Postfix doesn't "intercept" the emails. It provides sendmail which the local system calls to send mail to root for cronjobs and other local mail delivery tasks. In-depth understanding of how Postfix processes email on the other hand is critical to one of your questions, so read on.
- Quite a number of apps e.g. cron etc will send mail to root if there are errors.
- I saw some tutorials which involve installing postfix + quite a bit of configuration to have them forwarded to gmail or some alternative. Too much configuration work.
These aren't questions, so I'm going to ignore those parts.
- I wish to know this and intercept these mails to root, then forward them to telegram/webhook or something.
Firstly, as I said, you don't "intercept" these messages. You configure Postfix or the MTA (Mail Server) on your system to process messages accordingly. In this case, you'd configure Postfix so messages to root or such get piped into custom code that it calls to process the messages into items that get put into a webhook or such that deliver to Telegram or whatever process you want to use. This is the only way to make that work.
- On a fresh installation of Ubuntu, cron can still send mail to root. How does it work?
A fresh Ubuntu installation installs basic mailer functionality into the system just for email delivery to root for cronjob tasks. Typically this is some application that provides sendmail locally. The actual internal processes for how this works varies based on which provider for the sendmail script/binary exists, but for how Postfix does it, continue on.
- How does postfix detect there are new mails to root? Checking some folder? Or?
Without going into too much depth, Postfix has multiple components in its design and architecture that handles mail in general. This is described and visible better here at the Postfix main site: https://www.postfix.org/OVERVIEW.html - If you really want to understand how the internals work I would start here on that page and read through the entire page as it really explains everything in-depth.
But I'll do my best to include bits from there.
To start with, mail delivery happens in several mechanisms before it hits the incoming queue which are all handled as 'live' components of the Postfix process. As evidenced in this 'diagram' from the Postfix pages:
Email messages from the Internet, etc. are all delivered to a "cleanup" process. Messages delivered locally typically use the sendmail call (which cron does in fact call!) and are put into the postdrop process, which in turn puts it into the maildrop process and then into a pickup process which then leads to cleanup for the message (which includes identifying rewrites, redirection of accounts based off of Postfix config, etc.). Then it goes into the incoming queue which is then processed by Postfix's delivery mechanisms internally.
That cleanup processor then alerts Postfix's queue manager that there's stuff to pick up and then the queue manager processes those items. However, this is internal components of Postfix, and happen whether mail is from the Internet or locally.
ULTIMATELY, for any mail delivery, Postfix delivers everything to the incoming queue then alerts Postfix's internal system manager that there's items to review in the queue. This happens transparently though.
Once it's in the incoming queue, it goes through more processes before being delivered:
ULTIMATELY with local mail delivery being processed via the local, virtual, or pipe calls - local is direct delivery to a mailbox in the inbox locations configured by Postfix (default drops into /var/mail/USER/INBOX I believe but don't quote me on that), and that's what happens for local mail delivery to root for cronjobs, etc.
