sysadmin
utils to manage a linux system

apt list installed packages

apt list --installed

cleanup packages

sudo apt update
sudo apt clean
sudo apt autoclean
sudo apt autoremove
pip cache purge

journalctl --disk-usage
sudo journalctl --vacuum-size=100M
sudo journalctl --vacuum-time=2weeks

sudo snap list --all | awk '/disabled/{print $1, $3}' |
    while read snapname revision; do
        sudo snap remove "$snapname" --revision="$revision"
    done

pnpm has better options than npm because it reuses many installation libraries

sudo apt install npm
sudo npm install -g pnpm

to check what packages we installed

npm list -g

/usr/local/lib
└── eslint@10.4.1

npm ls -g 

/usr/local/lib
└── eslint@10.4.1

I prefer pnpm which shares node_modules directories

pnpm config set store-dir ~/.pnpm-store
#cat "store-dir=~/.pnpm-store\nshamefully-hoist=true\nglobal-dir=~/.config/node_modules\ncache-dir=~/.cache/pnpm\ncolor=auto\nloglevel=info" > ~/.npmrc
pnpm config get store-dir

Remove package

dropbox stop
dropbox status  # Should report "not running"
rm -rf ~/.dropbox-dist
rm -rf /var/lib/dropbox
rm -rf ~/.dropbox*
sudo apt-get remove nautilus-dropbox
sudo apt-get remove dropbox
rm /etc/apt/source.d/dropbox

Fix broken not working

sudo dpkg --force-all --configure -a
sudo dpkg --purge --force-depends libnettle6 
sudo apt --fix-broken install
sudo apt-get -f install
sudo apt update & sudo apt upgrade

Many packages suffer with locale different from en_US.UTF-8

locale  # check for UTF-8
sudo apt update && sudo apt install locales
sudo locale-gen en_US en_US.UTF-8
sudo update-locale LC_ALL=en_US.UTF-8 LANG=en_US.UTF-8
export LANG=en_US.UTF-8
locale  # verify settings

tmux

pstree | head -5

systemd-+-ModemManager---3*[{ModemManager}]
        |-NetworkManager---3*[{NetworkManager}]
        |-accounts-daemon---3*[{accounts-daemon}]
        |-avahi-daemon---avahi-daemon
        |-bluetoothd

systemctl --type=service --state=running

ss -tlnp | grep 13305

LISTEN 0      4096         0.0.0.0:13305      0.0.0.0:*                                          
LISTEN 0      4096            [::]:13305         [::]:*                                          

# View running processes
ps   aux | head -10
#ps -ef --sort=-%cpu
#+BEGIN_SRC shell

USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0  28020 12880 ?        Ss   Jun15   4:08 /usr/lib/systemd/systemd --switched-root --system --deserialize=52 splash
root           2  0.0  0.0      0     0 ?        S    Jun15   0:01 [kthreadd]
root           3  0.0  0.0      0     0 ?        S    Jun15   0:00 [pool_workqueue_release]
root           4  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-rcu_gp]
root           5  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-sync_wq]
root           6  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-kvfree_rcu_reclaim]
root           7  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-slub_flushwq]
root           8  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/R-netns]
root          10  0.0  0.0      0     0 ?        I<   Jun15   0:00 [kworker/0:0H-kblockd]

kill -9 <PID>
pkill -f <process-name>
sudo systemctl stop <service>

= User Management =

# Add user
sudo adduser <username>
# Remove user
sudo deluser <username>
sudo userdel -r <username>
# View users
sudo cat /etc/passwd

= File System & Disk =

# Check disk space
df -h

# Check filesystem errors
sudo fsck -f /dev/<device>

# View inode usage
sudo du -sh /* | sort -hr

= Network Diagnostics =

# Test connectivity
ping -c 4 <hostname>
traceroute <hostname>
dig <hostname>

# Check open ports
sudo netstat -tulpn
sudo ss -tulpn

= System Logs =

# View logs
sudo journalctl -xe
sudo tail -f /var/log/syslog
sudo grep <error> /var/log/syslog | tail -100

= Package Management =

# Update packages
sudo apt update && sudo apt upgrade -y

# Search packages
apt search <keyword>

# Remove packages with dependencies
sudo apt remove <package>

We can configure the system behavior

#sudo apt install dconf-editor
xev -event keyboard

I want to map the menu key

KeyRelease event, serial 28, synthetic NO, window 0x1000001,
    root 0x352, subw 0x0, time 913179790, (-526,-209), root:(345,337),
    state 0x0, keycode 135 (keysym 0xff67, Menu), same_screen YES,
    XLookupString gives 0 bytes:
    XFilterEvent returns: False

