curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER
newgrp docker

docker version
docker info
systemctl status docker

docker ps          # đang chạy
docker ps -a       # tất cả
docker ps -aq      # chỉ ID

docker start   <id|name>
docker stop    <id|name>
docker restart <id|name>
docker rm      <id|name>
docker rm -f   <id|name>   # force

docker exec -it <name> bash
docker exec -it <name> sh   # nếu không có bash

docker logs <name>
docker logs -f <name>          # follow
docker logs --tail 100 <name>  # 100 dòng cuối

docker build -t myapp:1.0 .
docker build -t myapp:latest -f Dockerfile.prod .

docker pull nginx:alpine
docker tag myapp:1.0 registry.io/user/myapp:1.0
docker push registry.io/user/myapp:1.0

docker run -d \
  -v /host/path:/container/path \
  -p 8080:80 \
  --name web nginx

docker compose up -d
docker compose down
docker compose up -d --build
docker compose logs -f

docker inspect <name> | grep IPAddress
docker network ls
docker network inspect bridge

docker system prune -af --volumes

⚠️ Xóa tất cả container, image, volume không dùng.

docker cp ./local.txt container:/app/local.txt
docker cp container:/app/out.log ./out.log

docker run -d \
  --cpus="1.5" \
  --memory="512m" \
  nginx

FROM node:20-alpine
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]

FROM python:3.12-slim
WORKDIR /app
COPY requirements.txt .
RUN pip install --no-cache-dir -r requirements.txt
COPY . .
EXPOSE 5000
CMD ["python", "app.py"]

docker stats
docker stats <name> --no-stream   # snapshot

docker network create mynet
docker run -d --network mynet --name app1 nginx
docker run -d --network mynet --name app2 nginx
# app1 và app2 có thể ping nhau bằng tên

sudo apt update
sudo apt upgrade -y
sudo apt full-upgrade -y

sudo apt install nginx
sudo apt remove nginx
sudo apt purge nginx
apt search nginx
apt show nginx

Xem các volume đang không dùng:
docker volume ls -f dangling=true
Xóa các volume không dùng không xác nhận:
docker volume prune -a
Để biết các volume (và các thành phần khác) đang chiếm bao nhiêu bộ đĩa:
docker system df

df -h
du -sh /var/log
du -sh /* | sort -rh | head -10

systemctl start|stop|restart|enable|disable|status nginx

journalctl -xe
journalctl -u nginx -f
journalctl --since "1 hour ago"
tail -f /var/log/syslog

sudo adduser username
sudo userdel -r username
sudo passwd username
sudo usermod -aG sudo username

chmod 755 file.sh
chmod -R 755 /var/www
chown user:group file
chown -R www-data:www-data /var/www/html

find / -name "*.conf" 2>/dev/null
find /etc -name "nginx*" -type f
grep -r "error" /var/log --include="*.log"

ssh user@192.168.1.10
ssh -p 2222 user@host
scp file.txt user@host:/path/
rsync -avz ./local/ user@host:/remote/

ssh-keygen -t ed25519 -C "email@example.com"
ssh-copy-id user@host

ps aux | grep nginx
pkill nginx
kill -9 <PID>
killall nginx

tar -czf archive.tar.gz /path
tar -xzf archive.tar.gz
zip -r archive.zip folder/
unzip archive.zip -d /dest

sudo apt install ufw
sudo ufw allow 22/tcp
sudo ufw allow 80,443/tcp
sudo ufw enable
sudo ufw status verbose

free -h
nproc
lscpu
vmstat 1 5

timedatectl set-timezone Asia/Ho_Chi_Minh
timedatectl status

i     → Insert mode
Esc   → Normal mode
:w    → Lưu
:q!   → Thoát không lưu
:wq   → Lưu và thoát
/kw   → Tìm kiếm
dd    → Xóa dòng
yy/p  → Copy/Paste dòng

crontab -e    # chỉnh sửa
crontab -l    # xem danh sách
# min hour day month weekday cmd
0 2 * * * /usr/bin/backup.sh
*/5 * * * * /usr/bin/check.sh

uptime
w
cat /proc/loadavg

Load < số core CPU là bình thường.

ip addr show
ip addr show eth0
hostname -I
curl ifconfig.me   # IP public

ss -tlnp
lsof -i :80
lsof -i -P -n | grep LISTEN

iftop              # apt install iftop
nload eth0
ip -s link show eth0

lsblk
sudo mount /dev/sdb1 /mnt/disk
sudo umount /mnt/disk
# /etc/fstab auto mount:
/dev/sdb1  /mnt/data  ext4  defaults  0  2

sudo fallocate -l 2G /swapfile
sudo chmod 600 /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
# /etc/fstab:
/swapfile swap swap defaults 0 0

history
history | grep docker
Ctrl+R  → reverse search

rsync -avz --progress /source/ /backup/
rsync -avz --delete /source/ /backup/
rsync -avz -e ssh /source/ user@remote:/backup/

nc -zv google.com 443
nc -zv 192.168.1.1 22
curl -v telnet://host:port

sudo hostnamectl set-hostname myserver
hostname

curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o awscliv2.zip
unzip awscliv2.zip && sudo ./aws/install
aws configure
aws sts get-caller-identity

aws s3 cp file.txt s3://mybucket/
aws s3 cp s3://mybucket/file.txt ./
aws s3 sync ./local/ s3://mybucket/backup/
aws s3 ls s3://mybucket/ --recursive

kubectl get pods -A
kubectl get nodes
kubectl describe pod <name>
kubectl logs <pod> -f
kubectl exec -it <pod> -- bash
kubectl apply -f deployment.yaml
kubectl delete -f deployment.yaml

server {
    listen 80;
    server_name example.com;
    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com
sudo certbot renew --dry-run

terraform init
terraform plan
terraform apply
terraform apply -auto-approve
terraform destroy

worker_processes auto;
worker_connections 1024;
keepalive_timeout 65;
gzip on;
gzip_types text/plain application/json application/javascript text/css;

