everything from tiny gadgets to massive servers.
- Stability. Linux systems are famous for running for months or even years without a reboot (reboot it when possible though do avoid long term sys failures)
- Security. Strong permission handling makes it harder for malware to take over.
- Hardware support. The kernel works with a staggering range of devices, old and new. (unless you unfortunately use NVIDIA graphics cards, then it can be hell for you setting that up, speaking of experience)
- Updates. Kernel updates patch security holes, add support for new hardware, and improve speed.
/useful linux terminologies
A few terms you will likely bump into as you go:
- System calls – as previously said is the official way programs ask the kernel for something. “open this”, “send this data over there”.
- Kernel Space vs User Space. The kernel runs in a protected are called kernel space, with full control over the hardware. Your applications run in user space, walled off from the sensitive stuff. This separation is a safety barrier. If an app crashes, it can’t drag the whole system down -> Think of blast radius.
/conclusion
The kernel is the part of Linux you’ll rarely see but always depend on. It manages your processor and memory, talks to your hardware, organizes your files and keeps everything secure, all while going unnoticed by everyone.
You don’t need to understand every line of kernel code to use Linux well. But knowing what the kernel is and what it does gives you a mental map of how the whole system fits together.
So the next time you are on a linux machine, open the terminal and run uname -r to see which kernel version you’re on right now. Or just use fastfetch as everybody else, which is way cooler looking.
