Linux administration

LFCS: Linux administration with evidence

The goal is to recognize what a Linux system is doing, make a focused change, and prove the result. Read the concepts first, use the playbook to plan an attempt, then complete an exercise without its walkthrough. The commands are tools for answering questions, not a list to memorize.

Domains and scope

The published LFCS domains are Operations and Deployment 25%, Networking 25%, Storage 20%, Essential Commands 20%, and Users and Groups 10%. LFCS is a two-hour practical exam with distribution-independent objectives; this course's Ubuntu VM is a practice environment, not a claim about your exam image. Official LFCS objectives and exam details ↗.

25 exercises touch all five domains. That is not complete competency coverage. The concepts below explain SELinux, guest and boot recovery, network block devices, and performance diagnosis, but these still need additional hands-on practice beyond the supplied drills. The LDAP provisioning update also needs a fresh-VM live validation pass.

Build the command-to-evidence habit

Coach Caz: Read the journal before the third restart. The machine has been leaving you notes.

Use each Practice loop below as a short rehearsal. Read its starting state, predict the result of the first command, then compare that prediction with the evidence. The outputs are illustrative: names, timestamps, addresses, and counts vary. Commands use the example's names; substitute the actual task's namespace, resource, host, and file names when transferring the pattern to a drill.

1. Recognize: say which symptom puts you on this path.
2. Inspect: run the smallest check that separates two plausible causes.
3. Act: change the field or configuration supported by that evidence.
4. Prove: repeat the failed operation and check a constraint that must still hold.
5. Repeat: hide the commands, change one input, and rebuild the sequence from memory.

Use a disposable practice environment for changes. A case that assumes an installed controller, tool, or prepared resource says so; it does not install those prerequisites for you. Linux host commands belong inside a practice Linux VM or the specified lab node. These examples teach the investigation pattern; use the CLI's assigned task and grader for recorded reps.

Operations: current state and next-start state

A running process, an active service, and an enabled unit are different facts. systemctl status shows current service state; systemctl is-enabled shows startup configuration; journalctl -u UNIT -b shows the current boot's evidence. For a failed service, inspect systemctl cat UNIT, then its executable, user, paths and permissions. Repair the cause and verify the resulting behavior.

A timer activates a service. A oneshot service may finish successfully and become inactive; that does not mean its job failed. Inspect the last result and output. After editing unit files, reload systemd's definitions. After editing application configuration, use that application's syntax check and reload behavior. Schedule work and repair a systemd service (kubefit drill lfcs-ops-01-systemd) practices both halves: a timer that must be enabled and started, and a failing unit whose real fault is in the journal. systemd timer reference ↗.

A runtime kernel setting can disappear after reboot. Keep the requested persistent value in the appropriate configuration file, apply it, and inspect the live value separately. Package tasks similarly require separate evidence for installed version, file ownership, hold state and integrity; an installed executable does not establish all four. Manage kernel settings and package state (kubefit drill lfcs-ops-02-kernel-packages) grades the sysctl.d file and the live value separately, and records package answers as files.

Container storage and service startup are separate concerns. Inspect the volume and port mapping, test the response, then inspect startup configuration. Run a persistent Podman web service (kubefit drill lfcs-ops-03-containers) requires container-web1.service; newer Podman deployments commonly use Quadlet, whose generated service behavior should be studied independently of this fixture. Podman systemd integration ↗.

Libvirt separates domains, networks, pools and volumes. A defined domain is not a running guest. Define libvirt networks, storage and a VM (kubefit drill lfcs-ops-06-libvirt) validates definitions and autostart settings, while guest boot and recovery require another environment. virsh reference ↗.

Package trust and virtual-machine lifecycle

A package manager resolves dependencies using configured repositories. Verify the repository identity and signature policy, refresh metadata, then inspect the selected version before installing or upgrading. Disabling signature checks does not repair a trust problem. After a change, verify the installed version and the actual service; a package transaction can succeed while its daemon fails. Ubuntu package management ↗

For a libvirt guest, inspect virsh dominfo, its disks and network, then distinguish definition, startup, clean shutdown, and autostart. virsh shutdown asks the guest to stop; virsh destroy forcibly stops it and is not a clean shutdown. Neither operation by itself deletes the guest disk. When startup fails, inspect domain logs, resource availability, disk access, and console output. Prove it: the guest boots, the required service responds, and clean shutdown and restart preserve its data. The local definition-only drill cannot prove that lifecycle. virsh reference ↗

