What Is Linux? History, Kernel and Basic File Commands

By Ravindra Bagale, trainer · LinkedIn · Last updated: 18 October 2026

1. What an operating system does

Why: Every command you type asks the OS to do something on the hardware for you. Knowing that layer explains why Linux matters for every server job.

What: an operating system (OS) is the system software between you, your apps and the hardware (CPU, RAM, disk, network).

1. You open an app, for example a word processor.
2. The OS finds the program on the disk, gives it RAM and CPU time, and starts it.
3. When the app saves a file, it asks the OS, and the OS writes to the disk.
4. Common operating systems: Windows, Linux, macOS, Android and iOS.

The everyday file and folder work an OS does, and its Linux commands, is in What Is Amazon EC2 and How Does It Work: what Linux is.

2. From UNIX to Linux: the timeline

Why: interviewers like history questions, and several popular versions of the story are wrong. Learn the order once, with the right facts.

The facts that matter:

1. 1969: Ken Thompson and Dennis Ritchie built UNIX at AT&T Bell Labs. Ritchie also created the C language, and UNIX was rewritten in C, which made it easy to move to new machines.
2. 1970s: UNIX was licensed, cheaply to universities, not given away as open source. Companies built their own commercial versions: IBM AIX, Sun Solaris and HP-UX.
3. 1983: Richard Stallman started the GNU project for a free UNIX-like system. By 1991 it had a shell, a compiler and the basic tools, but no finished kernel.
4. 1987: Andrew Tanenbaum, a professor in Amsterdam, published MINIX, a small teaching OS that came with his textbook. Linus Torvalds studied it from the book; Tanenbaum was not his teacher.
5. 1991: Torvalds, a student at the University of Helsinki, wrote a new kernel from scratch. Linux is UNIX-like: it behaves like UNIX but contains no UNIX code.
6. 2001: Mac OS X arrived, built on Darwin (BSD and NeXTSTEP). Today's macOS is certified UNIX; it did not grow out of Linux.

The story of the name "Linux", the GPL licence and who makes each distribution is in What Is Amazon EC2 and How Does It Work: distributions and how Linux was born. One update to remember: CentOS Linux has ended; CentOS Stream, Rocky Linux and AlmaLinux continue.

3. Kernel vs operating system: GNU + Linux

Why: "Linux is an operating system" is fine in daily talk. The precise interview answer is: Linux is a kernel.

What:

1. The kernel is one part of the OS: the core that manages memory, processes, files, drivers and the network, and talks to the hardware.
2. The commands you type every day, such as ls, cp, cat, touch, stat and tac, and the bash shell, come mostly from GNU.
3. GNU tools + the Linux kernel + an installer and a package manager = a distribution: Ubuntu, Debian, RHEL, Fedora, Amazon Linux, Kali.
4. That is why the full system is sometimes called GNU/Linux.
5. Business model: the code is free. Companies such as Red Hat earn from subscriptions: support, updates and certification. Canonical does the same for Ubuntu.

What the kernel does step by step when you type a command is shown in What Is Amazon EC2 and How Does It Work: the kernel.

4. Why companies run Linux

Why: Choosing an OS for servers is a business decision. These reasons are why almost every cloud server you will touch runs Linux.

What: most servers in the cloud run Linux, for these reasons:

1. Free: no licence fee per server. With hundreds of servers, that saves a lot, and there is no risk of using unlicensed copies.
2. Open source: anyone can read and change the code, so bugs are found and fixed by many people, and companies can tune it.
3. Secure by design: every file has an owner and permissions, normal users cannot change system files, and admin work needs sudo. A harmful program run by a normal user can damage that user's files, but not the system. Linux still needs updates and care; it is not immune.
4. Lightweight: servers run without a desktop, so they need less RAM and CPU. On EC2, Amazon Linux and Ubuntu start with an 8 GiB root volume by default, Windows Server with 30 GiB.
5. Multi-user and multitasking: many users can log in, and many programs run at the same time.
6. Choice: many distributions for different needs, from Amazon Linux on EC2 to Kali for security testing.
7. Automation: everything can be done with commands, so it can be scripted and repeated on a thousand servers.

5. Linux server and Windows desktop: the layers

Why: Seeing the layers side by side shows what a server leaves out (no desktop) and why it needs fewer resources than your laptop.

What:

1. Linux server: hardware, then the kernel, then the shell, then you. You type a command in the terminal; the shell reads it and asks the kernel; the kernel drives the hardware.
2. Windows desktop: hardware, then the Windows NT kernel, then system services and the shell, then a built-in GUI, then you. Your clicks pass through the GUI first.
3. Both have a kernel. The difference is that Windows has its GUI built in, while a Linux server usually has no GUI at all. Windows also has command lines (Command Prompt and PowerShell).
4. A shell is the program that takes your commands, usually bash on Linux. Shell scripting means saving commands in a file and running them together.

