I/O

Many Linux services eventually become event loops: network sockets, pipes, timerfd, eventfd, device nodes, and signal notifications all enter a select, poll, or epoll loop.

This is not because epoll is a more advanced read(). It solves a more basic problem: one thread cannot block on many read() calls at the same time.

If a program has only one socket, blocking read() is natural. Once it must handle hundreds of connections, one control pipe, several timers, and a device fd, it cannot let the thread get stuck on any single object.

Linux devices often show behavior that looks odd at first: a large file is much faster to read the second time; write() returns quickly after writing data; free shows less available memory even though the system is not really leaking memory.

The same mechanism is often behind all of these observations: Page Cache.

Page Cache is the kernel layer that caches file contents in memory. It prevents file reads and writes from touching much slower storage on every operation. On reads, the kernel can check the cache first. On writes, the kernel can update cached pages first and write them back to storage later.