Ed: The Standard Unix Editor Survival Guide for Sysadmins

In the vast ecosystem of modern Linux CLI text editors—where we debate the merits of Neovim’s Lua API, Emacs’ Lisp interpreter, or whether Nano is acceptable for production servers—there is one editor that predates them all. Before the screen buffers of Vim, before the graphical interfaces of VS Code, and even before the portable magic of e3, there was Ed.

Created by Ken Thompson in 1969 for the original Unix operating system, Ed is universally codified as the “Standard Text Editor.”

To a modern DevOps engineer spinning up Docker containers or configuring Kubernetes clusters, launching Ed feels like walking into a pitch-black room. There is no menu. There is no blinking cursor. There is no syntax highlighting. If you type a command the editor does not understand, it responds with a single, deeply unhelpful question mark: ?.

Yet, beneath this famously hostile exterior lies the absolute foundation of Unix text processing. Understanding Ed is the Rosetta Stone to mastering sed, awk, grep, and the underlying command mode of Vim. As a senior sysadmin, I can tell you that Ed is the ultimate survival tool when SSH connections are degraded or terminal multiplexers like Tmux fail. Here is your practical survival guide.

1. The Teletype Era: Why Ed is Built This Way

To understand why Ed is intensely minimal, you must understand the hardware constraints of 1969, long before the modern Linux filesystem hierarchy existed.

Ken Thompson did not have an LCD monitor. He interacted with the mainframe using a Teletype (TTY) machine—an electromechanical typewriter. When he typed a command, the computer literally printed the output onto a continuous roll of physical paper.

If a text editor functioned like modern Nano—constantly redrawing the entire screen via ncurses every time you moved the cursor down one line—it would have wasted miles of expensive paper and taken minutes to render.

Therefore, Ed was designed as a strict Line Editor. It only prints output when explicitly commanded, operating on specific lines targeted via numerical addresses. You must maintain a mental model of the configuration file—whether it’s an Nginx reverse proxy config or a systemd service unit—and issue commands for the computer to execute in memory.

2. The Absolute Minimalism of the Interface

When you launch Ed and point it at a bash script or a UFW firewall config, you are greeted with almost nothing.

$ ed deploy_script.sh
245

That single number (245) is Ed telling you how many bytes are in the file. It does not show the text. It simply waits.

If you attempt to use modern instincts and press the Up Arrow key to scroll, Ed will print:

?

That question mark is the entirety of Ed’s default error reporting. If you want to know why you got an error, type h (for help) and press Enter. Ed will print a slightly more descriptive message, such as unknown command.

3. The Grammar of Ed: Line Addressing

Because you cannot point to text with a mouse or an arrow key, you must tell Ed exactly which line you want to manipulate. This is called Addressing.

Every Ed command follows a basic grammatical structure: [start_address],[end_address][command]

Numerical Addresses

• 1: Refers to line 1.
• 5: Refers to line 5.
• $: Refers to the absolute last line in the file.
• . (Dot): Refers to the current line (where your invisible cursor rests).

Combining Addresses for Ranges

You combine addresses with a comma to select a range of lines, perfect for deleting entire blocks in a Fail2ban configuration.

• 1,5: Selects lines 1 through 5.
• 1,$: Selects line 1 through the end of the file.
• , (Comma alone): The shorthand alias for 1,$ (the entire document).

Relative Addressing

You can do math based on your current position.

• .+3: Three lines below the current line.
• .-2: Two lines above the current line.

4. Basic Line Editing Commands

Now that we can address lines, we can apply commands to manipulate text inside Linux configuration files.

Viewing Text (p and n)

To see what is in your file, you must tell Ed to print it to your terminal.

• p (Print): Prints the addressed lines.
• n (Number): Prints the lines and prepends their line numbers (highly recommended).

Examples:

• 1,10p (Print lines 1 through 10).
• ,n (Print the entire file with line numbers).
• .n (Print just the current line).

Adding Text (a and i)

Ed operates in two modes: Command Mode (for typing addresses) and Input Mode (for typing text).

• a (Append): Enters Input Mode and adds text after the addressed line.
• i (Insert): Enters Input Mode and adds text before the addressed line.

If you want to append a new WireGuard peer to the very end of your config, type $a and hit Enter.

Crucial Survival Rule: Exiting Input Mode Once in Input Mode, everything you type is injected into the file. Pressing Esc or Ctrl+C will not exit. To escape to Command Mode, you must type a single period . on a line by itself, and press Enter.

$a
[Peer]
PublicKey = xyz123
AllowedIPs = 10.0.0.2/32
.

Deleting and Changing Text (d and c)

• d (Delete): Deletes the addressed lines. (e.g., 10,20d deletes lines 10 through 20).
• c (Change): Deletes the addressed lines and instantly drops you into Input Mode to type the replacement text. Remember to end with the lone period ..

5. The Birth of Regular Expressions: g/re/p

Ed’s greatest legacy in computer science, and its primary utility for sysadmins parsing Linux logs or Promtail streams, is its integration of Regular Expressions.

Contextual Searching

If you don’t know the line number, search for a word by wrapping it in forward slashes.