6. Windows words and Linux words

Why: Interviewers and teammates use the Linux words. Saying "directory" and "root" correctly marks you as someone who has worked on servers.

Use the Linux words at work and in interviews:

7. Five ways to create a file

Why: Each way suits a different job: an empty placeholder, a quick note, a long edit. Picking the right one saves time every day.

touch notes.txt
cat > notes.txt
echo "first line" > notes.txt
nano notes.txt
vi notes.txt

1. touch makes an empty file, or several at once: touch a.txt b.txt c.txt.
2. cat > takes what you type until Ctrl+D on an empty line.
3. echo "text" > file writes one line; >> adds it at the end instead.
4. nano and vi are editors for writing and changing text.

The basics of each, and the > trap, are in Linux files: touch, cat, nano and vi. The rest of this chapter covers what that chapter does not: timestamps, touch on an existing file, and more uses of cat.

8. The three timestamps, and stat

Why: when something breaks on a server, the first questions are "which file changed, and when?" The timestamps answer them.

What: every file has metadata, data about the file: size, owner, permissions and times. stat shows all of it.

1. Access (atime): when the content was last read.
2. Modify (mtime): when the content was last changed.
3. Change (ctime): when the content or the metadata was last changed: permissions, owner, name, size.
4. Birth: when the file was created, if the filesystem records it. Some systems show - here.

How:

touch notes.txt
stat notes.txt

The top lines show the size, inode, permissions and owner. The last four lines are the times:

Access: 2025-03-01 10:00:00.000000000 +0000
Modify: 2025-03-01 10:00:00.000000000 +0000
Change: 2025-03-01 10:00:00.000000000 +0000
 Birth: 2025-03-01 10:00:00.000000000 +0000

A new empty file has all four equal. ls -l shows only Modify; ls -lu shows Access and ls -lc shows Change.

One detail: Linux normally mounts disks with relatime. A read then updates Access only if Access is older than Modify or Change, or more than a day old. So reading a file twice in a row moves Access only once.

9. What touch does to an existing file

Why: touch on an existing file is used on purpose, for example to mark a file as just changed so a backup or build tool picks it up.

What: on a file that already exists, touch changes no content. It sets Access and Modify to now. You cannot set Change: the kernel updates it by itself whenever the file's metadata changes, and setting the other two times is such a change.

Worked example: each line runs a few minutes after the one before:

touch a.txt
echo hi > a.txt
cat a.txt
chmod 600 a.txt
touch a.txt
touch -d '2025-01-01 09:00' a.txt

1. touch a.txt at 10:00: a new empty file; Access, Modify and Change are all 10:00.
2. echo hi > a.txt at 10:05: new content, so Modify and Change become 10:05; Access stays 10:00.
3. cat a.txt at 10:10: a read, so only Access becomes 10:10.
4. chmod 600 a.txt at 10:15: metadata only, so only Change becomes 10:15.
5. touch a.txt at 10:20: Access and Modify become 10:20, and Change follows to 10:20.
6. touch -d '2025-01-01 09:00' a.txt at 10:25: Access and Modify now show that old date, but Change shows the real time, 10:25.

Run stat a.txt after each step to see it yourself. touch -a changes only Access, touch -m only Modify, and Change follows both. This is also why Change is useful in an investigation: someone can fake Access and Modify with touch -d, but not Change.

10. cat and tac

Why: cat joins and reads files in one step, and tac reads a log from the newest line first, which is where the latest error is.

What: cat (short for concatenate) has more uses than reading:

1. Read: cat n.txt prints the file.
2. Create: cat > n.txt, type lines, then Ctrl+D on an empty line.
3. Append: cat >> n.txt adds lines at the end.
4. Concatenate (join): cat a.txt n.txt > all.txt writes the lines of a.txt, then those of n.txt, into all.txt. This is where the name comes from.
5. Number the lines: cat -n n.txt.
6. Reverse: tac n.txt prints the lines from the last to the first. The name is cat spelled backwards.

Worked example:

printf 'one\ntwo\nthree\n' > n.txt
cat n.txt
tac n.txt
echo four >> n.txt
tac n.txt

1. cat n.txt prints one, two, three.
2. tac n.txt prints three, two, one.
3. After echo four >> n.txt, tac starts with four.
4. tac is handy for logs, where the newest lines are at the bottom.

cat cannot change a line in the middle of a file; use nano or vi for that.

