Step-by-step, task-oriented guides — do this, in this order, to get this result.
Using bind mounts to expose one directory at multiple paths, and OverlayFS to layer a writable surface on read-only content — the base of containers.
Using bpftrace's scripting language to observe live kernel behavior — syscalls, function calls, scheduler events — with lower overhead than older tools.
Using systemd's resource-control unit directives to cap CPU, memory, and IO for a service, and confirming the kernel actually enforces them.
Packaging a kernel module with DKMS so it automatically rebuilds against every new kernel version, instead of breaking silently on the next kernel update.
Creating a separate network stack on the same machine to test firewall rules or networked software without touching the host's real network.
A complete walkthrough reading, changing, and persisting kernel runtime parameters — with a few of the most commonly tuned examples explained, not just listed.
Creating and running a lightweight systemd-nspawn container — useful for isolated testing environments without a full container runtime's overhead.
Creating, listing, mounting, and cleaning up APFS local snapshots directly — the same mechanism Time Machine uses, available for manual, ad-hoc use.
Checking whether an app's code signature and notarization are actually valid from the command line, not just Gatekeeper's pass/fail dialog.
Understanding the container/volume distinction that makes APFS different from older partition schemes, and using diskutil to manage volumes directly.