Processes, signals, performance, and boot recovery

Use ps to identify the process, parent, user, and state before sending a signal. SIGTERM permits cleanup; SIGKILL does not. A process in uninterruptible I/O sleep may not disappear immediately even after SIGKILL. A busy CPU, swapping, exhausted file descriptors, and slow disk I/O need different fixes: compare top, vmstat, iostat, service logs, and limits rather than treating load average as CPU percentage. Process signals ↗ · Proc filesystem ↗

On a disposable Linux VM, diagnose boot failures from the console: failed units, dependency errors, mount configuration, and the previous boot's journal. Rescue and emergency environments differ in which services and mounts are available. Repair the cause, validate configuration, and test a normal reboot before claiming recovery. Prove it: the expected service survives startup and its original operation works. A reboot is a verification step, not a diagnosis. systemd special targets ↗

SELinux: labels, policy, and persistent corrections

On an SELinux-enabled practice VM, getenforce shows the current mode; ls -Z and ps -eZ expose file and process labels. Enforcing blocks policy violations; permissive records them without enforcing. Ordinary mode bits can permit access while SELinux still denies it.

Read AVC denial evidence before changing policy. A misplaced file often needs the correct persistent file-context rule with semanage fcontext, then restorecon to apply that mapping. chcon alone is not a durable relabeling policy. Inspect booleans before changing them; use persistent changes only when required. Prove it: the application works in enforcing mode, the intended label survives relabeling, and prohibited access remains denied. Ubuntu AppArmor drills do not exercise these SELinux commands. SELinux administration ↗

Practice loop: repair a service from its first useful error

Starting state: inside a disposable Linux VM, prepared unit practice-web.service fails to start. Its intended executable is /usr/bin/python3; the unit contains a typo in that path. Use the supplied unit, not a similarly named host service.

sudo systemctl status practice-web.service --no-pager
sudo journalctl -u practice-web.service -b -n 40 --no-pager
sudo systemctl cat practice-web.service

Look for: status=203/EXEC and the effective ExecStart. This means systemd could not execute the command; it does not prove the application started and crashed. Check the exact executable and directory access:

ls -l /usr/bin/python3
namei -l /usr/bin/python3

Act: correct only the wrong path in the practice unit, preserving its arguments and service user. After a unit-file edit, reload systemd's definition, then restart:

sudo systemctl daemon-reload
sudo systemctl restart practice-web.service
systemctl is-active practice-web.service
systemctl is-enabled practice-web.service

Prove: active answers “running now.” enabled answers a different startup question; enable the unit only if required. Test the service's actual operation too. For a oneshot unit, inspect its result and output rather than demanding that it remain active forever.

Repeat: diagnose a bad working directory next. Compare its journal message with the executable-path failure.

Coach Caz: Restarting the same typo ten times is a set of ten typos. Read the journal between sets. systemctl reference ↗

Networking: address → route → listener → policy → response

An address belongs to an interface; a route chooses a next hop and interface. ip -br addr and ip route get DESTINATION answer those questions. ss -lntup identifies listeners. Only after those checks should you diagnose firewall or application behavior. A DNS lookup failure and a TCP connection timeout occur at different stages.

Live ip changes are not persistent configuration. On this Ubuntu fixture, netplan recreates the requested addresses and routes. Leave the management interface alone and use the provided dummy interface. A dummy next hop exercises route selection but does not create a real remote network. Persist addresses and a static route (kubefit drill lfcs-net-02-addressing-routing) grades the netplan file and ip route get together. Netplan configuration reference ↗.

nftables handles packets at hooks. Incoming traffic reaches prerouting before input; locally generated traffic reaches output. This explains why an inbound redirect can work from another host while failing for localhost. Apply a complete, syntax-checked ruleset with management access allowed. Atomic loading prevents a partially constructed policy; it does not prevent a logically incorrect policy from blocking you. Filter and redirect traffic with nftables (kubefit drill lfcs-net-01-nftables) tests the loopback redirect and persistence. nftables documentation ↗.

