This page collects the Linux commands that are useful day to day, sorted by topic. Each table shows the command and what it does. Words in <angle brackets> are placeholders: replace them with your own values.
Tip: Put sudo in front of a command that needs root rights. Run man <command> or <command> --help to see all of a command's options.
Navigation & Files
| Command | What it does |
|---|
pwd | Show the current directory |
ls -lah | List all files (including hidden ones) with sizes in a readable format |
cd <dir> / cd .. / cd ~ / cd - | Go to a directory, one level up, to your home directory, or back to the previous directory |
mkdir -p a/b/c | Create a directory, including any missing parent directories |
touch <file> | Create an empty file, or update the timestamp of an existing one |
cp -r <src> <dst> | Copy files or directories |
mv <src> <dst> | Move or rename |
rm <file> / rm -r <dir> | Delete a file or a directory (there is no trash, so it is gone for good) |
ln -s <target> <link> | Create a symbolic link |
tree -L 2 | Show the directory tree two levels deep (may need to be installed first) |
Viewing & Editing Files
| Command | What it does |
|---|
cat <file> | Print the whole file |
less <file> | Scroll through a file (q quits, /word searches) |
head -n 20 <file> | Show the first 20 lines |
tail -n 50 <file> | Show the last 50 lines |
tail -f <file> | Follow a file live, for example a log file |
nano <file> | Simple editor (Ctrl+O saves, Ctrl+X exits) |
vim <file> | Powerful editor (i starts insert mode, Esc then :wq saves and exits) |
wc -l <file> | Count the lines |
diff <a> <b> | Compare two files |
Searching
| Command | What it does |
|---|
grep -rn "text" <dir> | Search for text in all files below a directory, with line numbers |
grep -i "text" <file> | Search without caring about upper or lower case |
find / -name "*.conf" 2>/dev/null | Find files by name and hide errors |
find . -type f -size +100M | Find files larger than 100 MB |
find . -mtime -1 | Find files changed in the last 24 hours |
which <cmd> | Show which program runs when you type a command |
history | Show the commands you ran before (Ctrl+R searches them) |
Permissions & Ownership
| Command | What it does |
|---|
chmod 644 <file> | Owner can read and write, everyone else can only read |
chmod 755 <file> | Owner has full rights, everyone else can read and execute |
chmod +x <script> | Make a file executable |
chown user:group <file> | Change the owner and group |
chown -R user:group <dir> | Change the owner and group recursively |
How the numbers work: read = 4, write = 2, execute = 1. Add them up for each group in the order owner, group, others. For example, 7 = 4+2+1 = rwx.
Processes
| Command | What it does |
|---|
ps aux | List all running processes |
top / htop | Live view of CPU and RAM usage (htop is nicer but may need to be installed) |
pgrep -a <name> | Find processes by name |
kill <PID> | Ask a process to stop |
kill -9 <PID> | Force a process to stop (use this only as a last resort) |
pkill <name> | Stop processes by name |
<cmd> & / jobs / fg | Run a command in the background, list background jobs, bring a job back to the foreground |
nohup <cmd> & | Keep a command running after you log out |
| Command | What it does |
|---|
uname -a | Kernel and system information |
cat /etc/os-release | Which distribution and version |
hostnamectl | Hostname and OS overview |
uptime | How long the system has been running, and its load |
free -h | RAM and swap usage |
nproc / lscpu | Number of CPU cores and CPU details |
date / timedatectl | Current time and timezone settings |
Disk & Storage
| Command | What it does |
|---|
df -h | Free space on every mounted drive |
du -sh <dir> | Total size of a directory |
du -h --max-depth=1 / | Size of every top-level directory, to find what fills the disk |
lsblk | List disks and partitions |
mount / umount <path> | Show mounted drives, unmount a drive |
ncdu / | Interactive disk usage browser (may need to be installed) |
Networking
| Command | What it does |
|---|
ip a | Show IP addresses and network interfaces |
ip r | Show the routing table and default gateway |
ping <host> | Test whether a host can be reached |
curl -I https://<site> | Fetch only the HTTP headers of a website |
wget <url> | Download a file |
ss -tulpn | Show listening ports and which process uses each one |
dig <domain> / nslookup <domain> | DNS lookup |
traceroute <host> | Show the network path to a host |
Users
| Command | What it does |
|---|
whoami / id | Your current user, and its groups |
sudo adduser <name> | Create a new user (Debian/Ubuntu) |
sudo usermod -aG <group> <user> | Add a user to a group, for example docker |
passwd | Change your password |
su - <user> | Switch to another user |
who / last | Who is logged in now, and the login history |
Packages
| Debian / Ubuntu (apt) | RHEL / Fedora (dnf) | What it does |
|---|
sudo apt update | sudo dnf check-update | Refresh the package lists |
sudo apt upgrade | sudo dnf upgrade | Install updates |
sudo apt install <pkg> | sudo dnf install <pkg> | Install a package |
sudo apt remove <pkg> | sudo dnf remove <pkg> | Remove a package |
apt search <word> | dnf search <word> | Search for a package |
sudo apt autoremove | sudo dnf autoremove | Remove packages that are no longer needed |
Services (systemd)
| Command | What it does |
|---|
systemctl status <service> | Show whether a service is running, plus its latest log lines |
sudo systemctl start / stop / restart <service> | Start, stop or restart a service |
sudo systemctl enable --now <service> | Start a service now and on every boot |
sudo systemctl disable <service> | Stop a service from starting on boot |
systemctl list-units --type=service --state=running | List the services that are running |
sudo systemctl daemon-reload | Reload the configuration after you edit unit files |
Logs
| Command | What it does |
|---|
journalctl -u <service> | Logs of one service |
