What the Linux Kernel Looks Like Inside: A Comic Walkthrough

File System (Foundation)

The lowest layer of the Linux kernel is visualised as a row of orderly file cabinets. Each cabinet represents a directory entry in the virtual file system. A penguin labelled with PID 421 demonstrates a process that is actively reading the file system, while a watchdog dog on the side symbolises the kernel’s file‑system monitoring subsystem.

Process Table (First Layer)

At the centre of the next layer lies a mat that stands for the process table. The penguin in the upper‑left corner is the init process (PID 1), the ancestor of every other process. All surrounding penguins are shown in a waiting state, illustrating that newly created processes start in TASK_WAIT until scheduled.

Two watchdog dogs flank the table, representing the kernel’s process‑watchdog that raises alerts when a process misbehaves.

Inter‑process communication is depicted by penguins passing items through pipes, a visual metaphor for Unix pipes ( |) and other IPC mechanisms such as FIFOs and sockets.

Specific services are highlighted:

cron – a frantic penguin constantly checking a watch, symbolising the daemon that executes scheduled jobs according to crontab.

Apache HTTP server – a penguin with PID 1341 bearing the Apache logo, listening on TCP port 80 to serve web pages.

SSH daemon (sshd) – a penguin wearing sunglasses guarding port 22, providing secure remote login.

FTP service – an aging penguin near a faded sign, representing the rarely used FTP daemon on port 21.

Wine compatibility layer – a penguin holding a glass of wine, indicating the ability to run Windows binaries on Linux.

Linux Kernel Library (LKL) – referenced by the URL https://github.com/lkl, an example of a project that re‑uses kernel code in user space.

A downward step in the upper‑left corner shows how processes can descend into the file‑system layer to read or modify files, mirroring system calls such as open(), read(), and write().

TTY Terminals (Upper Layer)

The topmost “jump layer” depicts two penguins working at a TTY window. TTY (teletype) terminals are historic serial‑line interfaces that persist in Linux as device nodes under /dev (e.g., /dev/tty1) and appear in the output of the ps command.

Several virtual terminals are illustrated: tty4 shows the incomplete command “fre…”, representing a mistyped input. tty2 and tty3 display normal command lines. tty7 hosts the graphical X Window System, the typical location of the desktop environment. tty5 and tty6 are empty, indicating no active sessions. tty1 is left ambiguous, highlighting that not every terminal is always present.

These terminals demonstrate that while many processes interact with users via TTYs, others communicate directly through network ports or other IPC mechanisms, so the “jump layer” is not a complete abstraction of all kernel activity.

References

Linux Kernel Library (LKL) project: https://github.com/lkl SSH protocol port 22 background: https://linux.cn/article-8476-1.html

Linux watchdog explanation: https://blog.csdn.net/liigo/article/details/9227205

General LKL information: https://en.wikipedia.org/wiki/Linux_Kernel_Library

Original comic source: http://turnoff.us/