Certification coverage

• Ports: a process listens, or nothing answers

What is missing: The lessons read kernel parameters with `sysctl` to explain what a port or a socket is doing; none sets one, and `/etc/sysctl.d/` — where a change survives a reboot — is not taught.

• What is running: processes
• Signals, and why kill -9 is the last resort
• Foreground, background and jobs
• Reading a status, and the four verbs
• Reading logs with journalctl
• Restart policies, and the crash loop they hide
• From a symptom to one component: what the hypothesis forbids

• Scheduling a task: cron or a systemd timer
• When the previous run has not finished
• A script you can run twice

• Updating a server with apt
• Installing and removing software
• Where a package puts its files
• Installing Docker: the official repository, not Ubuntu's
• Telling what changed on disk

• Rebuilding the whole machine, in the right order
• Restoring, and making the drill routine
• Restoring files, and the owners nobody backed up
• Verify before declaring success, and what a rollback does not undo

What is missing: Recovering data and rebuilding a machine from its backups is taught in full; recovering a machine that will not boot — the rescue shell, `fsck` on an unmounted filesystem, a broken bootloader — is not.

What is missing: Nothing in the curriculum runs a hypervisor. `libvirt`, `virsh` and virtual machine images are absent; every lesson administers a machine somebody else provisioned.

• Image, container, volume — and when to do without
• Installing Docker: the official repository, not Ubuntu's
• A Dockerfile for a Node application
• Data outlives the container, the port goes through the firewall
• Compose: the application and its database in one file
• The log file nothing is rotating
• A container with no memory limit, and the process the kernel kills instead

• AppArmor: the refusal permissions do not explain

What is missing: The blueprint names SELinux. The curriculum teaches mandatory access control through AppArmor, which is what Ubuntu ships — the concept transfers, the commands do not: `getenforce`, `semanage`, `restorecon` and file contexts have to be learnt elsewhere.

• Addresses, interfaces and routes
• Reading a prefix, bit by bit
• The fix that lasts until the next reboot
• A complete static address, without gateway4
• The second address family, already running on your machine
• A query's path, and the propagation myth
• What the application asks, and why dig answers a different question

What is missing: Static IPv4 configuration is now taught end to end — the prefix worked out, the address, the default route and the resolvers written into Netplan, and the distinction between live state and the file that decides at boot. IPv6 is read rather than configured: no lesson assigns a static IPv6 address.

• Two logs that say 14:02: a timestamp is not a number
• Clocks that agree with each other

• Ports: a process listens, or nothing answers
• Refused or silent: what each failure proves
• Unreachable: find the broken layer before touching anything
• Works on the server, refused from outside
• Dropped here or never arrived: one capture decides
• What a failed lookup tells you, and whose problem it is

• Connecting for the first time
• Moving SSH to key authentication
• The agent, the passphrase, and what ssh -A really lends
• A key is a line, and the line takes options
• Hardening the SSH daemon without locking yourself out

• ufw: deny by default without locking yourself out
• Three writers, one ruleset: reading what the kernel holds
• The undo you schedule before you need it
• Forwarding a port is not permitting one
• When the addresses ran out: the table that rewrites your packets
• Data outlives the container, the port goes through the firewall

• Addresses, interfaces and routes
• Neighbour or not: the test run on every packet
• A second route, and knowing it is the one used

• A bridge: the switch you already have
• Bonding two cards, without doubling the speed
• A VLAN is not a subnet

What is missing: A bridge, a bond and a VLAN interface are each built and read back, every command executed before it was printed. One reservation: the `802.3ad` half of bonding requires a switch configuration the lessons name without teaching — the curriculum configures no network equipment.

• Two backends behind one Nginx
• An address that changes machines
• Reverse proxying a Node application
• Which server block answers, and why the wrong site sometimes does
• The limits that refuse: 413 and 504
• Reading the error log: why the 502 happened

What is missing: Both halves are taught as of 2026-09-21, the day the one-machine boundary was crossed for that chapter alone: an `upstream {}` block with two servers, what `max_fails` actually does, and a floating address over VRRP. One reservation worth knowing: those two lessons rest on the vendors' documentation rather than a verified run, Nginx and keepalived not being installable on the authoring machine. They say so themselves.

What is missing: No lesson touches LVM. Every filesystem in the curriculum is the one the installer created.

• What is running: processes
• Busy doing what: reading the processor line

What is missing: `/proc` is read where it explains something — a process's working directory, the counters `top` reads — and `/etc/fstab` appears where systemd turns its lines into mount units. Writing a mount yourself, and what the kernel exposes under `/sys`, are not taught.

• Disk, memory and load: reading them correctly
• Restoring files, and the owners nobody backed up

What is missing: Troubleshooting a filesystem — a disk full with nothing to delete, inodes exhausted, ownership lost on restore — is taught with labs. Creating one with `mkfs`, checking it with `fsck` and mounting it yourself are not.

What is missing: No NFS, no iSCSI, no network block device. Off-site copies travel by `rsync` over SSH, which is a transfer, not a mounted filesystem.

• Disk, memory and load: reading them correctly

What is missing: Reading swap as a sign of memory pressure, in `free` and `vmstat`, is taught. Creating, sizing or removing swap is not.

What is missing: Nothing in the curriculum mounts on demand. `.automount` is named once, as one of systemd's eleven unit types, and never used; `autofs` does not appear.

• Which disk, and how long each request took
• Trends, not instants
• pg_wal fills, and something is holding it

• What a commit actually contains
• Answering "what changed?"
• What never goes into history
• Going back without rewriting history
• Moving history between machines
• Reading a repository somebody else branched
• Naming what is deployable

• Your first systemd unit
• Units, targets and what depends on what
• Configuration and secrets a unit can read
• Changing a packaged unit without losing your change
• Disabling a service is not stopping it

• Disk, memory and load: reading them correctly
• Busy doing what: reading the processor line
• Which disk, and how long each request took
• An automated check that is worth having
• What an output proves, and what "success" does not
• The check that cannot fail, and the flush that proves nothing

• Changing a packaged unit without losing your change
• A hundred connections, and the arithmetic that exceeds them
• The limits that refuse: 413 and 504
• A container with no memory limit, and the process the kernel kills instead

• Disk, memory and load: reading them correctly
• Controlling log growth
• Why a DELETE returns no space
• pg_wal fills, and something is holding it
• The log file nothing is rotating

• Ninety days, and nothing will warn you
• Checking from outside the machine

• Who am I on this system?
• Creating and removing accounts
• Locking a password is not closing an account
• sudo, and why nobody works as root
• Becoming someone else, and which shell you get

• Scheduling a task: cron or a systemd timer
• Configuration and secrets a unit can read
• What is a shell?

What is missing: The difference between an interactive shell's environment and a service's is taught where it bites — a script that works at the prompt and fails under cron or systemd. `/etc/profile`, `/etc/environment` and the order in which `~/.bashrc` and its siblings load are not.

• Changing a packaged unit without losing your change
• A hundred connections, and the arithmetic that exceeds them

What is missing: Limits are taught per service — `LimitNOFILE=` in a unit, a database's connection ceiling — never per user: `ulimit`, `/etc/security/limits.conf` and PAM's part in applying them are absent.

• A directory two accounts share, done properly
• Where a file's permissions come from
• Restoring files, and the owners nobody backed up

What is missing: Every account in the curriculum is local. No lesson joins a machine to a directory service.