CLI Command Cheat Sheet

Click any term to see a beginner-friendly explanation. Cross-references inside an explanation open in a stacked modal — Escape closes them one at a time.

• ABI Application Binary Interface The low-level contract between compiled code and the system — calling conventions, struct layouts, library symbol versions. Binaries built against one ABI may break on another (different glibc version, musl vs glibc, x86_64 vs aarch64). Why a Linux x86_64 binary won't just run on macOS even though both are Unix.
• CLI Command-Line Interface A text-only program you drive by typing commands at a shell prompt instead of clicking a GUI. POSIX conventions standardise flag style (-x, --long-flag) and exit codes (0 = success, non-zero = error).
• Cron cron / crontab Think of cron as an alarm clock for your computer. You write a schedule once and the system runs the command automatically — every night, every hour, every Monday morning. A Unix time-based job scheduler. Jobs are defined in a per-user crontab file (edit with crontab -e; list with crontab -l). Each line specifies a schedule using five fields (minute, hour, day-of-month, month, day-of-week) followed by the command to run. The daemon crond wakes every minute and fires matching jobs.
• curl curl (Client URL) A command-line tool for transferring data to or from a URL — HTTP, HTTPS, FTP, SFTP, and more. Useful for testing APIs, downloading files, and scripting web requests. Common flags: -s silent, -o write to file, -L follow redirects, -H add a header, -d send POST body, -X set HTTP method, -u user:pass basic auth.
• Daemon Daemon (background service process) A daemon is a background worker your computer keeps running quietly — you never interact with it directly, but it's always there answering requests (like a web server) or doing housekeeping. A long-running background process that provides a system service — web servers (nginx, apache), databases (postgres, mysqld), schedulers (crond), SSH server (sshd). Daemons typically start at boot, run as dedicated users, and have no terminal attached. On modern Linux, managed by systemd (systemctl start|stop|status <name>).
• Environment variable Environment Variable Environment variables are like sticky notes passed to every program you launch. The program can read them to know where things are or how to behave — without you having to pass those details as flags every time. A named string value that processes inherit from their parent shell — used to pass configuration without hard-coding it. Set temporarily with VAR=value cmd (just for that command) or persistently with export VAR=value in your shell init file. The PATH variable is the canonical example; others include HOME, EDITOR, LANG, and NO_COLOR.
• EOF End Of File The signal that a stream has no more data. In a terminal, send EOF with Ctrl+D — many CLIs (cat, wc, ssh sessions) exit cleanly on EOF rather than needing an explicit "quit" command. In heredoc syntax, <<EOF reads stdin until a line containing only EOF appears.
• Exit code Process Exit Status The number a command returns when it finishes — 0 means success, any non-zero value means failure (often 1 = generic error, 2 = misuse, 126 = not executable, 127 = command not found, 130 = killed by Ctrl+C). Check it with echo $? in bash/zsh. Shell scripts chain on exit codes (cmd1 && cmd2, cmd1 || cmd2).
• git git (distributed version control) A distributed version control system: every clone is a full repository with complete history. Core concepts: commits (snapshots), branches (lightweight movable pointers), remotes (other repos you sync with), staging area (index — what your next commit will contain). The working tree is what you actually edit on disk.
• Glob Glob Pattern Shell wildcard matching for filenames — * matches any characters except /, ? matches a single character, [abc] matches one of the listed characters, ** (with globstar or zsh) matches across directory levels. Not the same as regex — globs are simpler and filename-only.
• grep grep (Global Regular Expression Print) Searches one or more files (or stdin) for lines matching a regular expression and prints matching lines. Key flags: -i case-insensitive, -r recursive, -l filenames only, -n line numbers, -v invert (non-matching lines), -E ERE, -P PCRE, -q silent (just exit code).
• Heredoc Here Document A heredoc lets you write a block of text directly in your script without needing a separate file or lots of echo calls — handy for config templates, SQL queries, or multi-line messages. A shell syntax for embedding a multi-line string literal inline, feeding it as stdin to a command. <<MARKER reads until a line that is exactly MARKER (the EOF sentinel). Quoting the marker (<<'EOF') suppresses variable and command substitution inside the body; <<-EOF strips leading tabs so you can indent the body.
• Inode Index Node A data structure on a Unix filesystem that stores metadata for a file or directory — permissions, owner, timestamps, size, and the block addresses where the data lives — but not the filename. Filenames are just directory entries that map a name to an inode number. Hard links share an inode; a symlink has its own inode pointing at a path. Check with ls -i or stat.
• PATH $PATH (Executable Search Path) Colon-separated list of directories the shell searches when you type a command. Inspect with echo $PATH; prepend a directory with export PATH="/new/dir:$PATH" in your shell init file (~/.bashrc, ~/.zshrc). which cmd tells you which copy wins for a given name.
• PID Process ID The unique integer the kernel assigns to a running process. Find one with pgrep nginx or ps aux | grep nginx; act on it with kill <pid>. PID 1 on Linux is the init process (systemd / launchd on macOS).