For SSH, inspect both sshd -T and the actual listening socket. Includes, first-value precedence, Match blocks and socket activation can make a file edit differ from the effective result. Preserve an existing working session while testing a new one. In Harden SSH and configure time sources (kubefit drill lfcs-net-03-ssh-time) the root client alias is checked with ssh -G; root login remains disabled. OpenSSH server configuration ↗.

A proxy can have valid syntax while routing to the wrong backend. Test the expected path and Host header, as Configure a reverse proxy and load balancer (kubefit drill lfcs-net-04-reverse-proxy) does for nginx and HAProxy. A time service can know a source without being synchronized; inspect chronyc sources -v and chronyc tracking. Bonds and bridges solve different problems: link grouping versus Layer 2 forwarding; Build a bridge and an active-backup bond (kubefit drill lfcs-net-05-bridge-bond) grades mode, monitoring interval and membership on dummy devices.

IPv6 and NAT: inspect the actual address family and direction

IPv6 needs its own addresses, routes, listener support, and filtering. ip -6 addr, ip -6 route, and an IPv6 client test reveal failures an IPv4 success cannot. Link-local addresses have interface scope. Neighbor discovery and path-MTU feedback depend on ICMPv6; indiscriminately blocking it can break an otherwise plausible configuration. IPv6 interface ↗

DNAT changes a destination; SNAT or masquerade changes the observed source. A forwarder also needs forwarding enabled, permitted forwarding traffic, and a working return path. NAT alone grants no firewall permission. With nftables, inspect the family, hook, chain policy, connection state, and counters; an inet table can express filtering for both IP families. Prove it: test from the actual remote client and inspect the translated tuple, return traffic, and persisted configuration. nftables NAT ↗

Practice loop: locate a failed connection before editing the firewall

Starting state: a practice Linux VM should serve HTTP on port 8080 to another VM. The client can resolve the server name, but cannot connect. Substitute the actual server address for SERVER_IP; the commands below do not assume it is localhost.

On the server:

ip -br addr
ss -lntp
curl --connect-timeout 3 http://127.0.0.1:8080/

On the client:

ip route get SERVER_IP
curl -v --connect-timeout 3 http://SERVER_IP:8080/

Look for: 127.0.0.1:8080 in the listener column. A successful loopback request and a loopback-only bind explain why remote requests cannot reach that listener. A listener on 0.0.0.0:8080 changes the next question to route, filtering, and return traffic. IPv6 needs its own check.

Act: if the task requires remote access, change the application's bind address to the intended interface, validate its configuration, and reload/restart the service. Do not flush firewall rules to fix a loopback-only listener.

Prove: the listener is on the intended address, the original remote client gets the expected response, and an interface that should remain private does not become exposed. curl without a timeout can waste a timed attempt.

Repeat: keep the listener correct and introduce one wrong route in a prepared VM. Use the same order: address → route → listener → policy → response.

Coach Caz: Check which room the class is in before removing every door in the building. Socket inspection ↗

Storage: device → volume → filesystem → mount

Start with lsblk -f, findmnt, pvs, vgs and lvs. Identify the target before writing; the two disposable lab disks are listed in /etc/kubefit/disks. LVM allocates blocks; ext4 manages files inside those blocks; the mount attaches the filesystem to a path. Growing a logical volume and growing its filesystem are separate operations unless the chosen tool explicitly performs both. Create and grow LVM-backed storage (kubefit drill lfcs-storage-01-lvm) grades the LV size and the filesystem size as two facts.

Persistence belongs in mount configuration. Use the requested UUID, check it against blkid, and verify the mounted source. A correct /etc/fstab line and a working mount are separate evidence; neither alone proves a reboot was tested. Swap activation has its own size and priority checks. NFS exports control server-side access, while autofs mounts on demand when the path is accessed. Configure swap, NFS and on-demand mounts (kubefit drill lfcs-storage-02-swap-nfs-autofs) treats those three as independent services with independent proof.

