›What's the difference between a hard link and a symbolic link?
A hard link is a second directory entry pointing at the same inode — the same data on disk, indistinguishable from the "original," and it survives the original being deleted. A symbolic link is a separate file containing a path to another file — it breaks if the target moves or is deleted, but unlike a hard link it can point across filesystems and to directories.
›What's the difference between SIGTERM and SIGKILL?
SIGTERM (kill PID) asks a process to terminate gracefully — it can catch the signal, flush buffers, close
connections, and exit cleanly. SIGKILL (kill -9 PID) terminates immediately at the kernel level; the process gets
no chance to clean up. Always try SIGTERM first — reach for SIGKILL only when a process is genuinely unresponsive.
›What does a Linux load average actually measure?
The average number of processes either running on a CPU or waiting for one (plus, on Linux, processes in uninterruptible I/O wait), over the last 1, 5 and 15 minutes. It's only meaningful relative to core count — a load of 4 is fully saturating a 4-core box and comfortably idle on a 16-core one.
›What happens when a Linux system runs out of memory?
The kernel's OOM killer selects a process (weighted by memory usage and an adjustable "badness" score) and kills it
outright to free memory, rather than letting the whole system deadlock. It's visible in dmesg or
journalctl -k, and it's a common, confusing cause of a process dying with no application-level error at all.
›What's the difference between a process and a thread?
A process has its own isolated memory space, file descriptors and address space. Threads within a process share that memory and most resources, but each has its own stack and execution context — creating a thread is much cheaper than forking a process, at the cost of needing explicit synchronization for shared state.
›What does the sticky bit do on a directory?
Set with chmod +t, it restricts deletion or renaming of files inside a directory to the file's owner (or root),
even when the directory itself is group/world-writable. /tmp is the canonical example — everyone can create files
there, but nobody can delete someone else's.
›What's the difference between a soft link (symlink) and a bind mount?
A symlink is filesystem-level indirection — a file containing a path, resolved by whatever reads it. A bind mount makes a directory (or file) appear at a second location at the kernel/VFS level — the same underlying data, accessible from two paths, including working transparently inside a container that only has one of those paths namespaced in.
›How would you find what's consuming disk space on a full filesystem?
df -h to confirm which filesystem, then du -sh /path/* | sort -rh | head repeated a level deeper into whatever's
largest. If du and df disagree significantly, suspect a process holding a deleted file open — check with
lsof +L1, which won't show up in a normal directory walk at all.
›What's the difference between environment variables set in ~/.bashrc versus /etc/environment?
~/.bashrc runs for interactive non-login shells for one user and can contain arbitrary shell logic. /etc/environment
is a simple key=value file read by PAM at login, applying system-wide to every user and every session type
(including non-interactive ones like cron or systemd services) — the right place for something that must be
consistently set everywhere, not just in an interactive terminal.