Certification coverage

• Ports: a process listens, or nothing answers

What is missing: The lessons read kernel parameters with `sysctl` to explain what a port or a socket is doing; none sets one, and `/etc/sysctl.d/` — where a change survives a reboot — is not taught.

• What is running: processes
• Signals, and why kill -9 is the last resort
• Foreground, background and jobs
• Reading a status, and the four verbs
• Reading logs with journalctl
• Restart policies, and the crash loop they hide
• From a symptom to one component: what the hypothesis forbids

• Scheduling a task: cron or a systemd timer
• When the previous run has not finished
• A script you can run twice

• Updating a server with apt
• Installing and removing software
• Where a package puts its files
• Installing Docker: the official repository, not Ubuntu's
• Telling what changed on disk

• Rebuilding the whole machine, in the right order
• Restoring, and making the drill routine
• Restoring files, and the owners nobody backed up
• Verify before declaring success, and what a rollback does not undo

What is missing: Recovering data and rebuilding a machine from its backups is taught in full; recovering a machine that will not boot — the rescue shell, `fsck` on an unmounted filesystem, a broken bootloader — is not.

What is missing: Nothing in the curriculum runs a hypervisor. `libvirt`, `virsh` and virtual machine images are absent; every lesson administers a machine somebody else provisioned.

• Image, container, volume — and when to do without
• Installing Docker: the official repository, not Ubuntu's
• A Dockerfile for a Node application
• Data outlives the container, the port goes through the firewall
• Compose: the application and its database in one file
• The log file nothing is rotating
• A container with no memory limit, and the process the kernel kills instead

• AppArmor: the refusal permissions do not explain

What is missing: The blueprint names SELinux. The curriculum teaches mandatory access control through AppArmor, which is what Ubuntu ships — the concept transfers, the commands do not: `getenforce`, `semanage`, `restorecon` and file contexts have to be learnt elsewhere.

• Addresses, interfaces and routes
• A query's path, and the propagation myth
• What the application asks, and why dig answers a different question

What is missing: Reading addresses, routes and interfaces with `ip`, and how a name is resolved, are taught. Assigning an address — a static configuration in Netplan — is not.

• Two logs that say 14:02: a timestamp is not a number

What is missing: Reading a machine's time, zone and synchronisation state with `timedatectl`, and what a stepped clock does to evidence, are taught in a lesson and a lab. Pointing `systemd-timesyncd` at your own servers in `timesyncd.conf` is not.

• Ports: a process listens, or nothing answers
• Refused or silent: what each failure proves
• Unreachable: find the broken layer before touching anything
• Works on the server, refused from outside
• Dropped here or never arrived: one capture decides
• What a failed lookup tells you, and whose problem it is

• Connecting for the first time
• Moving SSH to key authentication
• The agent, the passphrase, and what ssh -A really lends
• A key is a line, and the line takes options
• Hardening the SSH daemon without locking yourself out

• ufw: deny by default without locking yourself out
• Three writers, one ruleset: reading what the kernel holds
• The undo you schedule before you need it
• Data outlives the container, the port goes through the firewall

What is missing: Filtering with `ufw`, reading the nftables ruleset the kernel actually holds, and how Docker writes its own NAT ahead of it are taught. Writing a port redirection or a NAT rule by hand is not.

• Addresses, interfaces and routes

What is missing: Reading the routing table and the default route is taught; adding a static route, and making it persistent, is not.

What is missing: No lesson creates a bridge or a bond. Docker's bridge network appears as a fact the container lessons rely on, never as a device you configure.

• Reverse proxying a Node application
• Which server block answers, and why the wrong site sometimes does
• The limits that refuse: 413 and 504
• Reading the error log: why the 502 happened

What is missing: The reverse-proxy half is taught in depth — Nginx in front of a Node application, with its timeouts and its error log. The load-balancer half is not: no lesson puts two servers behind one `upstream {}` block, because the curriculum stops at one machine.

What is missing: No lesson touches LVM. Every filesystem in the curriculum is the one the installer created.

• What is running: processes
• Busy doing what: reading the processor line

What is missing: `/proc` is read where it explains something — a process's working directory, the counters `top` reads — and `/etc/fstab` appears where systemd turns its lines into mount units. Writing a mount yourself, and what the kernel exposes under `/sys`, are not taught.

• Disk, memory and load: reading them correctly
• Restoring files, and the owners nobody backed up

What is missing: Troubleshooting a filesystem — a disk full with nothing to delete, inodes exhausted, ownership lost on restore — is taught with labs. Creating one with `mkfs`, checking it with `fsck` and mounting it yourself are not.

What is missing: No NFS, no iSCSI, no network block device. Off-site copies travel by `rsync` over SSH, which is a transfer, not a mounted filesystem.

• Disk, memory and load: reading them correctly

What is missing: Reading swap as a sign of memory pressure, in `free` and `vmstat`, is taught. Creating, sizing or removing swap is not.

What is missing: Nothing in the curriculum mounts on demand. `.automount` is named once, as one of systemd's eleven unit types, and never used; `autofs` does not appear.

• Which disk, and how long each request took
• Trends, not instants
• pg_wal fills, and something is holding it

• What a commit actually contains
• Answering "what changed?"
• What never goes into history
• Going back without rewriting history
• Moving history between machines
• Reading a repository somebody else branched
• Naming what is deployable

• Your first systemd unit
• Units, targets and what depends on what
• Configuration and secrets a unit can read
• Changing a packaged unit without losing your change
• Disabling a service is not stopping it

• Disk, memory and load: reading them correctly
• Busy doing what: reading the processor line
• Which disk, and how long each request took
• An automated check that is worth having
• What an output proves, and what "success" does not
• The check that cannot fail, and the flush that proves nothing

• Changing a packaged unit without losing your change
• A hundred connections, and the arithmetic that exceeds them
• The limits that refuse: 413 and 504
• A container with no memory limit, and the process the kernel kills instead

• Disk, memory and load: reading them correctly
• Controlling log growth
• Why a DELETE returns no space
• pg_wal fills, and something is holding it
• The log file nothing is rotating

• Ninety days, and nothing will warn you
• Checking from outside the machine

• Who am I on this system?
• Creating and removing accounts
• Locking a password is not closing an account
• sudo, and why nobody works as root
• Becoming someone else, and which shell you get

• Scheduling a task: cron or a systemd timer
• Configuration and secrets a unit can read
• What is a shell?

What is missing: The difference between an interactive shell's environment and a service's is taught where it bites — a script that works at the prompt and fails under cron or systemd. `/etc/profile`, `/etc/environment` and the order in which `~/.bashrc` and its siblings load are not.

• Changing a packaged unit without losing your change
• A hundred connections, and the arithmetic that exceeds them

What is missing: Limits are taught per service — `LimitNOFILE=` in a unit, a database's connection ceiling — never per user: `ulimit`, `/etc/security/limits.conf` and PAM's part in applying them are absent.

• A directory two accounts share, done properly
• Where a file's permissions come from
• Restoring files, and the owners nobody backed up

What is missing: Every account in the curriculum is local. No lesson joins a machine to a directory service.