11. What cloud is

Why: Everything in this course runs on someone else's servers. Knowing what "cloud" means is the base for every AWS service that follows.

What: cloud computing means using servers, storage, databases and networks in someone else's data centre, over the internet, on demand, and paying for what you use.

What a company needs to run its own servers on-premises:

1. Servers and storage.
2. A firewall, a gateway, switches and routers.
3. Internet links, electricity, backup power and air conditioning.
4. A server room, and staff to run it day and night.

The comparison table of on-premises and cloud, and the IaaS, PaaS and SaaS models, are in 5.1 Why EC2? Cloud vs on-premises.

12. Capex vs Opex

Why: The money model is why companies move to the cloud. Engineers who can explain it talk the same language as managers.

What:

1. Capex (capital expenditure): money paid up front for things the company buys and owns for years: servers, storage, firewall, switches, routers, racks, UPS, AC units, the server room.
2. Opex (operating expenditure): running costs paid every month: electricity, cooling, internet, staff salaries, maintenance. A cloud bill is also Opex.
3. On-premises needs a big Capex before the first visitor arrives, plus Opex every month.
4. Cloud needs almost no Capex: you rent capacity and pay as you go, so most of the cost becomes Opex that goes up and down with use.

13. Worked example: the server math of a three-day sale

Why: this one example explains why online shops love the cloud. Think of a big online store, such as Flipkart during its Big Billion Days sale. The numbers below are illustrative.

The situation:

1. On a normal day, 1 crore visitors use the site, and 50 servers handle them.
2. During a three-day sale, 10 crore visitors come every day. That needs about 500 servers, ten times more.

On-premises:

1. The site must survive the peak, so the company buys 500 servers. That is a large Capex.
2. It owns them all year: 500 × 365 = 182,500 server-days.
3. It needs only 50 × 362 + 500 × 3 = 19,600 server-days. About 11% of what it paid for is used; 450 servers sit idle for 362 days, still using power, cooling and space.

Cloud:

1. Run 50 servers all year.
2. Before the sale, add 450 more; after three days, release them.
3. Pay for 50 × 365 + 450 × 3 = 19,600 server-days, about 9 times fewer than owning 500.

The cloud features this example uses:

1. On-demand self-service: you start servers yourself in minutes, with no order to a vendor.
2. Elasticity: capacity grows for the peak and shrinks after it. On AWS, Auto Scaling does this for you.
3. Resource pooling: the provider shares a huge pool of hardware among many customers, so 450 servers are always available to rent.
4. Pay-as-you-go: you pay only for the hours you run.

14. Cloud providers

Why: Job posts name specific clouds. Knowing who the main providers are helps you read those posts and choose what to learn next.

1. AWS (Amazon Web Services) opened to the public in 2006 with S3 and then EC2. Being first helped it become the largest provider, and it is the most profitable part of Amazon.
2. Microsoft Azure and Google Cloud (GCP) are the next two big ones.
3. Others: Oracle Cloud, IBM Cloud and Alibaba Cloud.
4. The ideas are the same everywhere: servers, storage, networks, users and permissions. Learn AWS well first, and the others become easy to pick up.

15. What AWS and DevOps interviews ask most

Why: Knowing which topics come up most lets you spend practice time where it counts.

This is a rough guide from interview experience, not a rule. Every company is different.

AWS:

1. IAM: users, groups, roles and policies.
2. S3: buckets, storage classes and access.
3. EC2 and security groups: inbound and outbound rules.
4. VPC: the difference between a NACL and a security group is asked almost everywhere.
5. Load Balancer + Auto Scaling: scenario questions, such as "traffic doubles at 9 pm; what do you set up?"

DevOps, in a typical set of 10 questions:

1. About 3-4 on Docker and Kubernetes.
2. About 1-2 on Terraform and Jenkins.
3. About 1-2 on Git, GitHub Actions and Ansible.
4. The rest on Linux, networking and real scenarios.

How to prepare:

1. Do not spend most of your time on the easy tools and skip the hard ones. Kubernetes takes longer to learn, and it is asked more.
2. Learn each tool on its own first.
3. Then build one or two end-to-end projects that join them: code in Git, a Jenkins or GitHub Actions pipeline, a Docker image, deployment to Kubernetes, infrastructure from Terraform. In an interview, a project you built yourself answers many questions at once.
4. Know the differences between similar things, such as NACL and security group, or Docker and Kubernetes. Mixing them up is like putting salt in tea instead of sugar.

16. When something looks wrong

Why: The timestamps don't always move the way you expect. These notes stop you from thinking stat is broken.