Annoying close window prompt on applications with background operations

# extend ubuntu timeout to check if a window is still alive
gsettings set org.gnome.mutter check-alive-timeout 60000

echo -e "keycode 66 = Hyper_L\nkeycode 118 = Hyper_L\nkeycode 135 = Hyper_L\nkeycode 133 = Hyper_L"  > ~/.xmodmap
xmodmap ~/.xmodmap

#xbindkeys
# gsettings reset-recursively org.gnome.desktop.input-sources
# gsettings reset-recursively org.gnome.desktop.wm.keybindings
gsettings list-recursively org.gnome.desktop.input-sources
gsettings set org.gnome.desktop.input-sources xkb-options "['caps:hyper', 'insert:hyper', 'menu:hyper', 'keycode_133:hyper']"
gsettings get org.gnome.desktop.input-sources xkb-options
# gsettings set org.gnome.desktop.wm.keybindings panel-main-menu "[]"
# gsettings set org.gnome.desktop.wm.keybindings show-desktop "[]"
# gsettings set org.gnome.desktop.wm.keybindings toggle-fullscreen "[]"
#xkeyboard-config

org.gnome.desktop.input-sources current uint32 0
org.gnome.desktop.input-sources mru-sources @a(ss) []
org.gnome.desktop.input-sources per-window false
org.gnome.desktop.input-sources show-all-sources false
org.gnome.desktop.input-sources sources @a(ss) []
org.gnome.desktop.input-sources xkb-model 'pc105+inet'
org.gnome.desktop.input-sources xkb-options @as []
['caps:hyper', 'insert:hyper', 'menu:hyper']

setxkbmap -option caps:hyper -option insert:hyper -option menu:hyper -option keycode_133:hyper

Local port scanning

nmap -sT localhost

lsof -i :80
ss -tlnp | grep :80

Socat is a relay for bidirectional data transfers between two independent data channels. Is meant as the advanced version of netcat. article, article, article.

• Files
• Pipes
• Devices (serial line, pseudo-terminal, etc)
• Sockets (UNIX, IP4, IP6 - raw, UDP, TCP)
• SSL sockets
• Proxy CONNECT connections
• File descriptors (stdin, etc)
• The GNU line editor (readline)
• Programs

#socat [options] <address> <address>
socat TCP4-LISTEN:81 TCP4:192.168.1.10:80
socat TCP4-LISTEN:81,fork,reuseaddr TCP4:TCP4:192.168.1.10:80

nc -l localhost 1234 #terminal1 
socat STDIO TCP4:localhost:1234 #terminal2

Docker host/container connection

socat TCP-LISTEN:1234,reuseaddr,fork TCP:localhost:80

Build & Dev:

• docker build -f Dockerfile.dockerfile -t myorg . - Build from Dockerfile
• docker run -it --rm -v $PWD:/workspace myorg org mode :start - Launch org-mode
• docker exec -it myorg bash - Enter container
• docker build -f Dockerfile.dockerfile --build-arg DOCKER_FLAGS“-v $PWD:/workspace” -t myorg .= - Build with volume flags

Run & Manage:

• docker run -it --rm -v $PWD:/workspace -w /workspace myorg org mode --no-user-info - Run org without user info
• docker run --rm -v $PWD:/workspace myorg org mode :source_block_quote: "hello" - Process org block
• docker run --rm myorg org mode :clear_properties - Clear properties
• docker run --rm myorg org mode :close_all - Close all buffers

Network & Logs:

• docker run --rm -v $PWD:/workspace myorg org mode :start_export "latex" - Export to LaTeX
• docker logs myorg - View logs
• docker ps -a - List all containers

Useful for Org workflows:

• docker cp myorg:/workspace/src/*.org $PWD/ - Copy files out
• docker cp $PWD/*.org myorg:/workspace/src/ - Copy files in
• docker commit myorg myorg:latest - Save image
• docker stop myorg && docker rm myorg - Stop and remove

links: attachable networks

127.0.0.1

If your application inside a container binds to 127.0.0.1, it means the application can only be accessed by other processes running inside that exact same container.

