A realistic practice space.
Clear boundaries.

The lab is designed to teach operator habits without running a command on your real machine.

Command language: Single/double quotes, escaped spaces, $VARIABLE, ${VARIABLE}, $?, assignments, export, unset, &&, ||, ;, pipelines up to eight commands, >, >>, <, 2>, 2>>, and 2>&1.
State and permissions: A virtual filesystem, owner/group/other rwx checks, persistent scratch state, environment variables, current directory, service state, and meaningful command exit codes.
Input controls: Up/down history, draft restoration, Tab completion, Ctrl+C, Ctrl+L, Ctrl+A, Ctrl+E, Ctrl+U, and Ctrl+K. Escape followed by Tab leaves the command field.
Deliberate limits: No real OS processes, network connections, model calls, packages, credentials, or arbitrary script evaluation. No command substitution, background jobs, shell functions, full scripting interpreter, full regex engine, or full jq.
Platforms: The main filesystem is Linux-oriented. A few macOS-oriented lessons use fixed brew, launchctl, and plutil fixtures; those tools are not claimed as Linux commands.
Administration fixtures: nginx syntax validation covers a small teaching subset. systemctl start/stop/restart/reload changes virtual state. Package, SSH, resource, and many inspection commands return fixed training data.
File safety: Protected paths and unsupported deletion are blocked in this simulator. A real shell may not protect them. Do not paste unfamiliar training commands into production.
Web safety: HTML/CSS previews are sanitized and cannot load student-specified URLs or submit forms. JavaScript is structurally checked, not executed. A real browser and accessibility audit remain necessary for real projects.
Progress: Existing lesson/task/mission IDs, XP, daily challenges, and account sync are preserved. New mastery and incident badges are local practice records, not tamper-proof credentials. Latest ten lesson scratch workspaces are kept; earned progress is separate.

Command reference

Find a supported command

`pwd`

Print the directory that relative paths currently resolve from.

pwd

A relative path is interpreted from the working directory, not necessarily the home folder.

`ls`

List directory entries; -a includes hidden names and -l adds ownership and permission detail.

ls -la /home/learner

A listing is not proof that you can read or modify every listed file.

`cd`

Change the shell working directory; .. selects the parent and ~ identifies your home.

cd /var/log

Changing directories changes how later relative paths resolve.

`cat`

Read one or more files to standard output without editing their contents.

cat /etc/hostname

Reading a source file should precede changing it; avoid printing real secrets.

`less`

Inspect text without changing the file. This simulator displays a bounded snapshot rather than an interactive pager.

less /var/log/syslog

The real less pager has navigation controls that are outside this lab subset.

`head`

Show the beginning of an input; -n sets how many lines to include.

head -n 3 /var/log/syslog

A small sample may omit the failure. Choose the time window you actually need.

`tail`

Show the end of an input; -n selects the number of lines.

tail -n 3 /var/log/syslog

This browser lab snapshots output; it does not keep a live tail -f stream.

`grep`

Select input lines that match a pattern; -i ignores case, -n adds line numbers, and -v inverts selection.

grep -n nginx /var/log/syslog

No matches is exit status 1, which is different from a malformed invocation.

`wc`

Count input. -l counts newline characters, -w counts whitespace-delimited words, and -c counts bytes.

wc -l /var/log/syslog

Text without a final newline may have fewer counted lines than visible rows.

`sort`

Order lines before comparing or grouping them; -n compares numerically and -r reverses order.

sort /etc/passwd

Alphabetical sorting is not numeric sorting.

`uniq`

Collapse adjacent duplicate lines; use sort first when duplicates are not already together.

printf "a\na\nb\n" | uniq -c

uniq does not find every duplicate in an unsorted stream.

`printf`

Format data deliberately, including separators and final newlines.

printf "%s\n" ready

A format string controls output; a newline is data, not an automatic guarantee.