1. Access did not change after cat: relatime is at work; Access moves only if it is older than Modify or Change, or more than a day old.
2. touch -d did not change the Change time: Change cannot be set; it always shows when the metadata really changed.
3. stat shows Birth: -: this filesystem or kernel does not record creation time. Use the other three.
4. cat > file emptied a file: a single > replaces the content; use >> to add.
5. ls -l shows a different time than stat's Access: ls -l shows Modify. Use ls -lu for Access and ls -lc for Change.
6. cat floods the screen on a big file: use less file, tail file, or tac file | head.

17. The whole class on one page

1. An OS sits between apps and hardware. Linux, Windows, macOS, Android and iOS are operating systems.
2. UNIX was born at Bell Labs in 1969 and licensed; GNU started in 1983; Torvalds wrote the Linux kernel in 1991 from scratch. MINIX was Tanenbaum's teaching OS, and macOS is built on Darwin (BSD).
3. Linux is a kernel; GNU tools + the kernel + extras make a distribution. Companies pay for support, not for the code.
4. Linux is free, open source, lightweight (8 GiB default root volume vs 30 GiB for Windows Server on EC2) and secure through users, permissions and sudo.
5. Linux server: hardware, kernel, shell, user. Windows desktop adds a built-in GUI; it also has a kernel.
6. Directory, root, package, terminal: use the Linux words.
7. Files can be created with touch, cat >, echo >, nano and vi.
8. stat shows Access (read), Modify (content), Change (content or metadata) and Birth.
9. touch on an existing file sets Access and Modify to now; Change follows by itself and can never be set.
10. cat reads, creates, appends, joins and numbers; tac prints the lines in reverse.
11. Cloud = someone else's data centre, over the internet, on demand, pay-as-you-go.
12. Capex = buying hardware up front; Opex = running costs. Cloud turns most cost into Opex.
13. For a three-day peak, owning 500 servers costs 182,500 server-days; renting the extra 450 costs 19,600.
14. AWS, Azure and GCP lead. A rough interview guide: NACL vs security group, Load Balancer + Auto Scaling, Docker and Kubernetes; then build end-to-end projects.

18. Hands-on lab: create files and read their timestamps

Why this lab. When something breaks on a server, the first question is "what changed, and when?". This lab creates files in different ways and watches the three timestamps move.

1. Create files three ways
   • Command: mkdir -p ~/ts && cd ~/ts && touch a.txt && echo "first line" > n.txt && cat > c.txt
   • You should see: The cursor waits; type hello, Enter, then Ctrl+D.
   • Check: ls -l shows a.txt (size 0), c.txt and n.txt.
   • Why: touch for an empty file, echo > for one line, cat > for a few lines without opening an editor.
2. Read the timestamps
   • Command: stat n.txt
   • You should see: Access:, Modify:, Change: and Birth: lines, all with nearly the same time.
   • Check: Birth: may show - on some filesystems; that is normal.
   • Why: A new file has all its times equal. Every later step changes some of them, and stat shows which.
3. Change the content
   • Command: sleep 2 && echo "second line" >> n.txt && stat n.txt
   • You should see: Modify: and Change: are newer than Access:.
   • Check: cat n.txt shows two lines.
   • Why: Writing changes the content (Modify) and the file's size, which is metadata (Change). The 2-second wait makes the difference visible.
4. Change only the permissions
   • Command: sleep 2 && chmod 600 n.txt && stat n.txt
   • You should see: Only Change: moved forward; Modify: stayed.
   • Check: stat also shows Access: (0600/-rw-------).
   • Why: chmod changes metadata, not content. That is the difference between Modify and Change.
5. touch an existing file
   • Command: sleep 2 && touch n.txt && stat n.txt
   • You should see: Access:, Modify: and Change: all show the new time.
   • Check: cat n.txt still shows the same two lines.
   • Why: touch sets Access and Modify to now without touching content; setting them is itself a metadata change, so Change moves too.
6. Join files with cat
   • Command: cat n.txt c.txt > all.txt && cat all.txt
   • You should see: first line, second line, hello.
   • Check: wc -l all.txt → 3 all.txt
   • Why: "cat" is short for concatenate: several files in, one stream out.
7. Read backwards with tac
   • Command: tac all.txt
   • You should see: hello, second line, first line.
   • Check: The last line comes first.
   • Why: In a log the newest lines are at the bottom. tac shows them first.
8. Clean up
   • Command: cd && rm -r ~/ts
   • You should see: Nothing.
   • Check: ls ~ no longer shows ts. Stop the instance.
   • Why: Keep the home folder tidy for the next chapter.

19. Try at home

Recap

Quick revision cards

Revise this lesson in two minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens its lesson.

More cards: Ravi Sir's Cards.