0.0.0.0

When you bind your application to 0.0.0.0, it makes the service accessible from anywhere that can reach the container—including the host machine, other containers on the same Docker network, and external networks.

docker network inspect webserver_webserver-net

[
    {
        "Name": "webserver_webserver-net",
        "Id": "95f40f2ec00116f8084f23f936e227ce10ab7ef22103bee3693efb013600b558",
        "Created": "2026-05-26T18:17:17.270114938+02:00",
        "Scope": "local",
        "Driver": "bridge",
        "EnableIPv4": true,
        "EnableIPv6": false,
        "IPAM": {
            "Driver": "default",
            "Options": null,
            "Config": [
                {
                    "Subnet": "172.18.0.0/16",
                    "Gateway": "172.18.0.1"
                }
            ]
        },
        "Internal": false,
        "Attachable": false,
        "Ingress": false,
        "ConfigFrom": {
            "Network": ""
        },
        "ConfigOnly": false,
        "Options": {},
	...

We often need to install ping to check communication between containers

apt update
apt install iputils-ping

Docker stores containers, volumes, image, and filesystem layers

docker rm $(docker ps -aq)
docker rmi $(docker images -q)
docker image prune -a
docker volume prune
docker system prune                 

SWARM_NAME=malestro SWARM_NODE=malestro NET_NAME=webserver-net SERVICE_NAME=db SUBNET=“10.11.0.0/16” GATEWAY=" docker swarm init

#docker network create –scope=swarm $NET_NAME #docker network create –scope=swarm –driver overlay –attachable $NET_NAME docker network create –driver=overlay –attachable $NET_NAME #docker network create –scope=swarm –driver overlay –ingress –opt com.docker.network.driver.mtu=1200 $NET_NAME docker network create –driver overlay –ingress –subnet=$SUBNET –gateway=$GATEWAY –opt com.docker.network.driver.mtu=1200 traefik-ingress

docker network create –subnet $SUBNET –opt com.docker.network.bridge.name=docker_gwbridge –opt com.docker.network.bridge.enable_icc=false –opt com.docker.network.bridge.enable_ip_masquerade=true docker_gwbridge

#docker network create –subnet=172.20.0.1/16 -o com.docker.network.bridge.enable_icc=false -o com.docker.network.bridge.name=docker_gwbridge docker_gwbridge

#docker service update –network-rm traefik-net myservice #docker service create –publish 80:80 –network=$NET_NAME –name nginx nginx docker service update –network-add $NET_NAME db

docker node update –availability active $SWARM_NODE docker swarm init

Docker has many advantages in terms of portability but few topics makes it really hard to use. I wish I can learn how to face time demanding issues:

user

is really tedious to have the same user as host, I’m not sure I found the best workaround. Volumes are mounted as root and the container user cannot work ref1

root

if a pre-built images starts a user I can’t do any root change

build

building takes an enormous amount of time and tentatives. I wish I could find a better way to avoid debugging every single line for unmet dependencies

mounting

Dockerfile copies the directory losing the dynamic changes

volumes

I use docker because I want a standard on the mounted directory and share LLM for example. Why it is so hard to find out every time where the provider puts the models

transparency

I use docker mainly for security reasons because I want to control what each service does on my machine but often compiling and launching from docker is really badly documented and I sometimes don’t manage to have it running

dependencies

I can’t count the time spent in figuring out the dependencies for each image

We start with a simple UI tool

We install kubectl

curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl"
curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl.sha256"
echo "$(cat kubectl.sha256)  kubectl" | sha256sum --check
sudo install -o root -g root -m 0755 kubectl /usr/local/bin/kubectl

Write down in org-mode useful commands and snippets for kubectl with mentions to configuration files

#+begin_src org

alias k=kubectl
alias kg='kubectl get'
alias kga='kubectl get all'
alias kd='kubectl describe'
alias kl='kubectl logs'
alias kpf='kubectl port-forward'

#+end_src

Here are useful kubectl commands and snippets in org-mode with configuration file references:

