Complete procedures with a way back.

Sub-process /usr/bin/dpkg returned an error code (1) is a final summary, not the root cause. The decisive message normally appears earlier in the transaction. This guide preserves that first failure, checks package-manager ownership, locks, disk and filesystem health, audits dpkg state, then completes configuration or performs a targeted rollback without deleting lock files or forcing unrelated removals.

The error: externally-managed-environment means pip has refused to modify an Ubuntu-managed Python installation. This guide shows how to identify the interpreter you are using, preserve operating-system package ownership, and choose the correct safe route: apt for Ubuntu packages, a project virtual environment for libraries, pipx for command-line applications, or an isolated container for disposable work.

Build a private, cache-enabled Unbound resolver that performs recursion itself, validates DNSSEC, minimizes query names, and refuses clients outside an explicit network.

Recover a non-booting Ubuntu Server by choosing the least invasive systemd target, preserving console evidence, identifying the failed boot dependency, applying a reversible correction, and proving a clean normal boot.

Layer Pi-hole v6 filtering on a client-facing DNS service and Unbound validation on a loopback-only recursive port, with explicit privacy, firewall, DNSSEC, canary, and rollback controls.

Build a tagged Ubuntu Tailscale router, advertise and approve a private subnet, authorize users with least-privilege grants, test optional internet egress, and rehearse failure, withdrawal, and replacement.

Copy an Ubuntu root filesystem to a larger ext4 disk, preserve Linux metadata, rebuild UUID-based boot artifacts, perform a controlled cutover, and retain the original disk as a tested rollback.

Configure SQL Server 2025 CU7 on Ubuntu 24.04 for strict validated TLS, replace broad application rights, create an encrypted checksum backup with off-host key escrow, and prove it through real restore and CHECKDB.

Build a redundant active-backup bond, carry a tagged service VLAN over it, terminate the host address on a Linux bridge, and introduce the topology through `netplan try` with automatic rollback, console recovery, and explicit switch-side evidence.

Apply Ubuntu security updates through reviewed origins, dry-run the exact unattended policy, schedule APT timers inside a declared maintenance window, and permit reboots only at a known local time when no users are logged in.

Make local journals persistent and bounded, receive per-host journal files on a dedicated collector, and upload structured events over mutually authenticated TLS while preserving a local buffer and auditable failure behavior.

The mount error “wrong fs type, bad option, bad superblock” is a summary, not a diagnosis of corruption. Identify the exact storage layer, read the kernel reason, and separate missing helpers or invalid options from real damage before configuring UUID-based systemd mounts.

Build and operate a PostgreSQL 18.4 hot standby with bounded WAL retention, verified lag, explicit fencing, planned promotion, endpoint cutover, and safe rewind or rebuild.

Build a fail-closed PostgreSQL 18.4 WAL archive and verified base-backup chain, then restore to an exact target in isolation, validate while paused, promote, and re-establish protection.

Create a private Ubuntu 24.04 LTS Compute Engine VM with Shielded VM, IAP TCP forwarding, OS Login, service-account-targeted firewall rules and a least-privilege workload identity, then prove access and recovery.

Deploy a private Ubuntu 24.04 LTS VM with Trusted Launch, encryption at host, an explicit NSG, no public IP and a least-privilege system-assigned managed identity, then prove network, identity, patch and recovery controls.

Build an enforce-mode Ubuntu AppArmor profile, review bounded learning evidence, model execution/network boundaries, interpret denials and roll out without unconfined shortcuts.

Install Apache 2.4, replace the default page, constrain the listener, set a server identity, open only required firewall ports, and prove restart safety.

Install from Docker's signed repository, limit daemon exposure, bound logs, and document privilege boundaries.

Set a canonical identity, local domains, relay policy, DNS, TLS, aliases, queue monitoring, and end-to-end SMTP tests on Debian or Ubuntu.

Build a single-control-plane Kubernetes cluster with containerd, an explicit Pod network, a joined worker, verification, and a complete reset path.

Build Apache, MariaDB, PHP-FPM, TLS, application identity, database credentials, health checks, and backups as one verified stack.

Build nginx, MariaDB, PHP-FPM, TLS, isolated application paths, FastCGI safety rules, health checks, and backups.

Install MySQL, remove unsafe defaults, create a least-privilege application database, optionally allow restricted TLS network access, and prove backup readiness.

Install nginx, replace the default site, set a minimal server identity, validate config, restrict firewall access, and prove restart behavior.

Deploy or repair an OpenVPN 2.6 gateway with certificate checks intact. Start Cannot resolve host address with the client's pre-tunnel DNS and actual profile; investigate VERIFY ERROR, peer certificate verification failure and TLS handshake failed only at their demonstrated transport or TLS layer.

Install PostgreSQL, create a least-privilege role and database, optionally enable restricted TLS network access, validate authentication order, and prove recovery readiness.

Create a named administrator, prove key-based recovery access, patch the host, restrict SSH, enable a host firewall, and verify time and exposed services.

Create a minimal routed WireGuard VPN with protected keys, explicit peers, constrained forwarding, and peer removal.