Lesson 01

The Anatomy
of Linux

"Linux" is not one thing. It's a stack — layers of software, each with a specific job, each independently replaceable. Understanding the stack is understanding why Linux works the way it does, and why you have choices that don't exist elsewhere.

5 layers
1 quiz question
~10 min read

The Stack

Five layers.
Each one optional.

Every time you click an icon on a Linux desktop, software from all five layers is involved. Most operating systems hide this. Linux exposes it — and lets you swap out any layer you don't like.

L5 Hardware CPU · RAM · GPU · Storage · Network

The physical machine. CPU, RAM, GPU, disk, network interfaces. Linux speaks to hardware through drivers — small programs that translate the kernel's generic instructions into hardware-specific signals. Most drivers ship with the kernel itself.

Check your hardware

lscpu # CPU info free -h # RAM (watch "available", not "free") lspci # PCI devices: GPU, NIC, etc. lsblk # Block storage devices
L4 Linux Kernel The actual "Linux"

This is what "Linux" actually refers to. The kernel is the core program that manages hardware access, memory, processes, and the filesystem. Every other piece of software sits on top of it. Linus Torvalds wrote the first version in 1991 and still leads development today.

RAM behavior — read this

$ free -h total used free shared buff/cache available Mem: 15Gi 6.2Gi 400Mi 1.1Gi 8.4Gi 8.0Gi

RAM will look 90% full on a healthy Linux system. That is normal. The kernel aggressively fills available RAM with disk and file cache — pages it has read before that it keeps in memory in case you need them again. This makes your system faster. Watch available, not free. Available = what could be freed if a program needed it. Free = what is sitting literally empty right now.

L3 Display Server X11 / Xorg · Wayland

The display server is the intermediary between your GPU and everything that draws pixels on screen. It handles input events (keyboard, mouse), manages windows as surfaces, and coordinates who gets to draw what and when. X11 (Xorg) has been around since 1984. It is actively maintained, cared for, and fed — do not believe obituaries. Wayland is a newer protocol with better security and GPU integration, but has coverage gaps in gaming, screen capture, and remote desktop that X11 doesn't.

Check which you're running

echo $XDG_SESSION_TYPE # prints: x11 or wayland loginctl show-session $XDG_SESSION_ID -p Type
L2 Window Manager i3 · Openbox · Sway · Mutter · KWin

The window manager decides where windows live on screen, how you move and resize them, and what the window borders (if any) look like. It's a separate program from the display server — a subtlety that matters. Tiling managers (i3, Sway) automatically arrange windows in a grid with no overlapping. Floating managers (Openbox, Fluxbox) let you drag windows freely, like Windows or macOS. Desktop environments ship their own window manager (GNOME uses Mutter; KDE uses KWin) but you can swap them out.

Check your window manager

wmctrl -m # or echo $GDMSESSION
L1 Applications & Shell bash · zsh · Firefox · GIMP · Steam

Everything you actually use lives here: browsers, editors, games, terminals. The shell (bash, zsh, fish) is the command interpreter — what runs when you open a terminal. It is itself just an application sitting at layer 1, but it's the one that talks to every other layer. Most Linux configuration happens through the shell, which is why learning it matters.

Check your shell

echo $SHELL # common answers: /bin/bash /bin/zsh /usr/bin/fish cat /etc/shells # all available shells on your system

Key Terms

The vocabulary.

These words get thrown around constantly in Linux discussions. Know what they actually mean and you'll stop feeling lost in documentation and forums.

Core
Kernel
The actual Linux program — manages hardware, memory, processes, and filesystems. Everything else runs on top of it. This is what Linus maintains.
$ uname -r → 6.8.0-76060800
Boot
Init System
The first program the kernel starts after boot. Responsible for starting every other service on your machine. Most modern distros use systemd.
$ systemctl status
Display
Display Server
Manages the screen, windows, and input devices. Sits between your GPU and every program that draws pixels. Either X11 (Xorg) or Wayland.
$ echo $XDG_SESSION_TYPE
Display
Display Manager
The graphical login screen (GDM, SDDM, LightDM). It starts the display server and launches your session. Completely separate from the desktop environment.
GNOME → GDM · KDE → SDDM
Display
Compositor
Renders windows to a back buffer before displaying them — enables transparency, shadows, animations. On Wayland, the compositor and window manager are typically merged into one program.
Picom (X11) · KWin (Wayland/X11)
Windowing
Window Manager
Controls window placement, borders, focus behavior, and keyboard shortcuts for managing windows. Can be used alone (minimal setups) or as part of a full desktop environment.
i3 · Openbox · Fluxbox · Mutter
Windowing
Desktop Environment
A bundled set of software: window manager, file manager, settings panel, notification system, app launcher. Designed to work together. Trading flexibility for convenience.
GNOME · KDE Plasma · XFCE
Shell
Shell
The command interpreter — what you type commands into in a terminal. bash is universal, zsh is feature-rich (default on macOS), fish has the best autocomplete out of the box. They're all just programs.
bash · zsh · fish · dash
Software
Package Manager
How software installs, updates, and removes itself on your system. Every major distro has one. It resolves dependencies automatically and keeps everything consistent — the feature Windows and macOS never got right.
apt · pacman · dnf · zypper
Software
Repository
A trusted server that hosts packages your package manager can download from. Distros maintain official repos; communities maintain unofficial ones (like the AUR). You control which repos your system trusts.
stable · testing · unstable · AUR
Identity
Distribution
A curated combination of kernel + init system + package manager + default software + installer. Ubuntu and Arch both run the Linux kernel, but almost everything else is different.
Ubuntu · Debian · Arch · Fedora
Toolkit
GTK vs Qt
The two dominant GUI toolkits. GNOME apps use GTK; KDE apps use Qt. You can run either on any desktop — they just may look slightly mismatched without theming. Not a war you need to pick a side in.
GTK: Firefox, GIMP · Qt: VLC, OBS

Appendix H: Init Systems — SysV, Upstart, systemd →