• /error/: Searches forward for the next line containing “error”.
• ?warning?: Searches backward for the word “warning”.

The Global Command (g)

The g command allows you to execute an Ed command on every single line that matches a regex pattern.

If you want to globally search (g) the file for a regular expression (re) and print the result (p), the command is: g/re/p

Ken Thompson extracted this specific subroutine from Ed and packaged it as a standalone utility. This is the exact origin of the famous Unix grep command.

Substitution (s)

Ed invented the substitution syntax still utilized today by sed, vim, and Perl.

• s/foo/bar/: Replaces the first instance of “foo” with “bar” on the current line.
• s/foo/bar/g: Replaces every instance of “foo” with “bar” on the current line (the g here means global replacement on that line).

To replace a deprecated Docker image tag across an entire document, combine the global address , with the substitution command:

,s/ubuntu:latest/ubuntu:24.04/g

6. Saving and Quitting: Escaping the Trap

Countless junior developers have accidentally launched Ed (perhaps via a Git merge conflict) and found themselves trapped, unable to close it because Ctrl+Q or Esc fail.

1. Ensure Command Mode: Type a single period . and press Enter. If you see a ?, you were already in Command Mode.
2. w (Write): Type w and press Enter to save to the disk. Ed will print the new byte count (which is incredibly fast on a Btrfs filesystem).
3. q (Quit): Type q and press Enter to exit to your Bash shell.
4. Q (Force Quit): If you ruined the file and want to exit without saving, type a capital Q.

7. Conclusion: Why Sysadmins Should Learn Ed

No rational developer uses Ed as their primary IDE in 2026. Writing a massive Node.js application or orchestrating Ansible playbooks in Ed is pure masochism.

So why should you learn it?

1. Understanding the Lineage: Ed spawned ex. ex spawned vi. vi spawned Vim. When you type :%s/foo/bar/g in Neovim today, you are executing a 50-year-old Ed command.
2. Mastering sed: The Stream Editor (sed) is essentially Ed designed for non-interactive shell scripts. If you know Ed, you can effortlessly write complex sed pipelines to parse JSON with jq or format Restic backups.
3. The Ultimate Fallback: In catastrophic disaster recovery scenarios where the terminal is corrupted, ncurses is broken, and visual editors fail to load on a Proxmox server, Ed will always work. It is the ultimate survival tool for a Linux sysadmin.

To respect Ed is to respect the philosophical foundation of Unix: simple, composable, text-driven, and relentlessly efficient.

Official Documentation

• GNU Ed Manual: https://www.gnu.org/software/ed/manual/ed_manual.html
• GNU Sed (Stream Editor) Documentation: https://www.gnu.org/software/sed/manual/sed.html
• Grep Official Documentation: https://www.gnu.org/software/grep/manual/grep.html
• POSIX Specification for Ed: https://pubs.opengroup.org/onlinepubs/9699919799/utilities/ed.html
• Vim Command Reference (Derived from Ex/Ed): https://vimhelp.org/

Frequently Asked Questions (FAQ)

What is Ed and why is it called the “Standard Text Editor”?

Ed is the original text editor created for the Unix operating system in 1969 by Ken Thompson. It is known as the “Standard Text Editor” because it was the first fundamental text processing tool on Unix, forming the architectural basis for almost all subsequent CLI editors.

Why doesn’t Ed have a visual interface or support arrow keys?

Ed was designed during the Teletype era, where operators interacted with mainframes via physical paper printers. Constantly reprinting the document to show cursor movement would have wasted paper, so Ed was built as a “Line Editor” that only prints when explicitly commanded.

How do I exit Input Mode in Ed?

To exit Input Mode and return to Command Mode, you must type a single period . on a new line by itself and press Enter. Standard escape sequences like Esc or Ctrl+C will not work.

How do I save my changes and quit the editor?

Ensure you are in Command Mode. Type w and press Enter to write (save) your changes to the disk. Then, type q and press Enter to quit. To quit without saving, use a capital Q.

What is the relationship between Ed and the grep command?

The grep command was born directly from Ed. In Ed, the command to globally search for a regular expression and print the matching lines is g/re/p. Ken Thompson extracted this subroutine into a standalone utility, naming it grep.

Is it still practical to use Ed in 2026?

While no one uses it for heavy software development, knowing Ed is incredibly practical for sysadmins. Because it requires zero screen-drawing libraries (like ncurses), it serves as the ultimate fallback editor during catastrophic server recoveries when other terminal interfaces are broken.

How does Ed handle file addressing?

Ed requires you to target specific lines numerically. For example, 1,5 targets lines 1 through 5, $ targets the last line, and . targets the current line.

Can Ed be used in shell scripts?

Yes, though its non-interactive descendant, sed (Stream Editor), is far more appropriate and efficient for automated shell scripting and pipeline text manipulation.

Does Ed support modern features like syntax highlighting?

No. Ed operates entirely in plain text without a visual screen buffer. It possesses zero modern IDE features like syntax highlighting, code completion, or plugin ecosystems.

Where can I find Ed on a modern Linux distribution?

Ed is so fundamental that it is usually pre-installed on the base images of Debian, Ubuntu, Arch, and Alpine Linux, residing securely in /bin/ed.