journalctl -u <service> -f | Follow a service's logs live |
journalctl --since "1 hour ago" | Logs from the last hour |
journalctl -p err -b | Errors since the last boot |
dmesg -T | Kernel messages with readable timestamps |
tail -f /var/log/syslog | Follow the system log (on RHEL it is /var/log/messages) |
Archives & Transfer
| Command | What it does |
|---|
tar -czf backup.tar.gz <dir> | Pack and compress a directory |
tar -xzf backup.tar.gz | Unpack an archive |
tar -tzf backup.tar.gz | List what is inside an archive without unpacking it |
zip -r a.zip <dir> / unzip a.zip | Create or unpack a zip file |
ssh user@host | Log in to a remote server |
scp <file> user@host:/path/ | Copy a file to a server |
rsync -avh --progress <src> user@host:/path/ | Sync files, copying only what changed |
Handy Shell Tricks
command1 | command2 # pass the output of one command to the next
command > file.txt # write the output to a file (overwrites it)
command >> file.txt # add the output to the end of a file
command 2>&1 # merge errors into the normal output
cmd1 && cmd2 # run cmd2 only if cmd1 worked
cmd1 || cmd2 # run cmd2 only if cmd1 failed
sudo !! # run the last command again with sudo
Examples:
ps aux | grep nginx # find nginx processes
du -sh * | sort -h # sizes in the current directory, smallest first
journalctl -u ssh | grep "Failed" # failed SSH logins
Docker
Containers
| Command | What it does |
|---|
docker ps | List running containers |
docker ps -a | List all containers, including stopped ones |
docker run -d --name <name> -p 8080:80 <image> | Start a container in the background and publish a port (host:container) |
docker start / stop / restart <name> | Start, stop or restart a container |
docker rm <name> | Delete a stopped container (-f forces it while it is running) |
docker exec -it <name> bash | Open a shell inside a container (use sh if the image has no bash) |
docker logs -f --tail 100 <name> | Follow a container's logs, starting with the last 100 lines |
docker stats | Live CPU, RAM and network usage per container |
docker inspect <name> | Full details of a container, as JSON |
docker cp <name>:/path/file . | Copy a file out of a container |
Restart Policies
The restart policy decides whether Docker starts a container again by itself.
| Policy | Behaviour |
|---|
no | Never restart (this is the default) |
on-failure[:N] | Restart only when the container exits with an error, at most N times if you give a number |
always | Always restart, even after a reboot. If you stopped it by hand, it comes back the next time the Docker daemon starts |
unless-stopped | Like always, but a container you stopped by hand stays stopped. This is usually the best choice |
Show the restart policy of all containers:
docker inspect --format '{{.Name}} -> {{.HostConfig.RestartPolicy.Name}}' $(docker ps -aq)
Show the policy of one container:
docker inspect --format '{{.HostConfig.RestartPolicy.Name}}' <name>
Change the policy of a container that already exists, without recreating it:
docker update --restart unless-stopped <name>
Change the policy of all containers at once:
docker update --restart unless-stopped $(docker ps -aq)
Set the policy when you create a container:
docker run -d --restart unless-stopped --name <name> <image>
Turn automatic restarts off:
docker update --restart no <name>
Note for Docker Compose: docker update only changes the current container. The next docker compose up recreates it with the policy from the compose file, so set it there instead: restart: unless-stopped.
Images
| Command | What it does |
|---|
docker images | List the images on this machine |
docker pull <image>:<tag> | Download an image |
docker build -t <name>:<tag> . | Build an image from the Dockerfile in the current directory |
docker rmi <image> | Delete an image |
docker history <image> | Show the layers an image is made of |
Volumes & Networks
| Command | What it does |
|---|
docker volume ls | List volumes |
docker volume inspect <vol> | Show a volume's details and where it is stored on disk |
docker run -v <vol>:/data <image> | Mount a volume into a container |
docker network ls | List networks |
docker network create <net> | Create a network |
docker network connect <net> <container> | Connect a container to a network |
Cleanup
| Command | What it does |
|---|
docker system df | Show how much space Docker uses |
docker container prune | Delete all stopped containers |
docker image prune -a | Delete every image that no container uses |
docker volume prune | Delete unused volumes (the data in them is lost) |
docker system prune -a | Delete stopped containers, unused networks, unused images and build cache in one go |
Docker Compose
Run these commands in the folder that contains docker-compose.yml or compose.yaml.
| Command | What it does |
|---|
docker compose up -d | Start all services in the background |
docker compose down | Stop and remove the services (add -v to remove their volumes too) |
docker compose ps | Show the status of the services |
docker compose logs -f <service> | Follow a service's logs |
docker compose pull && docker compose up -d | Update the images and restart with the new versions |
docker compose restart <service> | Restart one service |
docker compose exec <service> sh | Open a shell in a service's container |
A minimal example of a compose file:
services:
web:
image: nginx:latest
restart: unless-stopped
ports:
- "8080:80"
volumes:
- ./html:/usr/share/nginx/html
Useful Docker One-Liners
# Stop all running containers
docker stop $(docker ps -q)
# Show each container with its IP address
docker inspect --format '{{.Name}} {{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' $(docker ps -q)
# Show each container with its published ports
docker ps --format 'table {{.Names}}\t{{.Ports}}'
# Show the size of each container
docker ps -s
# Let your user run docker without sudo (log out and back in afterwards)
sudo usermod -aG docker $USER
