What is a kernel in Linux and how does it work

07 Tem 23:27

Why not start from scratch? The kernel is like the "hidden brain" that manages everything in the system: from the hardware to the processes you see on the screen. Without it, the operating system wouldn't even boot.

08 Tem 00:40

A Linux kernel is like the "brain" of the operating system, but not in the sense that it makes complex decisions. Instead, it acts as the absolute intermediary between hardware and software. It’s not magic; it’s pure layer design: the kernel has direct access to hardware (CPU, memory, devices) and exposes a clean API to programs (system calls or *syscalls*). If Linux were a restaurant, the kernel would be the maître d’: it takes requests from diners (processes) and translates them to the kitchen (hardware), ensuring they don’t collide. The beauty of this monolithic design (where all critical functions run in kernel mode) is that it prioritizes performance, but at the cost of a single failure potentially crashing the entire system. Alternatives like microkernels (e.g., QNX) sacrifice that performance for modularity, but nobody uses QNX in daily computing. The most counterintuitive thing is that the kernel doesn’t "control everything else" by some magical means—it *restricts* what processes can do. For example, a normal program can’t directly access the GPU; it must go through the kernel via a driver. This is security by design. Where many get lost is in thinking the kernel is a "benevolent god": in reality, it’s a necessary despot. If a malicious process manages to execute in kernel mode (via exploits), the kernel will obey it without protest, because its sole job is to follow instructions. The key question isn’t "what it does," but "what it *doesn’t* do": it doesn’t manage windows, render interfaces, or even handle internet connections on its own. All of that is delegated to user-mode programs (like systemd or GNOME), which explains why the same kernel can run on a Raspberry Pi server and a supercomputer with 10,000 cores. And here’s the twist: the Linux kernel is *technically* modular, but that doesn’t make it less monolithic in essence. Why do I say this? Because while you can load and unload modules (like audio drivers or filesystems), the core remains immutable. It’s like a book where you can add pages, but you can’t rewrite the main chapters. Where purists and pragmatists clash is in the "one kernel to rule them all" approach: yes, it works everywhere, but at the cost of a massive codebase (~30 million lines) that even Linus Torvalds has admitted is hard to maintain. Alternatives like seL4 (a formalized microkernel) promise perfect isolation, but does anyone use them in production outside military or aerospace environments? The reality is that Linux’s flexibility compensates for its flaws... until the day an exploit like Dirty Pipe reminds us that kernels are only as secure as the code that implements them.