Understanding Linux Kernel Types: Micro, Monolithic, and Hybrid Explained

1. Introduction

This article explains what the Linux kernel is and uses several images to illustrate its functions so readers can quickly grasp its purpose.

2. What Is a Kernel

The kernel is the lowest‑level software that interfaces with hardware, connecting user‑mode applications to physical devices and allowing processes to communicate via IPC.

3. Kernel Types

3.1 Microkernel

A microkernel only manages the CPU, memory, and IPC. Most other services run in user mode, giving it strong portability, small memory footprint, and improved security because only specific processes run with high privileges.

Portability

Small installation size

Low memory usage

Security

Hardware abstraction via drivers can add latency

Drivers run in user mode, potentially slower

Processes must wait in queues for information

Processes cannot access others without waiting

3.2 Monolithic Kernel

In contrast, a monolithic kernel includes device drivers, file‑system management, and system calls in addition to CPU, memory, and IPC. It provides direct hardware access and efficient multitasking but can become large, consume more memory, and be less safe because many components run in kernel mode.

Direct hardware access

Easier inter‑process communication

No extra installation needed for supported devices

Faster process response

Larger installation size

Higher memory consumption

Less safe, as all code runs in kernel mode

4. Hybrid Kernel

A hybrid kernel lets developers choose which components run in user mode and which stay in kernel mode. Typically drivers and file‑system I/O run in user mode, while IPC and system calls remain in kernel mode, offering flexibility but requiring more work from hardware vendors.

Developers can decide user‑mode vs. kernel‑mode execution

Smaller installation footprint than a pure monolithic kernel

Greater flexibility

May suffer the same process‑latency issues as microkernels

Drivers often need user‑mode management

5. Where Linux Kernel Files Reside

In Ubuntu, kernel images are stored in the /boot directory as vmlinux‑<version> or vmlinuz‑<version>. The “vm” prefix indicates virtual‑memory support, and the “z” suffix shows the image is compressed (commonly with zlib, LZMA, or BZIP2).

Other important files in /boot include initrd.img‑<version> (a small RAM disk used during boot), System.map‑<version> (memory layout before full kernel loading), and config‑<version> (kernel build options).

6. Linux Kernel Architecture

Because the Linux kernel is monolithic, it occupies the most space and has the highest complexity among kernel designs. To mitigate this, Linux supports loadable kernel modules that can be added or removed at runtime, enabling dynamic feature extension without rebooting.

7. Kernel Modules

Loadable Kernel Modules (LKM) allow optional drivers, filesystems, and system calls to be loaded on demand. Modules have the .ko extension and are typically stored in /lib/modules. They can be enabled or disabled via menuconfig, editing /boot/config, or using the modprobe command.

Third‑party or closed‑source modules may be unavailable in some distributions because their source code is not provided.

8. Linux Kernel Learning Experience Summary

Opening

Learning the kernel requires a balanced approach: understand concepts before diving into code, build a mental framework of subsystems, and use multiple reference books to gain different perspectives.

Why Write This Blog

The author shares personal study methods, emphasizing the importance of grasping high‑level design before examining low‑level implementation details.

Learning Method

Start by knowing that a subsystem exists, then understand its design principles. Use books such as LKD3, ULK3, and PLKA to get both conceptual overviews and detailed code walkthroughs, and practice by building and loading modules.

References

Key references include LDD3, LKD3, ULK3, PLKA, Intel V3 manuals, and various online articles.