`echo`

Write simple text to standard output. Prefer printf when exact formatting matters.

echo ready

Redirection can overwrite an existing file before the command runs.

`mkdir`

Create a directory. -p also creates missing parent directories and accepts an existing directory.

mkdir -p lab/notes

Creating a folder does not change the current directory.

`touch`

Create an empty file when absent, or update timestamps without truncating an existing file.

touch lab/check.txt

touch is not a way to empty a file that already has content.

`cp`

Copy a file to a new location, leaving the original in place.

cp /etc/hosts lab/hosts.copy

Confirm the destination before replacing a file. This lab supports file copies, not every cp option.

`mv`

Move or rename a file; the old path no longer names it afterward.

mv lab/old.txt lab/new.txt

A successful move should be verified at both the destination and the old path.

`rm`

Remove the named file from the virtual workspace. The training root and system trees are guarded.

rm lab/check.txt

Simulator protections are not a promise that a real shell will protect the same target.

`find`

Search directory trees by criteria rather than relying on one shallow listing.

find /var/log -name "*.log"

Quote wildcard patterns so find receives them instead of the shell expanding them first.

`stat`

Inspect a file or directory metadata record, including ownership, permissions, and size.

stat /etc/hosts

Metadata and file contents answer different questions.

`file`

Identify a file from its characteristics rather than trusting only the filename extension.

file /etc/hosts

The simulator uses a small reviewed type classifier, not the full system magic database.

`du`

Estimate usage attributed to files or directories; compare it with filesystem capacity when investigating storage.

du -sh /var/log

du describes file usage, whereas df describes filesystem capacity.

`df`

Inspect the virtual filesystem capacity report. Real systems can run out of space or inodes independently.

df -h

Available space is a snapshot, not a guarantee that a later write will succeed.

`chmod`

Change permissions using an octal mode or a symbolic adjustment. Each rwx bit belongs to owner, group, or other.

chmod 640 lab/check.txt

Do not use 777 as a blanket fix. Grant the smallest access needed.

`chown`

Change ownership; on a real Linux system changing the file owner normally requires elevated privilege.

sudo chown learner:learners lab/check.txt

Ownership and mode bits are separate controls; inspect both.

`chgrp`

Change the file group within the permissions of the acting user.

chgrp learners lab/check.txt

A group name alone does not grant access unless membership and mode bits agree.

`id`

Inspect user identity and group membership.

id

A file group is useful only when the acting user belongs to it or has an applicable override.

`whoami`

Print the effective user name.

whoami

An elevated command can run with a different effective identity from the normal shell.

`groups`

List the groups associated with the training user.

groups

Directory search permission also matters when accessing a file inside it.

`sudo`

Run a permitted command as the simulated root user without changing the real computer.

sudo systemctl restart nginx

Shell redirections happen before sudo starts the command; sudo echo does not elevate the > operator.

`ps`

Inspect a bounded snapshot of simulated processes.

ps aux

A process being present does not prove that its service can handle requests.

`pgrep`

Find simulated process IDs by a name pattern.

pgrep nginx

Verify a process identity before sending a signal.

`top`

Inspect a single training snapshot of process and resource activity.

top

This lab does not run a continuously refreshing process monitor.

`kill`

Send an allowlisted signal to a simulated process target.

kill -TERM 321

Prefer the service manager for managed daemons and understand the signal before using it.

`systemctl`

Inspect or change a simulated systemd service. Status, active state, and unit configuration reveal different evidence.

systemctl status nginx

A service can be active while an application endpoint is unhealthy; verify both layers.

`journalctl`

Read the training journal by unit or a bounded line window.

journalctl -u nginx -n 10

A relevant unit and time range are more useful than an unfiltered wall of logs.

`nginx`

Check the simulated configuration using nginx -t before changing service state.

nginx -t

This lab checks a limited configuration subset, not the complete Nginx parser.

