Ubuntu

This skill covers Ubuntu across all supported LTS versions (20.04, 22.04, 24.04, and 26.04), covering both Desktop and Server editions. It provides deep knowledge of:

• apt/dpkg package management, PPAs, deb822 format, and pinning
• snap packaging, confinement, interfaces, refresh scheduling, and Snap Store
• Netplan declarative networking (systemd-networkd and NetworkManager backends)
• cloud-init multi-stage initialization, datasources, and user-data formats
• UFW (Uncomplicated Firewall) with nftables backend
• AppArmor path-based mandatory access control
• Ubuntu Pro, ESM (Extended Security Maintenance), and Livepatch
• Subiquity server installer with autoinstall YAML
• ZFS root filesystem support (pools, datasets, snapshots)
• LXD/Incus system containers and VMs
• MicroK8s lightweight Kubernetes distribution

For generic Linux kernel internals and systemd fundamentals, see the rhel skill. This skill focuses on Ubuntu-specific tooling and approaches.

When a question is version-specific, read the relevant file under references/versions/. When the version is unknown, provide general guidance and note where behavior differs across versions.

How to Approach Tasks

Route by request type: troubleshooting → references/diagnostics.md; optimization → references/best-practices.md; architecture → references/architecture.md; edition selection → references/editions.md; administration → the guidance below.

Identify the Ubuntu LTS version first — package format, kernel features, and default tooling shift between releases. Apply Ubuntu-specific reasoning, not generic Linux advice. Validate with systemctl, journalctl, apt queries, and snap checks.

Core Expertise

apt / dpkg Package Management

apt is the high-level package resolver; dpkg is the low-level installer. Ubuntu uses the Debian .deb format.

# Package operations
apt update -q
apt install nginx -y
apt full-upgrade -y                    # upgrade + allow removals for deps
apt autoremove --purge -y              # remove orphans and config files
apt list --upgradable 2>/dev/null      # pending upgrades

# Package queries
dpkg -l 'nginx*'                       # list packages matching pattern
dpkg -L nginx                          # files owned by package
dpkg -S /usr/bin/curl                  # which package owns file
apt-cache policy nginx                 # installed vs available versions
apt-cache rdepends --installed nginx   # reverse dependencies

# Repair
dpkg --configure -a                    # configure partially installed
apt --fix-broken install               # resolve broken dependencies

Repository configuration evolved across versions:

• Pre-24.04: /etc/apt/sources.list one-liner format
• 24.04+: /etc/apt/sources.list.d/ubuntu.sources deb822 format (multi-value, Signed-By field)

Archive components: main (Canonical-supported), restricted (proprietary drivers), universe (community FOSS), multiverse (non-free).

PPAs: add-apt-repository ppa:owner/name adds a Launchpad-hosted repo. Store keys in /etc/apt/keyrings/ with Signed-By in the source definition.

snap Packaging

snap delivers self-contained, sandboxed applications with automatic updates.

# Snap lifecycle
snap install firefox                   # install from Snap Store
snap install code --classic            # classic confinement (full access)
snap refresh --hold=48h firefox        # defer updates
snap revert firefox                    # rollback to previous revision
snap remove --purge firefox            # remove with all data

# Inspection
snap list                              # installed snaps
snap info firefox                      # channels, confinement, version
snap connections firefox               # interface plug/slot connections

# Administration
snap set system refresh.timer="mon-fri,02:00-04:00"  # set refresh window
snap list --all | awk '/disabled/{print $1, $3}'      # old revisions

Confinement: strict (AppArmor + seccomp sandbox), classic (full system access), devmode (violations logged only). Snap data lives in /var/snap/ and ~/snap/.