#+BEGIN_SRC org

The current choice is pipewire

• Lower latency for real-time audio processing.
• Better compatibility with Wayland display servers (unlike PulseAudio)
• Hardware-accelerated video passthrough for screen sharing
• Integration with Mesa DRM for improved graphics performance
• Support for native Wayland audio protocol instead of X11
• Reduced CPU overhead and power consumption
• Better support for virtualization and nested audio contexts
• Improved video effects and filters support
• Seamless integration with Ubuntu’s native GNOME environment
• Better support for multimedia applications and games
• More efficient resource management for audio devices
• Improved compatibility with modern Linux kernels
• Reduced latency for audio streaming and VoIP applications
• Better support for audio mixing and routing
• Integration with JACK protocol for professional audio work

sudo apt install pulseaudio-utils
sudo apt install pipewire pipewire-pulse wireplumber pipewire-alsa pipewire-jack -y

pactl info | grep "Server Name"

Server Name: PulseAudio (on PipeWire 1.6.2)

systemctl --user enable --now pipewire pipewire-pulse wireplumber
journalctl --user -u pipewire  # Replace "pipewire" with the failing service name

Sep 05 00:36:29 manitro systemd[3162]: Stopping pipewire.service - PipeWire Multimedia Service...
Sep 05 00:36:29 manitro systemd[3162]: Stopped pipewire.service - PipeWire Multimedia Service.
Sep 05 00:36:29 manitro systemd[3162]: pipewire.service: Consumed 3min 31.719s CPU time over 2d 15h 50min 9.478s wall clock time, 21.7M memory peak, 4.6M memory swap peak.
-- Boot 2f8cdd9bf9554f12ba750e8021731469 --
Sep 05 10:15:53 manitro systemd[3180]: Started pipewire.service - PipeWire Multimedia Service.

pw-top

I’m running LMMS configured with alsa and pipewire but I hear no sound, how can I debug it?

echo "=== LMMS Audio Debug Script ==="
echo ""
echo "Checking ALSA devices..."
alsaloop -P default -c 2 -t 2 -p
echo "Checking PulseAudio status..."
if pgrep -x pulseaudio> /dev/null; then
    echo "PulseAudio is running"
elif pgrep -x pipewire > /dev/null; then
    echo "PipeWire is running"
elif pgrep -x pavucontrol > /dev/null; then
    echo "PavuControl is available"
fi
echo "Checking ALSA modules..."
cat /proc/asound/cards
echo "Checking PulseAudio modules..."
pactl info 2>/dev/null || echo "Pactl not available or PulseAudio not running"
echo "Checking PipeWire modules..."
pipewire-pulse-info 2>/dev/null || echo "PipeWire-Pulse not available"
echo "Checking user audio permissions..."
id
ls -la ~/.cache/pulse/ 2>/dev/null || echo "Pulse cache not found"
# Test with a686196b566e5e97b932e4168a028a1295b5b3d06e6d1c3e1e9b17f3d1c2e3f4
echo ""
echo "Test sound output..."
play -t alsa /dev/zero 2>/dev/null &
sleep 1
kill $! 2>/dev/null || true
echo "" echo "

=== LMMS Audio Debug Script ===

Checking ALSA devices...
Checking PulseAudio status...
PipeWire is running
Checking ALSA modules...
 0 [NVidia         ]: HDA-Intel - HDA NVidia
                      HDA NVidia at 0xbc000000 irq 124
 1 [Generic        ]: HDA-Intel - HD-Audio Generic
                      HD-Audio Generic at 0xbc8c8000 irq 126
 2 [Generic_1      ]: HDA-Intel - HD-Audio Generic
                      HD-Audio Generic at 0xbc8c0000 irq 127
 3 [Fold           ]: USB-Audio - nanoKEY Fold
                      KORG INC. nanoKEY Fold at usb-0000:66:00.4-1, full speed
Checking PulseAudio modules...
Server String: /run/user/1000/pulse/native
Library Protocol Version: 35
Server Protocol Version: 35
Is Local: yes
Client Index: 523
Tile Size: 65472
User Name: sabeiro
Host Name: manitro
Server Name: PulseAudio (on PipeWire 1.6.2)
Server Version: 15.0.0
Default Sample Specification: float32le 2ch 48000Hz
Default Channel Map: front-left,front-right
Default Sink: alsa_output.pci-0000_64_00.6.analog-stereo
Default Source: alsa_input.pci-0000_64_00.6.analog-stereo
Cookie: 0b3e:429a
Checking PipeWire modules...
PipeWire-Pulse not available
Checking user audio permissions...
uid=1000(sabeiro) gid=1000(sabeiro) groups=1000(sabeiro),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),100(users),111(lpadmin),114(lxd),973(docker),994(input)
Pulse cache not found

Test sound output...