Skip to content

Linux: kernel vs userspace vs distro

Mental model

Three layers, often collapsed into one word. The kernel is the OS. Userspace runs on top of it. A distro is a packaging decision around both.

What it looks like

"I'm running Linux" — as if it's one thing. "Ubuntu is an operating system." "Switch to Alpine."

What it really is

  • Kernel: the actual OS. Runs in privileged (ring 0) mode. Manages hardware, memory, processes, filesystems, networking. One kernel binary (vmlinuz), loaded at boot.
  • Userspace: everything else. Runs in unprivileged mode. Communicates with the kernel exclusively through syscalls. Includes: shell, coreutils, libc, daemons, your application.
  • Distro: kernel + userspace tools + package manager + opinions. A distribution is a curated bundle, not a separate OS.

Why it seems confusing

"Linux" is used to mean the kernel, the userspace, or the entire distro depending on context. Kernel versioning and distro versioning are independent. Two machines can run the same kernel with completely different userspace stacks.

What actually matters

  • The kernel is the only code running in privileged mode.
  • Userspace talks to the kernel via syscalls — nothing else.
  • Distro differences boil down to: package manager (apt/dnf/apk), init system (systemd/openrc), default configs, and release cadence.
  • Containers share the host kernel. The "distro" inside a container is just the userspace layer.
flowchart TD
    subgraph Distro["Distro (Ubuntu, Alpine, RHEL)"]
        subgraph US["Userspace (unprivileged)"]
            APP["Applications"]
            LIBS["libc, coreutils, shell"]
            DAEMONS["systemd, sshd, cron"]
        end
        PKG["Package Manager\napt / dnf / apk"]
    end

    US -->|syscalls| K["Kernel (privileged)\nprocess, memory, fs, network"]
    K --> HW["Hardware"]

    style K fill:#f80,color:#fff
    style US fill:#36f,color:#fff

Common mistakes

  • Thinking Alpine and Ubuntu have different kernels in Docker. They share the host kernel; only userspace differs.
  • Confusing kernel version with distro version. Ubuntu 22.04 ships kernel 5.15; you can run 6.x on it.
  • Believing distro choice fundamentally changes how Linux works. The syscall interface is the same across all distros.

Small examples

uname -r                  # kernel version (e.g., 6.1.0)
cat /etc/os-release       # distro info (e.g., Ubuntu 22.04)
ldd /bin/ls               # userspace: shows libc dependency
strace ls /tmp 2>&1 | head  # syscalls: userspace → kernel boundary

Same kernel, different distros: 

Host: kernel 6.1.0, Ubuntu 22.04, apt, systemd
Container A: Alpine 3.18 userspace, apk, no init
Container B: Debian 12 userspace, apt, no init
All three share kernel 6.1.0.

One-line summary

Kernel = the OS (privileged); userspace = everything else (unprivileged); distro = how they're packaged together.