Quotas are a filesystem feature with a mount-time switch. On XFS the usrquota option must be present when the filesystem is mounted, in the live mount and in the fstab options field; xfs_quota -x -c 'state -u' MOUNTPOINT then reports whether accounting and enforcement are ON, and xfs_quota -x -c 'limit -u bhard=20m USER' MOUNTPOINT sets a hard block limit that report -u lists in 1K-blocks. Recognition cues: state says OFF, or the report lacks the user, or a write past the limit succeeds. The proof is a write as that user, not as root: root is never subject to the limit, and a dd past the hard limit must fail with "Disk quota exceeded". Mount XFS with enforced user quotas (kubefit drill lfcs-storage-03-quotas-xfs) formats the second lab disk, mounts it at /srv/projects by UUID with usrquota, and checks that a 30M write by dev1 is refused while a 5M write succeeds. xfs_quota manual ↗.

df counts filesystem allocation. du walks reachable files. Deleted but open files can consume space in the first view and disappear from the second. Inspect lsof +L1 before removing more data. Also distinguish exhausted blocks from exhausted inodes with df -i. This is the first half of Recover disk space and serve HTTPS (kubefit drill lfcs-essentials-01-diskspace-certs).

For filesystem recovery, preserve the supplied image and inspect its layout. Run repair on an unmounted filesystem. A tool's no-write inspection mode is different from creating a replacement filesystem. Read the recovered file, unmount, and capture the final check's exit status immediately, as Recover an ext4 filesystem from a backup superblock (kubefit drill lfcs-ops-05-filesystem-recovery) requires. e2fsck manual ↗, LVM administration manual ↗.

Remote filesystems, network block devices, and I/O evidence

NFS shares a filesystem; iSCSI exposes a remote block device on which the client manages a filesystem. A successful discovery or login is not a successful mount. Identify the target, session, device, filesystem, and mount separately. Do not format an existing device merely because it appeared under a new name, or mount a non-cluster filesystem read-write from multiple hosts. Open-iSCSI ↗

Network-backed mounts need dependencies that let networking and device discovery complete before access. Test reconnection and reboot on a disposable VM. iostat latency/queue evidence and vmstat I/O wait help separate storage delay from CPU saturation; compare multiple samples under a known workload. Prove it: data persists through the required reconnect and the identified bottleneck improves. The current LFCS pack does not grade network-block-device provisioning. iostat ↗

Practice loop: separate volume size from filesystem size

Starting state: a disposable VM has logical volume /dev/practice/data mounted at /srv/practice. A prepared exercise has enlarged the LV but left its ext4 filesystem unchanged. The names are example inputs; discover and confirm the actual target before any write.

lsblk -f
findmnt /srv/practice
sudo lvs -o lv_path,lv_size,vg_name
df -hT /srv/practice

Look for: the intended LV is, for example, 2g, while its ext4 filesystem is still about 1g. That is not proof the LV extension failed: the allocation and filesystem are separate layers. If the mount points at a different device, fix your understanding before issuing a resize.

Act: after confirming the device, filesystem type, intended growth, and recovery requirements, grow the ext4 filesystem:

sudo resize2fs /dev/practice/data
df -hT /srv/practice

For XFS the tool and argument differ: xfs_growfs operates on the mounted filesystem path. Do not apply ext4 commands to XFS. Shrinking is a different operation with different support and risk; these growth steps are not a shrink recipe.

Prove: the filesystem reports the new usable size and existing data remains readable. A larger block device alone is insufficient. In a prepared rehearsal, write a marker before extending and read it afterward.

Repeat: point to each layer in device → PV → VG → LV → filesystem → mount using command output.

Coach Caz: A bigger locker does not automatically give you a bigger gym bag. Expand the right layer. resize2fs ↗

Essential commands: preserve meaning when collecting evidence

Read output before redirecting it into an answer file. Capture $? immediately after the command whose status matters. A later echo, pipeline or successful command can replace it. For a pipeline, know whether you are checking the last command or using pipefail to detect earlier failures.

A TLS certificate binds names to a public key. Inspect SAN, validity dates and key correspondence separately from testing an HTTPS response. curl -k bypasses trust validation, so it cannot prove that a client trusts the certificate. The second half of Recover disk space and serve HTTPS (kubefit drill lfcs-essentials-01-diskspace-certs) grades the certificate's SAN, key mode and the served certificate separately. OpenSSL x509 reference ↗.

In Git, working-tree files, staged changes, commits, branches and tags are different objects or references. An annotated tag has its own object identity; dereference it when asked for the commit hash. Discover the remote's default branch rather than assuming its name. Manage branches, merges and annotated tags (kubefit drill lfcs-essentials-02-git) asks for exactly that dereferenced hash. Git revision syntax ↗.

