Glossary
248 terms with short definitions and links to the articles.
A
- A record A DNS record carrying an IPv4 address for a name.
- absolute path A path that starts with / and locates a file from the filesystem root; its meaning does not depend on the current directory. Example: /etc/ssh/sshd_config.
- Ansible module A program Ansible runs on a machine for one kind of work — ping, copy, template, service. A module first looks at the machine and answers ok or changed.
- apparent size A file size in bytes including sparse holes; it can differ from allocated space.
- AppArmor profile A file in /etc/apparmor.d listing what a program may do: paths with r, w, x rights and capabilities. In enforce mode the kernel denies the rest and logs apparmor="DENIED"; in complain mode it only logs.
- application consistency The property of captured data forming a valid coherent state for an application.
- archive member A named object with contents or metadata stored within an archive.
- ARP A protocol resolving a neighbor IPv4 address to its link-layer address on a local network.
- attack surface Everything reachable from outside: sockets listening on external addresses and ports the firewall lets through — and the services and accounts behind them. An audit starts with sudo ss -tlnp: which sockets listen and whose they are.
- audit rule A line for auditd: which file or system call to watch and with which key to record the event — auditctl -w /etc/hosts -p wa -k hosts. Permanent rules live in /etc/audit/rules.d; ausearch -k finds events.
- authentication Verification of a claimed identity, for example using a password or key.
- authorization Deciding which actions an established identity and its privileges permit.
- authorized_keys A server-side file of public keys authorized for an account.
B
- background (background job) The mode in which a command keeps running while the shell prints the prompt at once: start it with & at the end or resume it with bg.
- backup copy A data copy for recovery after a specified event; completeness, availability and recoverability require verification.
- backup manifest A description of expected backup objects and meaningful properties for checking completeness and recovery.
- backup retention Rules for retaining and removing previous backup states.
- bare repository A git repository with no working files — history only. Commits are pushed to it from different machines; created with git init --bare, usually with a name ending in .git.
- bind address The local address to which an application binds a socket, limiting its listening scope.
- bind mount A host directory or file mounted into a container at a path: -v /srv/web:/www. The container sees the same files with the same numeric owners and modes.
- blackhole route A route deliberately discarding packets for its destination.
- block device A device providing access to addressable storage blocks; it may contain a filesystem.
- brute force (password guessing) An attack that tries logins with one password after another until one fits. It leaves hundreds of "Failed password" lines in the sshd log. Defences are key login, faillock and an address ban by fail2ban.
- build cache Layers from earlier builds that docker build reuses when an instruction and its files are unchanged (Using cache). A changed step is rebuilt along with every step below it.
- build context The directory docker build sends to the daemon: the dot in "docker build -t app .". COPY takes files only from it; .dockerignore leaves out the rest.
C
- capabilities Root's rights split by the kernel into parts: CAP_NET_BIND_SERVICE for a port below 1024, CAP_DAC_OVERRIDE to bypass file permissions. A process or a file (setcap) gets only the part it needs instead of all of root.
- certificate (X.509) A file in which a certificate authority binds a public key to site names for the period from notBefore to notAfter with its signature. The server presents it to the client at the start of TLS.
- certificate authority (CA) The party that signs certificates; its name is in the issuer field. A client trusts a certificate if the chain of signatures reaches a root CA in its trust store.
- certificate chain The site certificate and the intermediate CA certificates up to the root, each signed by the next. The server sends the site and intermediate certificates; the client has its own root.
- certificate signing request (CSR) A file with the public key and the requested names, signed by the private key. A CA issues a certificate from it; a new CSR on the old key gives a new certificate without changing the key.
- chain policy The default decision when a packet reaches the end of a base chain without a terminating verdict.
- command argument A word on the command line after the command name that the shell passes to the program. The shell splits the line into arguments on whitespace; quotes keep words with spaces in one argument.
- command option An argument that changes a program's behavior; it usually starts with - (short form, -l) or -- (long form, --all). The argument -- usually marks the end of options. Options are listed in man and --help.
- commit A snapshot of the repository files with an author, a date and a message. Each commit has its own hash (c9ab4a3), by which git show, git revert and git blame find it.
- compose service An entry under services in compose.yaml: the image, command, ports and volumes of a container. The service name is its DNS name on the project network.
- conffile A configuration file explicitly registered by a package for dpkg handling of local modifications.
- connection tracking Associating packets with known connections and exchange states.
- connection tuple The source/destination addresses and ports plus transport protocol.
- container A process started from an image in its own namespaces, with its own name, file system and status in docker ps -a. It lives as long as its main process does.
- container image The read-only template of a container: layers of files plus run settings — command, variables, port. One image can back any number of containers.
- container layer The writable layer on top of the image layers: everything the container changes in its files lands here. It is deleted together with the container by docker rm.
- container main process The process started by the image command (CMD, ENTRYPOINT) or by docker run; it has PID 1 inside the container. When it exits, the container goes to Exited with its exit code.
- content checksum A value computed from contents to detect differences; its role depends on the verification stage.
- copy-on-write (COW) A mechanism preserving earlier data when shared blocks change; used by classic LVM snapshots.