1. Ping được không? ping <ip>
2. Port 22 mở? nc -zv <ip> 22
3. systemctl status ssh
4. UFW có block? ufw status
5. cat /var/log/auth.log

du -sh /* 2>/dev/null | sort -rh | head -10
sudo find /var/log -name "*.gz" -delete
sudo journalctl --vacuum-size=200M
docker system prune -af
sudo apt clean

free -h
ps aux --sort=-%mem | head -10
systemctl restart <service>
# top → nhấn M sort theo memory

1. systemctl status <app>
2. tail -f /var/log/nginx/error.log
3. Kiểm tra upstream: ss -tlnp | grep 3000
4. Restart app và nginx

sudo systemctl stop mysql
sudo mysqld_safe --skip-grant-tables &
mysql -u root
-- trong MySQL:
FLUSH PRIVILEGES;
ALTER USER "root"@"localhost" IDENTIFIED BY "NewPass!";
FLUSH PRIVILEGES; quit;
sudo systemctl restart mysql

sudo apt install fail2ban
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd
# /etc/ssh/sshd_config:
Port 2222
PermitRootLogin no
PasswordAuthentication no

nginx -t
sudo nginx -t && sudo systemctl reload nginx
apache2ctl configtest
sudo systemctl restart apache2

who
w
last | head -20
cat /var/log/auth.log | grep Accepted

# /etc/network/interfaces
auto eth0
iface eth0 inet static
    address 192.168.1.100
    netmask 255.255.255.0
    gateway 192.168.1.1
    dns-nameservers 8.8.8.8 1.1.1.1

sudo systemctl restart networking

# /etc/netplan/01-netcfg.yaml
network:
  version: 2
  ethernets:
    eth0:
      addresses: [192.168.1.100/24]
      gateway4: 192.168.1.1
      nameservers:
        addresses: [8.8.8.8, 1.1.1.1]

sudo netplan apply

traceroute google.com
mtr google.com    # realtime

dig google.com
dig @8.8.8.8 google.com
dig google.com MX
nslookup google.com

sudo tcpdump -i eth0
sudo tcpdump -i eth0 port 80
sudo tcpdump -i eth0 host 192.168.1.1
sudo tcpdump -w capture.pcap

nmap 192.168.1.1
nmap -p 1-65535 192.168.1.1
nmap -sV 192.168.1.1       # service version
nmap -A 192.168.1.1        # OS detect
nmap 192.168.1.0/24        # cả subnet

openssl rand -base64 32
openssl rand -hex 20
pwgen -s 20 1

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates
curl -vI https://example.com 2>&1 | grep -E "expire|subject"

grep "Failed password" /var/log/auth.log | tail -20
awk "/Failed/{print \$(NF-3)}" /var/log/auth.log | sort | uniq -c | sort -rn | head

Physical → Data Link → Network → Transport → Session → Presentation → Application

Nhớ: "Please Do Not Throw Sausage Pizza Away"

• L1 Physical: cáp, bit
• L2 Data Link: MAC, switch
• L3 Network: IP, router
• L4 Transport: TCP/UDP, port
• L5-7: Session, Presentation, Application

• /8 = 255.0.0.0 → 16,777,214 host
• /16 = 255.255.0.0 → 65,534 host
• /24 = 255.255.255.0 → 254 host
• /30 = 255.255.255.252 → 2 host

Số host = 2^(32-prefix) - 2

1. Discover: Client broadcast tìm DHCP server
2. Offer: Server gửi IP offer
3. Request: Client xác nhận chọn IP
4. Acknowledge: Server xác nhận cấp IP

1. Browser check local cache
2. Hỏi Recursive Resolver (8.8.8.8)
3. Resolver hỏi Root NS
4. Root trả TLD server (.com)
5. TLD trả Authoritative NS
6. Authoritative NS trả IP

• Static NAT: 1 IP private ↔ 1 IP public cố định
• Dynamic NAT: IP private → pool IP public
• PAT/Masquerade: Nhiều private → 1 public, phân biệt bằng port. Phổ biến nhất ở router gia đình.

• Chia switch vật lý thành nhiều LAN logic tách biệt
• Access port: kết nối end-user, 1 VLAN
• Trunk port: switch-to-switch, mang nhiều VLAN (802.1Q tag)
• Lợi ích: bảo mật, giảm broadcast, linh hoạt

• RAID 0: Striping, nhanh, không dự phòng
• RAID 1: Mirror, an toàn, dung lượng 50%
• RAID 5: Striping+parity, min 3 ổ, chịu 1 ổ hỏng
• RAID 10: RAID1+0, hiệu năng+dự phòng, min 4 ổ

1. SYN: Client → Server (seq=x)
2. SYN-ACK: Server → Client (seq=y, ack=x+1)
3. ACK: Client → Server (ack=y+1)

Đồng bộ sequence number, khởi tạo phiên kết nối.

• 200 OK   201 Created
• 301/302 Redirect
• 400 Bad Request   401 Unauthorized   403 Forbidden
• 404 Not Found
• 500 Server Error   502 Bad Gateway   503 Unavailable

git init / git clone <url>
git status / git log --oneline
git add . && git commit -m "msg"
git push origin main / git pull
git checkout -b feature/new
git merge feature/new
git stash / git stash pop
git reset --hard HEAD~1

• CI – Continuous Integration: auto build+test khi push code
• CD – Continuous Delivery: auto deploy lên staging
• CD – Continuous Deployment: auto deploy production

Tools: GitHub Actions, GitLab CI, Jenkins, CircleCI