A report is a pipeline with one tool per job: df -P supplies one stable line per filesystem, awk skips the header and selects fields, sort -rn orders numerically. Strip the % before sorting rather than relying on how sort -n treats trailing characters, and compare the result with the raw df -P output before scheduling it. Scheduling and retention are separate files: a /etc/cron.d entry is a system crontab whose sixth field names the user, so */15 * * * * root /path >> /var/log/file.log 2>&1 runs as root every 15 minutes, and cron silently ignores a file without a trailing newline, one that is group- or world-writable, or one whose name contains a dot. /etc/logrotate.d/NAME then bounds the log; logrotate -d CONFIG parses it without rotating and prints the pattern, frequency and rotation count it understood. Recognition cues: the script prints a header or a 0% line, the log never grows, journalctl -u cron shows no job. Script, schedule and rotate a disk report (kubefit drill lfcs-essentials-03-cron-reports) grades the script's output format and order, the cron.d line, a seeded log and a weekly, rotate 4, compress logrotate entry. crontab(5) ↗, logrotate(8) ↗.

Practice loop: df and du disagree for a reason

Starting state: a practice VM's filesystem is nearly full, but visible files do not explain the usage. These are inspection commands; do not reproduce disk exhaustion on your host.

df -h /var
df -i /var
sudo du -xhd1 /var
sudo lsof +L1

Look for: df reports allocated blocks, du totals reachable files, and lsof +L1 can reveal deleted files still held open. A large (deleted) log with a live PID is a strong clue. Check that it belongs to the same filesystem you measured. Exhausted inodes point to a different problem: many small files rather than a few large ones.

Act: identify the owning process/service and use its supported log-reopen or controlled restart procedure. Deleting more filenames will not release a file the process already holds open. Avoid guessing a signal: different daemons assign different meanings to it.

Prove: the relevant open-file entry disappears, free space increases, and the service remains healthy. lsof can include unrelated deleted objects; not every line explains the shortage.

Repeat: explain why removing a filename and closing the last open handle are different events. Then diagnose an inode shortage without using the deleted-log explanation.

Coach Caz: You removed the towel's label. Someone is still holding the towel. Open-file inspection ↗

Identity: account → groups → permissions → policy

Use id and getent to inspect the identity the system resolves. Ownership and mode bits are the starting point; ACL entries and their mask determine additional effective access. A default ACL affects new children, subject to the mode requested during creation. It does not grant execute permission to every new regular file. Manage accounts, ACLs and login limits (kubefit drill lfcs-users-01-accounts-acl) grades the inherited ACL on a file created after your changes.

Login limits and environment profiles take effect in the appropriate session. Test a fresh login for the affected account; daemon limits may instead come from the systemd unit. LDAP lookup through NSS establishes identity resolution. PAM authentication is another layer and is not validated by getent alone; Resolve Linux identities through LDAP (kubefit drill lfcs-users-02-ldap) stops at NSS resolution on purpose. Linux ACL manual ↗, OpenLDAP administrator guide ↗.

Privilege delegation is a grant of command lines, not a role. A sudoers entry reads who, on which host, as whom, which commands: %ops-admins ALL=(root) NOPASSWD: /usr/bin/systemctl restart nginx, /usr/bin/journalctl allows that systemctl command line and broad journalctl arguments. That is the lab contract, not a generally safe delegation recipe: privileged pagers and file-selection options can expose more than intended. In real delegation, constrain arguments, prefer --no-pager or an audited wrapper, and test escape paths as well as command authorization. Privileged pager behavior ↗ Keep drop-ins in /etc/sudoers.d/ at mode 0440, with no dot in the filename, and check them with visudo -c. The evidence is sudo -l -U USER, which shows the effective grant after every file is merged, and sudo -l -U USER /path/cmd args, which exits 0 only if that command line is permitted; a NOPASSWD: ALL entry passes the positive test and fails the "nothing else" test. Password policy is a PAM layer: libpam-pwquality adds pam_pwquality.so to /etc/pam.d/common-password, and /etc/security/pwquality.conf holds the rules (minlen = 12 must be an uncommented line). Locking is a shadow-file fact: passwd -l prefixes the hash with !, passwd -S reports L, and a never-set or administratively disabled password needs separate inspection; a lock marker alone does not prove the account was previously usable. Delegate sudo and enforce a password policy (kubefit drill lfcs-users-03-sudo-pam) grades the drop-in's mode and grant, the minlen line, bob's locked hash, and that alice can run sudo -n journalctl without a prompt while apt-get is refused. sudoers(5) ↗, pwquality.conf(5) ↗.