`ss`

Inspect simulated listening sockets and connection information.

ss -ltnp

A listening socket is not proof of correct application responses or external reachability.

`ip`

Inspect simulated interface and route state.

ip route

An interface address, a route, and a reachable service are separate parts of connectivity.

`ufw`

Inspect or adjust the training firewall rule list. No real firewall changes occur.

ufw status verbose

Firewall rules should be scoped and reviewed; simulator access is not a production change approval.

`curl`

Request a fixed synthetic training endpoint. This sandbox never contacts an arbitrary network destination.

curl http://localhost/

Check the HTTP result as well as the transport status; HTTP errors are not always curl failures without -f.

`free`

Inspect simulated memory totals and availability.

free -h

Allocated, cached, available, and free memory are not interchangeable measures.

`uptime`

Read simulated runtime and load information.

uptime

Load average is not a direct CPU percentage.

`uname`

Inspect simulated operating-system identity.

uname -a

A kernel string is not a complete inventory of packages or configuration.

`hostname`

Read the simulated host name.

hostname

A name helps orient an operator but is not proof of network reachability.

`date`

Read the lab clock representation and practice unambiguous timestamp labeling.

date

Name the timezone when comparing evidence from different systems.

`env`

Inspect shell environment variables. Assignments and export affect the training environment, never your host shell.

env

Environment output may expose real credentials outside the simulator.

`history`

Review commands entered during this session. History is a navigation aid, not evidence that a command succeeded.

history

Completion in this release checks command outcomes, not history strings alone.

`clear`

Clear visible terminal output without erasing files or earned progress.

clear

Clearing the screen is not the same as resetting the lab.

`reset`

Reset the current virtual environment. It never resets the operating system running your browser.

reset

Save a relevant result before discarding scratch work.

`help`

List the commands supported by this teaching simulator.

help

A familiar command may support fewer flags here than in a full shell.

`man`

Read a short built-in teaching reference for one supported command.

man grep

For real administration, check the installed command manual and version too.

`which`

Find the simulated executable path for a command.

which nginx

A path lookup does not prove that running the command will succeed.

`type`

Describe the shell command resolution for a supported name.

type cd

Shell builtins and external commands are not resolved in exactly the same way.

`basename`

Remove directory components from a path string.

basename /etc/nginx/nginx.conf

String manipulation does not verify that the target exists.

`dirname`

Extract the directory portion of a path string.

dirname /etc/nginx/nginx.conf

A path can be syntactically valid without naming an existing directory.

`readlink`

Inspect a symbolic-link target; use resolution options deliberately.

readlink /home/learner/current

A symlink contains a target path, not another copy of the target file.

`realpath`

Resolve a path to its canonical location in the virtual filesystem.

realpath /etc/../etc/hosts

Resolving a path and reading its contents are separate operations.

`ln`

Create a symbolic link in the lab with ln -s.

ln -s /etc/hosts lab/hosts.link

A relative symlink target is interpreted from the link directory.

`tar`

Practice archive inventory, creation, and extraction in a simulated archive format.

tar -tf /home/learner/backups/site.tar

These training archives are virtual data structures, not downloadable production tar files.

`diff`

Compare two text files; a difference is a meaningful nonzero status, not necessarily an execution error.

diff /etc/hosts /home/learner/lab/hosts.copy

Status 1 means differences for diff; shell status must be interpreted in command context.

`sha256sum`

Compare content digests to detect byte changes, not to establish who authored the file.

sha256sum /etc/hosts

A checksum detects changes only relative to a trusted expected digest.

`cut`

Extract delimiter-separated fields or character ranges from text.

cut -d : -f 1 /etc/passwd

A delimiter parser is not a general CSV parser with quoted fields.

`awk`

Extract whitespace-delimited fields with the supported print patterns.

awk "{print $1}" /etc/hostname

Quote awk programs so shell variable expansion does not consume $1; single quotes are usually appropriate.

