Linux Architecture

What Is Linux Architecture?

Linux architecture describes how the system is layered from raw hardware up to the applications you run, and — critically — the strict boundary between kernel space (privileged, trusted code) and user space (unprivileged applications).

flowchart TB subgraph User Space APP1[Applications: bash, nginx, python] LIB[Libraries: glibc] end subgraph Kernel Space SYS[System Call Interface] PROC[Process Scheduler] MEM[Memory Manager] VFS[Virtual File System] NET[Network Stack] DRV[Device Drivers] end HW[Hardware: CPU, RAM, Disk, NIC] APP1 --> LIB --> SYS SYS --> PROC SYS --> MEM SYS --> VFS SYS --> NET PROC --> HW MEM --> HW VFS --> HW NET --> HW DRV --> HW

Why the Kernel/User Space Split Matters

Stability: A crashing user-space application (a bug in nginx) can’t take down the kernel or other processes.
Security: User-space code cannot directly touch hardware or arbitrary memory — it must ask the kernel via a system call.
Portability: Applications written against the POSIX/glibc API don’t need to know which CPU architecture or driver is underneath.

The Path of a Command: `cat file.txt`

Shell forks a child process (fork()), then exec()s /bin/cat.
cat calls open(), read(), write() — these are system calls, trapping into kernel mode.
The kernel’s VFS layer resolves the path, the actual filesystem driver (ext4, xfs) reads blocks from disk via the block layer and device driver.
Data is copied back into user-space buffers and printed to the terminal (another write() syscall to fd 1).

# Trace every syscall a command makes
strace -c cat file.txt

# See which syscalls take the most time
strace -T -e trace=open,read,write cat file.txt

Kernel Space vs User Space — Key Differences

	Kernel Space	User Space
Privilege	Full hardware access (ring 0)	Restricted (ring 3)
Crash impact	Can panic the whole system	Isolated to that process
Examples	Scheduler, VFS, network stack, drivers	bash, nginx, python, your app
Memory	Shared, protected	Isolated per process (virtual memory)

Production Considerations

Kernel panics are rare but catastrophic — always check dmesg / journalctl -k after unexplained reboots.
Loading third-party kernel modules (e.g., proprietary GPU/network drivers) puts untrusted code in kernel space — a bug there can crash the whole box.
perf and strace let you inspect the user-space ↔ kernel-space boundary without modifying code — invaluable for performance debugging.

Quick Interview Answer

“Linux splits the system into kernel space, which has full hardware access and manages processes, memory, and I/O, and user space, where applications run with restricted privileges and must go through system calls to request kernel services. This isolation is what keeps a crashing application from taking down the whole machine.”

Common Mistakes

Confusing “architecture” (the kernel/user-space design) with CPU architecture (x86_64 vs. ARM) — both terms exist, context matters.
Assuming a segfault in an application can crash the kernel — it can’t, unless the bug is in a kernel module or driver.