- custom format (-Fc) A compressed pg_dump archive that only pg_restore reads: you can list its contents (-l) and restore selectively. The file starts with the bytes PGDMP.
D
- daemon A process that handles requests or events without ongoing interactive control.
- default route A zero-length-prefix route used when no more specific matching route applies.
- default server The server block nginx picks when the request's Host matches no server_name on that address and port: the one marked default_server, or the first one if none is marked.
- DHCP A protocol for obtaining network configuration automatically from a server.
- directory mirror A copy of a tree current state; without separate history it does not retain earlier versions.
- distribution A maintained collection of a kernel, system programs, packages, and settings, such as Ubuntu.
- DNS A distributed system of names and records.
- DNS record TTL The permitted record cache lifetime in seconds.
- Docker A container platform: the dockerd service creates and runs containers from images, the docker command drives it. Access to the service is for root and the docker group.
- docker compose A Docker plugin that describes several containers with their network, volumes and variables in a compose.yaml file and brings them up with one docker compose up -d.
- Docker DNS Docker's DNS server at 127.0.0.11 on user-defined networks: it answers with the names of containers and compose services on that network. The default bridge network lacks it and uses the host's DNS servers.
- Dockerfile A text file with the instructions for building an image: FROM is the base, COPY and RUN add layers, CMD is the start command. docker build turns it into an image.
- document root The directory nginx builds file paths from: the request path is appended to root — root /var/www/docs and /a.html give /var/www/docs/a.html.
- drop-in (unit override file) A .conf file in /etc/systemd/system/<unit>.d/: its lines add to or replace the unit's lines while the unit file stays as it is. After an edit, run systemctl daemon-reload.
- dry run A preview of proposed changes without applying them; it does not lock data against later changes.
E
- effective UID The process user identity used in ordinary checks of its privileges.
- end-to-end check A test of the required operation from its client through the expected service response.
- environment variable A NAME=value pair in a process environment; child processes receive a copy. In Bash, export adds a variable to the environment, and env prints the environment.
- exit status A command result: zero normally means success; a nonzero value needs interpretation.
- exposure level A number from 0 to 10 printed by systemd-analyze security: how many protections the unit lacks. 9.6 UNSAFE is a root service with no limits; below 5 is MEDIUM or lower. --threshold turns it into a check with an exit code.
F
- faillock (lockout after failed logins) The PAM module pam_faillock: it counts a user's failed logins and after deny failures in a row refuses even the right password until unlock_time passes. faillock --user shows the counter, faillock --reset clears it.
- file descriptor A non-negative integer a process uses to refer to an open file, pipe, or socket. By convention, 0, 1, and 2 are the standard streams; a process's open descriptors are listed in /proc/<PID>/fd.
- file lock A kernel mark on an open file: while one process holds it, another cannot get the same lock. It is released when the file is closed or the process ends.
- file owner The user (UID) and group (GID) recorded in a file's inode; the kernel uses them to choose which permission set applies. Changed with chown and chgrp.
- file permissions The r, w, and x bits for the owner, group, and others, stored in the file's inode. On a directory, r allows listing names, w together with x allows creating and removing entries, and x allows accessing files inside. Changed with chmod.
- filesystem A way to organize files, directories, metadata and allocated space on storage.
- filesystem block A filesystem space-allocation unit whose size depends on format and configuration.
- filesystem label A short name given to a filesystem at creation (mkfs.ext4 -L) or later (e2label). It finds the partition: LABEL=data in fstab, blkid -L data.
- filesystem UUID A filesystem identifier allowing references independent of its current device name.
- filter A command that reads a file or standard input, processes the text and prints the result to standard output: grep, head, sort, uniq, wc. Filters are chained into a pipeline.
- firewall A mechanism filtering network traffic according to specified conditions and actions.
- firewall verdict A rule-processing decision such as accepting, dropping or explicitly rejecting a packet.
- foreground The mode in which the shell waits for a command to finish: the terminal belongs to it, and Ctrl+C and Ctrl+Z act on it. fg brings a job back here.
- fstab A table describing filesystems, their sources, mount points and mount options.
- fully qualified domain name A name fully identifying its place in DNS; a trailing dot denotes the root.
G
- gateway The next host to which a packet is handed along the selected route.
- GID A numeric group identifier used in process credentials and file metadata.
- git repository The .git directory next to the working files: it holds the whole history — commits, branches, settings. git status and git log work inside a directory with such a .git.
H
- handler A playbook task that runs only if another task called it with notify and that task changed something. It runs once at the end of the play — for example, to reload the nginx config.
- hard link An additional directory entry for the same inode. The file's data is freed once all names are removed and no process holds it open. Hard links work only within one filesystem.
- healthcheck A command Docker runs inside a container at intervals: exit code 0 means healthy, several failures in a row mean unhealthy. The status shows in docker ps.
- home directory A user's personal directory as set in /etc/passwd, usually /home/<name>; for root it is /root. The shell expands ~ to it, and the HOME variable holds its path.
