Learn Rocky Linux - Core Concepts & Main Architecture

#Introduction

In the previous episode 1, you understood where Rocky Linux came from — the CentOS legacy, the birth of the RESF, and why binary compatibility with RHEL is its core value. Now it's time to dissect what's inside the Rocky Linux machine: how this system is built, what components make it up, and how all the parts work together to form a stable enterprise operating system.

Think of Rocky Linux like a multi-story building. Its foundation is the Linux kernel that manages the hardware. On top of it stands the userland — the programs and libraries you use every day. And at the topmost layer, there are specialized tools like dnf5, systemd, SELinux, and firewalld that keep the building functional and secure. This episode will guide you up floor by floor.

#Architecture and Philosophy

#The Rebuild Model from RHEL Source

Rocky Linux's philosophy is summed up in one phrase: a faithful rebuild. RHEL is released with its source code open in the form of SRPM (Source RPM) — a package containing the original source code plus its build metadata. The Rocky project takes those SRPMs, rebuilds them independently, and distributes the results through the Rocky repositories.

The full flow looks roughly like this:

1. Red Hat releases RHEL along with its SRPMs.
2. The Rocky team takes the SRPMs and rebuilds them using a community-owned build environment.
3. The build results are signed, tested, then published to the Rocky repositories.
4. You install and run those packages — binaries identical to RHEL.

rpm -q --queryformat '%{SOURCERPM}\n' systemd

Because the process is based on consistent rebuilds, the end result is a 100% binary-compatible system. You won't see different source code, a different kernel, or libraries that have been quietly patched.

#Kernel and ABI Compatibility

Binary compatibility means more than just having the same package names. It includes ABI compatibility (Application Binary Interface) — the rules for how programs interact with the kernel and libraries at the binary level. As long as the ABI is compatible, applications compiled for RHEL run without recompilation on Rocky Linux.

Memeriksa versi kernel

uname -r

The kernel running on Rocky Linux comes from the same RHEL kernel branch — stable, tested for enterprise workloads, and supported long-term. You won't find a bleeding-edge kernel here, and that is precisely its strength.

#Core Components

#Kernel

The kernel is the heart of Rocky Linux. It manages CPU, memory, storage, networking, and all interactions with hardware. Unlike community distros that chase the newest kernel versions, Rocky Linux uses a kernel from the RHEL branch that focuses on stability and backward compatibility.

For production, you will often check kernel information:

Informasi kernel

uname -a

Deeper kernel concepts — the boot process, kernel modules, and boot parameters — will be covered thoroughly in episode 10.

#GNU Userland

On top of the kernel sits the GNU userland: shells like Bash, core tools like ls, grep, and sed, the GCC compiler, and the C library (glibc) that is the foundation of almost every program. This userland is what lets you interact with the system through the terminal.

#DNF5 Package Manager

DNF5 is the modern package manager that handles installing, upgrading, and removing RPM packages. DNF5 is the latest version of DNF — faster, more memory-efficient, and available in Rocky 10. All your interactions with repositories — BaseOS, AppStream, EPEL — go through DNF5. To see the list of active repositories, run dnf5 repolist — a command you will use repeatedly starting in episode 4.

dnf5 --version

#Systemd

Systemd is the init system that is the first process the kernel runs. It manages services, devices, mount points, and centralized logs via journald. Almost every service management command in this series — systemctl start, systemctl enable, journalctl — is an interaction with systemd. Episode 7 will cover it in depth.

#SELinux and Firewalld

SELinux (Security-Enhanced Linux) provides Mandatory Access Control (MAC) that restricts what processes are allowed to do, even for root — a concept you will deepen in episode 14. Firewalld is the firewall that regulates network traffic based on zones and services, with nftables as its backend, and is covered in episode 13.

Both are security components that are active by default. Many beginner sysadmins immediately disable them because they're "troublesome", but in this series you will learn to leverage them — not fight them.

#Cockpit Web Console

Cockpit is a built-in web console that lets you manage the server through a browser: monitoring CPU and memory, managing services, viewing logs, and even checking updates. Cockpit doesn't replace the CLI, but it's a convenient observability gateway. Episode 11 will take it further.

#Repositories and Package Model

Rocky Linux separates packages into several repositories based on their role:

The separation of BaseOS and AppStream is an important innovation in RHEL 8 and later. Core packages whose versions rarely change live in BaseOS, while applications that update more frequently — such as Node.js or PostgreSQL — live in AppStream as module streams that allow multiple versions to coexist. Episode 5 will cover this model in detail.

#The Big Picture

If you put all the components together, this is what a Rocky Linux system looks like:

+--------------------------------------------------+
|  Cockpit (web console)         |
+--------------------------------------------------+
|  Aplikasi & workload (via dnf5)                  |
+--------------------------------------------------+
|  SELinux  |  firewalld  |  systemd  |  journald  |
+--------------------------------------------------+
|  Userland GNU (glibc, coreutils, shell)          |
+--------------------------------------------------+
|  Kernel (cabang RHEL)                            |
+--------------------------------------------------+
|  Hardware: CPU, RAM, disk, NIC                   |
+--------------------------------------------------+

Each layer has a clear role, and security is not delegated to a single component — SELinux protects from within, firewalld from the network, and systemd keeps services alive. Understanding this architecture will make the following episodes much easier to digest.