• Pipe Pipe / | operator The pipe is the Unix superpower: small programs that each do one thing well, snapped together like LEGO. The output of the first becomes the input of the next. Connects the stdout of one process to the stdin of the next, without writing a temporary file. The shell wires them up before either process starts, so they run concurrently. Chain as many stages as needed: cmd1 | cmd2 | cmd3. Only stdout is piped — stderr still goes to the terminal unless you redirect it first (2>&1 |).
• POSIX Portable Operating System Interface A family of IEEE standards (most notably IEEE 1003.1) that define a common Unix-like API and shell behaviour. POSIX-compliant scripts avoid bash-isms ([[ ]], arrays, <( )) and run on dash, ash, ksh, etc. #!/bin/sh implies POSIX; #!/bin/bash doesn't.
• Redirection I/O Redirection Redirection lets you save output to a file, silence noisy errors, or feed a file to a command as if you had typed it — all without changing the program itself. Shell syntax that rewires a process's file descriptors before it starts — pointing stdout or stderr at a file instead of the terminal, or feeding a file into stdin. > truncates, >> appends, < reads from a file, 2> redirects stderr, 2>&1 merges stderr into stdout, &> (bash) redirects both at once.
• Regex Regular Expression A pattern language for matching text — far more expressive than globs. grep uses BRE (basic) by default, ERE with -E, PCRE with -P; sed uses BRE; awk uses ERE. The flavour matters: + needs \+ in BRE but works bare in ERE.
• REPL Read–Eval–Print Loop An interactive language prompt — type code, get the result immediately, repeat. python3, node, irb, ghci are all REPLs. Distinct from running a script file: a REPL keeps state between lines and prints expression values.
• Shebang #! Interpreter Directive The first line of an executable script that tells the kernel which interpreter to use — #!/usr/bin/env python3, #!/bin/bash, #!/usr/bin/env node. Using /usr/bin/env looks up the interpreter via PATH so the script works whether Python is installed at /usr/bin or /usr/local/bin.
• SSH Secure Shell SSH is like a secure encrypted telephone line to another computer. Once connected, you get a shell just as if you were sitting in front of that machine. A cryptographic network protocol for logging into remote machines and running commands securely over an untrusted network. The client is ssh; the server daemon is sshd. Key-based auth (via ssh-keygen + ssh-copy-id) is preferred over passwords. ~/.ssh/config lets you define aliases, jump hosts, and per-host options.
• Stderr Standard Error (file descriptor 2) The separate stream for diagnostics and errors so they don't pollute piped stdout. Redirect with cmd 2> errors.log; merge into stdout with cmd 2>&1; silence everything with cmd > /dev/null 2>&1.
• Stdin Standard Input (file descriptor 0) The default input stream for a process — usually the keyboard, or whatever the previous command in a pipeline produced (cmd1 | cmd2). Redirect from a file with cmd < file; close it with cmd < /dev/null.
• Stdout Standard Output (file descriptor 1) The default output stream — usually the terminal. Redirect to a file with cmd > out.txt (overwrite) or >> (append). Pipelines connect one process's stdout to the next process's stdin.
• Subshell Subshell A child shell process forked from the current shell — changes to variables, the working directory, or shell options inside a subshell do not affect the parent. Created implicitly by pipelines (each stage runs in a subshell), or explicitly with parentheses ( cmds ). Distinct from a nested script invocation (bash script.sh) and from command substitution $( ), which is also a subshell. The environment variables exported before the fork are inherited read-only.
• Sudo Substitute User Do Runs a single command as another user (default: root). Configured per user via /etc/sudoers (edit with visudo). sudo -i opens an interactive root shell; sudo -E preserves your environment; sudo -u alice cmd runs as alice.
• Symlink Symbolic Link A symlink is like a shortcut or alias — a name that points to another file. Opening the symlink opens the real file; the shortcut itself contains only the path to get there. A filesystem entry that stores a path string pointing at another file or directory, rather than data itself. Unlike a hard link, a symlink can cross filesystem boundaries and point to directories. The inode of the symlink and the inode of the target are distinct — deleting the target leaves a dangling link. Create with ln -s target link; inspect with ls -l or readlink.
• tarball tar archive (.tar/.tar.gz) A single file that bundles a directory tree, produced by tar (Tape ARchive). Commonly compressed with gzip (.tar.gz / .tgz), bzip2 (.tar.bz2), or xz (.tar.xz). The tar flags most people memorise: c create, x extract, v verbose, f filename, z gzip, j bzip2, J xz. Often distributed alongside a symlink like latest.tar.gz → v1.2.3.tar.gz.
• Termux Termux (Android terminal emulator) An Android app that ships a near-complete Linux userland (apt packages, busybox, ssh, python, node, vim, …) in a sandboxed home directory — no root required. The 🤖 badge marks commands that work out of the box inside Termux on a stock Android phone.
• TTY Teletype / Terminal Device The terminal-device interface a process is attached to. Check with tty; check whether stdout is a TTY in scripts with [ -t 1 ]. Pipes (cmd | other) and redirects (cmd > file) make stdout non-TTY, which is why ls drops colours when piped.
• Working tree Working Tree / Working Directory In git context, the working tree is the checked-out set of files on disk that you actually edit — as opposed to the index (staging area) or the committed history. git status shows the difference between the working tree, the index, and HEAD. Outside of git, working directory simply means the current directory a process is running in (print it with pwd; change it with cd).