Linux Distributions
Every distribution ships the same Linux kernel — what differs is packaging, package manager and release model. Understand the Debian, RHEL and Arch families, their use cases, and how to choose the right base for servers, containers and security work.
What is this?
A Linux distribution is a complete operating system built on the Linux kernel — the same open-source engine in every distro — plus the userspace that makes it usable: a package manager, an init system, system libraries, a shell and default applications. The kernel is largely shared; what makes Ubuntu different from Alpine or Fedora is how software is packaged, how updates are delivered, and how long each release is supported.
Why do you need it?
- Your distro decides your commands: apt on Debian and Ubuntu, dnf on RHEL, pacman on Arch, apk on Alpine — the concepts transfer, the syntax does not.
- The release model sets the operating rhythm: LTS distros prioritise stability with years of security backports, while rolling distros ship constant updates.
- Enterprises and cloud vendors support specific distros (RHEL, Ubuntu LTS) with SLAs and security backports, which matters for compliance and audits.
- Footprint varies wildly: Alpine ships in a few megabytes for containers, while desktop distros weigh in at gigabytes.
- Choosing the wrong base is expensive later — most production Linux workloads standardise on the Debian or RHEL family.
Mental model
The same engine under different cars
The Linux kernel under different distros
A distribution is like a car: every model shares the same engine (the kernel), but the body, dashboard (package manager), service schedule (release cadence) and warranty (support period) are completely different. You pick the model that fits the job — a compact for a tiny container, a long-warranty workhorse for a database server.
How it works
- A distro bundles the kernel with userspace components — glibc, systemd, bash, coreutils — into a self-contained, installable system with its own defaults and configuration.
- The package manager is the heart: each distro ships signed packages (.deb, .rpm, .pkg.tar.zst, .apk) from its own repositories, with dependency metadata attached.
- Distro families share roots: Debian-family (apt/dpkg) includes Ubuntu and Kali; RHEL-family (dnf/yum, rpm) includes Fedora, AlmaLinux and Rocky; Arch (pacman) and Alpine (apk) are standalone.
- Release models differ: fixed release ships major versions on a schedule (Ubuntu LTS every two years), rolling release updates everything continuously (Arch).
- Support lifecycle matters: LTS releases receive security backports for years, so enterprises standardise on them instead of chasing the newest version.
What makes a distribution and how software flows through it.
Key commands
cat /etc/os-releaseAuthoritative distro identification, present on every modern Linux.
PRETTY_NAME="Ubuntu 24.04.1 LTS" NAME="Ubuntu" VERSION_ID="24.04" ID=ubuntu ID_LIKE=debian
grep PRETTY_NAME /etc/os-releaseJust the human-readable distro name.
PRETTY_NAME="Ubuntu 24.04.1 LTS"
uname -rShow the kernel release — the engine shared by every distro.
6.5.0-1020-aws
command -v apt dnf pacman apkWhich package managers exist — the fastest way to identify a family.
/usr/bin/apt
hostnamectlA quick OS and kernel overview on systemd-based distros.
Operating System: Ubuntu 24.04.1 LTS
cat /etc/redhat-releaseRHEL-family version file on older RHEL derivatives.
AlmaLinux release 9.3 (Emerald Puma)
Examples
Identify any Linux system in one command
# The one command that works on every modern distrocat /etc/os-release # Just the human-readable namegrep PRETTY_NAME /etc/os-release # The kernel underneath (shared by every distro)uname -ros-release is the cross-distro standard every modern system ships — it names the distribution, its version and its family. grep PRETTY_NAME gives the friendly name, and uname -r shows the kernel, which is the same engine every distro runs.
In production
- Cloud images are overwhelmingly Debian-family (Ubuntu) and RHEL-family (AlmaLinux/Rocky) — standardising on one family keeps fleet automation consistent.
- Enterprises with compliance needs buy RHEL or SUSE subscriptions for SLA-backed security backports.
- Alpine and distroless images keep container supply chains small — Alpine base images are around 5 MB.
- Kali and Parrot are purpose-built for penetration testing and forensic tooling.
- Fedora acts as the innovation branch: features stabilise there before they land in RHEL.
Best practices
- Standardise on one family (Debian or RHEL) per organisation so Ansible roles and shell scripts stay portable.
- Use LTS releases in production; reserve rolling distros for workstations and experimentation.
- Check end-of-life dates before adopting a version — upgrading later is far more painful than choosing well now.
- For containers, pick the smallest base image that still provides the tooling you need.
- Match the distro your employer uses so learning transfers straight into production.
Common mistakes
- Assuming apt works on RHEL or that dnf works on Debian — family commands do not transfer.
- Installing .deb packages on RHEL or .rpm packages on Debian without conversion or a compatible repo.
- Running a rolling-release distro in production where a surprise update breaks a service.
- Ignoring EOL: running an unsupported release means no security patches for critical CVEs.
- Choosing a distro by hype instead of by support lifecycle and team familiarity.
Common issues
apt: command not foundThe box is RHEL-family, Arch or Alpine — not Debian-family.
Detect with cat /etc/os-release, then use dnf install, pacman -S or apk add instead.
The repository ... does not have a Release fileThe OS was upgraded but the sources in /etc/apt/sources.list still point at the old release.
Regenerate sources for the current release, or reprovision from the current cloud image.
Error: nothing provides libssl.so.3() needed by ...A manually downloaded .rpm was built against libraries newer than this distro ships.
Use the package from the distro repository or a supported repo that matches this release.
Debugging tips
- cat /etc/os-release is the single authoritative answer to 'which distro is this?'
- command -v apt dnf pacman apk reveals the package manager without reading any release files.
- uname -r tells you the kernel, not the distro — don't confuse the two when troubleshooting.
- hostnamectl gives a quick OS plus kernel overview on systemd-based distros.
Interview checkpoint
Hands-on lab
- Identify a distribution with /etc/os-release
- Recognise the package manager each family ships
- Install the same tool with two different managers
- Compare image footprints between distros
Spot the distribution: identify and compare distros in containers
15 min · beginner
Quick quiz
What does every Linux distribution have in common?
Which package manager does the Debian family (Debian, Ubuntu, Kali) use?
Which distro is a lightweight, rolling-release system designed for advanced users who like customisation?
Fedora is the stable enterprise branch from which RHEL is derived.
Which distro is designed specifically for cybersecurity and penetration testing?
You need a stable production server with years of security support and no licensing cost. Which is the best choice?
Cheat sheet
cat /etc/os-releaseAuthoritative distro + versiongrep PRETTY_NAME /etc/os-releaseFriendly distro nameuname -rKernel release (same engine everywhere)hostnamectlOS + kernel overviewcommand -v apt dnf pacman apkReveal the package managerDebian, Ubuntu, Kaliapt / dpkg, .deb packagesRHEL, Fedora, AlmaLinux, Rockydnf (yum), .rpm packagesArchpacman, .pkg.tar.zst, rollingAlpineapk, ~5 MB base, container favouriteopenSUSEzypper, .rpm packagesUbuntu LTSFixed release, ~5 years support, serversRHEL / AlmaLinux / RockyEnterprise fixed release, SLAsFedoraLeading-edge, upstream of RHELArch LinuxRolling, customisable, advanced usersKaliSecurity testing toolingAlpineMinimal containers, embedded