Netplan Networking

Netplan is Ubuntu's declarative network configuration layer. It generates backend configs for systemd-networkd (server) or NetworkManager (desktop).

netplan apply                          # apply configuration
netplan try                            # apply with 120s auto-revert
netplan generate                       # write backend config only
netplan status                         # interface status (1.0+)
netplan get                            # current effective config

Configuration in /etc/netplan/*.yaml:

network:
  version: 2
  renderer: networkd
  ethernets:
    eth0:
      addresses: [192.168.1.10/24]
      routes:
        - to: default
          via: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

cloud-init

cloud-init initializes instances across five stages: generator, local, network, config, final. Datasources include EC2, Azure, GCE, OpenStack, and NoCloud.

cloud-init status --wait               # block until complete
cloud-init query -a                    # dump all instance metadata
cloud-init schema --config-file user-data.yaml  # validate syntax
cloud-init clean --logs                # reset for re-run

Network config written to /etc/netplan/50-cloud-init.yaml. Disable with: /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg containing network: {config: disabled}.

UFW Firewall

UFW is Ubuntu's default firewall frontend (iptables/nftables backend).

ufw status verbose                     # current rules and defaults
ufw default deny incoming
ufw default allow outgoing
ufw allow 22/tcp
ufw allow 'OpenSSH'
ufw allow from 10.0.0.0/8 to any port 22
ufw limit ssh                          # rate-limit (6 per 30s)
ufw enable
ufw logging medium

Application profiles in /etc/ufw/applications.d/. Ubuntu does not use firewalld by default.

AppArmor

AppArmor is Ubuntu's default MAC system (path-based profiles, unlike RHEL's SELinux label-based model).

aa-status                              # all profiles and modes
aa-enforce /etc/apparmor.d/usr.sbin.nginx
aa-complain /etc/apparmor.d/usr.sbin.nginx
journalctl -k | grep -i "apparmor.*denied"  # view denials
aa-genprof /usr/sbin/myapp             # generate profile
aa-logprof                             # update profiles from audit log

Modes: enforce (block + log), complain (log only), unconfined (no profile).

Ubuntu Pro / ESM / Livepatch

Ubuntu Pro extends LTS security maintenance from 5 to 10 years. Free for up to 5 machines.

pro attach <token>                     # attach subscription
pro status                             # show enabled services
pro enable esm-infra                   # extended main repo patches
pro enable esm-apps                    # extended universe patches
pro enable livepatch                   # kernel live patching
pro enable usg                         # CIS/STIG hardening
pro fix CVE-2024-XXXXX                 # check and fix a CVE

ESM-infra covers main packages; ESM-apps covers universe (23,000+ packages). Livepatch applies critical kernel CVE patches in-memory without reboots via canonical-livepatch.

Subiquity / Autoinstall

Subiquity is Ubuntu's server installer (replaced debian-installer in 20.04). Autoinstall YAML enables unattended provisioning.

#cloud-config
autoinstall:
  version: 1
  identity:
    hostname: myserver
    username: ubuntu
    password: $6$...
  storage:
    layout:
      name: lvm
  ssh:
    install-server: true
  packages:
    - nginx
  late-commands:
    - curtin in-target -- systemctl enable nginx

Key sections: identity, storage, network, ssh, packages, snaps, late-commands.

ZFS Support

Ubuntu provides first-class ZFS root filesystem support (not available on RHEL):

zpool status                           # pool health
zpool scrub rpool                      # integrity check
zfs list                               # datasets
zfs list -t snapshot                   # snapshots
zfs snapshot rpool/ROOT/ubuntu@backup  # create snapshot
zfs rollback rpool/ROOT/ubuntu@backup  # restore snapshot

Default server install uses LVM (ubuntu-vg/ubuntu-lv); ZFS is an installer option since 20.04.

LXD / Incus

System container and VM manager. Canonical's LXD (snap) and community fork Incus (deb, 24.04+).

lxc launch ubuntu:24.04 mycontainer   # create container
lxc launch ubuntu:24.04 myvm --vm     # create VM
lxc exec mycontainer -- bash           # shell into container
lxc snapshot mycontainer snap0         # snapshot
lxc restore mycontainer snap0          # restore
lxc list                               # list instances
lxc storage list                       # storage pools

MicroK8s

Canonical's lightweight Kubernetes, packaged as a strict-confined snap.

snap install microk8s --classic --channel=1.32/stable
microk8s status                        # cluster status
microk8s kubectl get nodes             # standard kubectl
microk8s enable dns storage ingress    # enable add-ons
microk8s add-node                      # generate HA join token
microk8s inspect                       # diagnostic report

HA requires 3+ nodes with Dqlite (distributed SQLite) replacing etcd.

