The kernel is the OS core — it schedules CPU, manages memory, and talks to hardware; all privileged work goes through it via syscalls. The shell (bash/zsh) is an ordinary user program that reads my command line, finds the binary via $PATH, and asks the kernel to run it. Kernel does the work; shell is my interface.

A process is a running program with its own isolated memory. A thread is a unit of execution inside a process that shares that memory with sibling threads. Processes are heavier (new address space) and fail independently; threads are cheap and communicate via shared memory but one crashing thread can take down the whole process. 🎯 The point they test is isolation.

The first process the kernel starts, and the ancestor of everything else — systemd on modern distros. It brings the system to its target state and reaps orphaned processes. ⚠️ If PID 1 dies the kernel panics.

1. Firmware (BIOS/UEFI) runs POST and picks a boot device. 2. Bootloader (GRUB) loads the kernel + initramfs into memory. 3. Kernel initializes hardware and mounts a temporary root from initramfs. 4. initramfs loads drivers (LVM/encryption) needed to find the real root. 5. PID 1 (systemd) starts units toward default.target. 6. Services come up in dependency order. 7. Login via getty or sshd. 🎯 systemd replaced SysV init and runlevels with targets (multi-user.target, graphical.target). Debug slow boots with systemd-analyze blame.

Absolute starts from / and is the same everywhere (/var/log/syslog). Relative resolves from the current directory (log/syslog). ⚠️ In scripts prefer absolute paths — a script assuming the wrong working directory is a classic bug.

$PATH is the colon-separated list of directories the shell searches for a command you type without a slash. The current directory only affects relative paths like ./script.sh. ⚠️ . is deliberately not in $PATH for security — so nobody can drop a malicious ls in a directory and trick you. Resolve a binary with command -v name or which name.