Mandatory access control is another layer beyond ordinary file permissions. This Ubuntu fixture uses AppArmor; Enforce file access with AppArmor (kubefit drill lfcs-ops-04-apparmor) is supplemental practice, not SELinux coverage. LFCS explicitly names SELinux, so separately practice enforcing mode, labels, persistent file contexts, booleans and denial investigation on a disposable SELinux-enabled system. Do not treat switching enforcement off as a repair. SELinux administration guide ↗.

Environment, permissions, and effective limits

A shell variable is not inherited by child processes unless exported. Login-shell profiles, interactive-shell startup files, cron, and systemd have different environments; a command working in your terminal does not prove it works as a scheduled service. Use the target account and execution method when verifying PATH and configuration.

Directory execute permission means traversal; file execute permission means execution. Group membership changes generally need a fresh session. An ACL mask can reduce an apparently granted permission. A shell's ulimit does not describe every daemon: inspect the service's LimitNOFILE, the process's /proc/PID/limits, and any cgroup limits. Prove it: the intended user can perform the exact required operation in a fresh session while an excluded user cannot. Bash startup files ↗ · systemd execution limits ↗

Practice loop: test permissions as the person who needs them

Starting state: user trainee must read /srv/practice/report.txt in a Linux VM. A prepared ACL should grant access, but the user gets Permission denied. The file contains only dummy text.

id trainee
namei -l /srv/practice/report.txt
getfacl /srv/practice/report.txt
sudo -u trainee cat /srv/practice/report.txt

Look for: directory traversal permission on every parent and the ACL's effective mask. An entry user:trainee:r-- with #effective:--- means the mask removes the apparent grant. Running cat as root cannot test the user's access.

Act: repair the identified directory or ACL constraint while retaining intended group permissions. In this prepared file-only case, after reviewing other ACL entries, restore an appropriate mask:

sudo setfacl -m m::r-- /srv/practice/report.txt
getfacl /srv/practice/report.txt
sudo -u trainee cat /srv/practice/report.txt

The mask affects multiple ACL entries; r-- is specific to this read-only example, not a universal fix. On an SELinux-enabled VM, correct ordinary permissions may still leave an AVC denial. Inspect getenforce, ls -Z, and audit evidence before changing persistent labels; do not disable enforcement to make the test pass.

Prove: the intended user can read and cannot perform a prohibited write; unrelated users retain their intended access. Repeat: change one parent directory's traversal permission in a prepared exercise and locate that boundary with namei.

Coach Caz: Testing as root is bench-pressing with the spotter doing all the work. Use the actual identity. ACLs and masks ↗

Turn understanding into a repeatable attempt

Write the target host, required object names and proof of success before changing anything. Diagnose one layer at a time, make the smallest useful repair, then retest the original symptom. On a second attempt, hide the walkthrough and explain why each command is needed. Study links here are references; check the exam resource policy ↗ for what is permitted during your exam.

Further applied practice

Control a runaway process and service priority

Process priority and a cgroup CPU quota solve different problems. Persist policy in the service configuration, then inspect both the service and the running process.

Service resource controls ↗ Process priorities ↗

Restore ownership, ACLs and hidden files

An archive is only useful if restoration preserves metadata as well as bytes. ACLs require explicit archive and extraction support; symbolic links and hidden files are part of the dataset.

tar metadata options ↗ POSIX ACLs ↗

Repair a filesystem mount by UUID

Filesystem UUIDs identify data independently of device enumeration. Diagnose the actual filesystem before changing mount configuration; formatting destroys recovery evidence.

fstab entries ↗ Mounting filesystems ↗

Recover a logical volume from a snapshot

An LVM snapshot preserves a point-in-time view. Merging requires attention to mount state and LV activation; recovery is not complete until the origin is active with the expected data.

LVM snapshot merge ↗ LV activation ↗

Repair a split DNS resolver route

Routing domains decide which link’s DNS server handles a name. Prove both the server endpoint and the resolver route; a hosts-file entry hides the problem.

Resolver controls ↗ Resolver routing ↗