Common Pitfalls

1. Editing /etc/apt/sources.list on 24.04+ instead of deb822 .sources files Ubuntu 24.04 defaults to /etc/apt/sources.list.d/ubuntu.sources (deb822 format). The legacy sources.list may be empty or absent. Always check which format is in use before editing.

2. Using apt-key instead of Signed-By keyrings apt-key is deprecated since 22.04 and removed in 24.04. Import keys with gpg --dearmor -o /etc/apt/keyrings/<name>.gpg and reference via Signed-By in the source definition.

3. Not enabling UFW after adding rules UFW rules are inactive until ufw enable is run. Adding rules without enabling the firewall provides no protection.

4. Ignoring snap disk accumulation Old snap revisions accumulate. By default, 2 revisions are kept per snap. Run snap list --all and remove disabled revisions to reclaim space.

5. Running without Ubuntu Pro after 20.04 standard EOL Ubuntu 20.04 standard support ended April 2025. Without Pro ESM enrollment, systems receive zero security updates. Attach immediately or plan an upgrade.

6. Using firewalld on Ubuntu instead of UFW Installing firewalld on Ubuntu conflicts with UFW. Stick with UFW unless there is a specific multi-zone requirement.

7. Forgetting needrestart after apt upgrades After apt full-upgrade, services using updated libraries need restarting. Install and run needrestart to detect stale processes. Configure automatic restart in /etc/needrestart/needrestart.conf.

8. Not using netplan try for remote network changes netplan apply is immediate and can lock you out of a remote system. Always use netplan try which auto-reverts in 120 seconds if not confirmed.

9. Disabling AppArmor instead of fixing profile denials AppArmor profiles are easier to fix than SELinux policies. Use aa-complain for learning mode, aa-logprof to update profiles, and journalctl -k | grep apparmor to find denials.

10. Missing cloud-init network disable file cloud-init regenerates /etc/netplan/50-cloud-init.yaml on each boot. Manual netplan edits are overwritten unless cloud-init network config is disabled via /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg.

Version-Specific Guidance

Version	Reference	What's version-specific
20.04	references/versions/20.04.md	ZFS root (zsys), WireGuard in-kernel, snap matured, LXD 4.0, ESM-only migration, Multipass, cloud-init v2 network
22.04	references/versions/22.04.md	Wayland default, GNOME 42, real-time kernel (Pro), Active Directory integration (adsys), nftables default, LXD 5.0, OpenSSL 3.0
24.04	references/versions/24.04.md	Netplan 1.0, AppArmor user namespaces, deb822 sources, TPM-backed FDE (experimental), frame pointers default, GNOME 46, Firefox/Thunderbird snap-only
26.04	references/versions/26.04.md	Kernel 7.0, GNOME 50 Wayland-only, dracut (replaces initramfs-tools), sudo-rs, APT 3.1, cgroup v2 mandatory, Chrony (replaces timesyncd), post-quantum SSH

Reference Files

Load these when you need deep knowledge for a specific area:

• references/architecture.md -- apt/dpkg/snap internals, Netplan, cloud-init, ZFS, LXD/Incus, MicroK8s, Ubuntu Pro overlay, Subiquity/autoinstall. Read for "how does X work" questions.
• references/diagnostics.md -- apport, apt troubleshooting, snap debugging, Netplan diagnostics, systemd-resolved DNS, UFW log analysis, performance tools, sosreport. Read when troubleshooting errors.
• references/best-practices.md -- CIS hardening (USG), UFW configuration, unattended-upgrades, AppArmor, Livepatch, snap management, backup/recovery, Landscape. Read for design and operations questions.
• references/editions.md -- Ubuntu variants, flavours, Pro vs free tier, lifecycle, Desktop vs Server, cloud images, Ubuntu Core, edition selection guide. Read for edition and licensing questions.