`sed`

Preview a supported substitution or line range without changing the source file.

sed "s/localhost/training/" /etc/hosts

Without a global flag, a substitution normally changes only the first match on each line.

`tr`

Translate or remove supported character sets from a stream.

printf "ready\n" | tr a-z A-Z

tr operates on characters, not whole words or regular-expression matches.

`tee`

Copy a stream both to a file and standard output; -a appends.

printf "ready\n" | tee lab/status.txt

tee can overwrite a file even though the output is also visible on screen.

`xargs`

Practice constructing a supported command from input words.

printf "one two\n" | xargs echo

Whitespace splitting does not safely represent every possible filename.

`nl`

Number input lines for a readable evidence reference.

nl -ba /etc/hosts

Line numbers depend on the exact file version and numbering mode.

`comm`

Compare sorted line sets and select unique or common columns.

comm /home/learner/lab/a.txt /home/learner/lab/b.txt

Both inputs must be sorted under the same ordering rules.

`test`

Evaluate a file or string condition through its exit status rather than printed output.

test -f /etc/hosts && echo present

A successful test usually prints nothing; inspect $? or chain a command.

`mktemp`

Create a uniquely named scratch location in the virtual filesystem.

mktemp -d

Do not guess a temporary filename when isolation matters.

`nano`

Edit a virtual text file using the browser editor and explicitly save it.

nano lab/runbook.txt

Opening the editor does not complete a write task. Save and verify the contents.

`ssh`

Inspect a fixed SSH training scenario; no real remote connection is made.

ssh learner@training-host

Verify host identity and choose credentials deliberately on real systems.

`ssh-keygen`

Review or create a simulated SSH-key artifact. It is not a usable cryptographic credential.

ssh-keygen -lf /home/learner/.ssh/id_ed25519.pub

Do not confuse public keys, private keys, and host fingerprints.

`scp`

Practice a fixed simulated copy workflow without network transfer.

scp lab/note.txt learner@training-host:/tmp/

Direction, destination, and host identity matter before copying real files.

`apt`

Inspect a fixed training package inventory. The simulator cannot install or upgrade your computer.

apt policy nginx

Candidate, installed, and repository versions answer different questions.

`dpkg`

Inspect installed-package records in the synthetic Debian-style environment.

dpkg -l nginx

Repository availability and installed package state are separate evidence.

`brew`

Review a synthetic Homebrew package record alongside the Linux-oriented labs.

brew info nginx

Homebrew and apt are different platform ecosystems; these outputs are training fixtures.

`crontab`

Inspect the simulated user schedule. No task is scheduled outside the browser.

crontab -l

A scheduled entry is not proof that its last run succeeded.

`logrotate`

Inspect or dry-run a simulated log-rotation policy.

logrotate -d /etc/logrotate.conf

A dry run reports intended behavior without rotating real logs.

`lsof`

Inspect a synthetic association between processes and open files or sockets.

lsof -i :80

Combine process and socket evidence rather than assuming a service from its port number.

`mount`

Inspect a synthetic mounted-filesystem table.

mount

Mount options can affect writability independently of file ownership.

`lsblk`

Inspect a synthetic block-device tree.

lsblk

A device, partition, filesystem, and mount point are different concepts.

`launchctl`

Inspect a fixed macOS launch-service fixture rather than invoking systemd.

launchctl list

Platform-specific service managers are not interchangeable.

`plutil`

Inspect a fixed property-list fixture used in macOS-oriented lessons.

plutil -lint /home/learner/lab/service.plist

A valid configuration syntax check does not prove runtime behavior.

`jq`

Select a supported JSON field, array value, or length from a fixture.

jq .status /opt/ai-lab/case.json

JSON values have types. This lab supports a small read-only subset of jq filters.

`aiops`

Inspect the fixed AI training inventory and reports. All outputs are synthetic, not live provider measurements.

aiops models list

A canned inspection is practice evidence, not an operational measurement.