- Host header The request header carrying the site name from the URL. The server uses it to choose among several sites on one address and port; HTTP/1.1 requires it.
- HTTP An application request-response protocol used by web services.
- HTTP header A «Name: value» line after the first line of a request or response — Host, Content-Type, Location and others; headers end with an empty line.
- HTTP method The first word of an HTTP request — what the client asks to do with the resource: GET returns it, HEAD returns only its headers, POST accepts data.
- HTTP status A three-digit code in an HTTP response describing the server handling result.
- HTTP virtual host A name-selected site sharing an address and port with other sites.
I
- ICMP An IP control-message protocol; ping uses echo requests and replies.
- idempotency A property whereby repeating an action on the state already achieved leaves the intended result the same as a single application.
- image digest The SHA-256 of the image manifest, sha256:… — a fingerprint of the content. nginx@sha256:… always means the same layers, while a tag can move to another image.
- image layer A piece of an image — an archive of file changes made by one Dockerfile instruction. Layers are read-only and shared by images with the same base; docker history lists them.
- image registry A server that stores images and serves docker pull: Docker Hub, GitLab Registry, a company registry. The registry name is the first part of a full image name.
- image tag A movable image name after the colon: nginx:alpine, app:1.1. With no tag, latest is used. After a new build the same tag points to the new image.
- initramfs A temporary root file system in memory that the boot loader hands to the kernel along with it: its programs find and mount the real root and hand over to systemd.
- inode A filesystem structure containing object metadata; its name is stored separately in a directory entry.
- installation candidate The version selected by APT using current information and policy; not necessarily already installed.
- intermediate CA A certificate authority between the root and the site — the root CA signed it, and it signs site certificates. Clients do not know it, so the server sends it along with the site certificate.
- interpreter A program that reads a script and runs its commands one by one: bash, sh, python3. On Ubuntu sh is dash, which has fewer features than bash.
- inventory The list of machines and groups Ansible works with: the machine name, the ansible_host address, the ansible_user, the connection type. Usually an inventory.ini file passed with -i.
- iowait CPU idle time while at least one process waits for the disk: wa in top and vmstat, %iowait in iostat and mpstat. It is a kind of idle time: when the CPU has other work, wa drops to zero although the disk is still busy.
- IP address A network-layer address assigned to an interface for IPv4 or IPv6 packet exchange.
J
- jail (fail2ban) A fail2ban bundle: where to read the log (backend, logpath), which filter to match, how many failures to allow (maxretry within findtime) and how long to ban the address (bantime). fail2ban-client status <jail> shows its state.
- Jinja2 template A .j2 file in which {{ name }} is replaced with a variable's value. The template module builds the final file on the machine from it and reports changed only if the result differs.
- journalctl Command for reading the systemd journal with service, time, and other filters.
K
- kernel The core of the operating system: it manages processes, memory, devices, and filesystems; programs request its services through system calls. uname -r prints its version.
- kernel ring buffer A fixed-size piece of memory where the kernel writes its messages; when it is full, new lines push out old ones. dmesg reads it (root only on Ubuntu), journalctl -k keeps a copy with exact times.
- key fingerprint A compact key representation for comparison with a trusted value.
- known_hosts A client list of trusted SSH server keys and host identities.
L
- least privilege The rule that a program or a user gets only the rights it cannot do its job without. A service gets its own user, writes only to its own directory and has no capabilities it does not need.
- linter A program that checks source code without running it and points out likely bugs and risky constructs; for shell scripts, shellcheck.
- listening socket A server socket waiting for new connections, distinct from accepted connection sockets.
- load average The average number of tasks that are running or waiting for a CPU (state R) and waiting for the kernel in uninterruptible sleep (state D), over 1, 5 and 15 minutes. Compare it with the CPU count from nproc.
- location block A block inside server with rules for part of the paths: location /api/ catches requests whose path starts with /api/. Of the matching prefixes the longest wins.
- logical dump A copy of a database as commands and data (CREATE, COPY), taken by pg_dump; it restores into a database of the same or a newer version. Roles are not included.
- logical volume (LV) An LVM block device receiving space from a volume group.
- login shell The program in the last field of /etc/passwd that the system starts when a user logs in: usually /bin/bash, /usr/sbin/nologin for services. usermod -s changes it.
- loop device A Linux block device using a regular file as its backing storage.
- loopback A local interface for communication within a network environment; typical addresses are 127.0.0.1 and ::1.
- LVM A logical volume management system allocating physical volume capacity through volume groups.
- LVM snapshot A representation of a volume at a point in time; a classic snapshot depends on its origin and COW reserve.
M
- merge conflict Both sides changed the same lines, and git cannot merge them by itself: it writes both versions into the file between the <<<<<<<, ======= and >>>>>>> markers and waits for an edit and git add.
- mount point A directory at which a mounted filesystem becomes accessible in the path tree.
N
- Netfilter hook A network processing stage to which a filtering base chain can attach.
- network interface A kernel object for sending and receiving packets, representing a physical or virtual device.
- network namespace An isolated Linux networking environment with its own interfaces, routes and various network settings.
- network port A numeric transport endpoint identifier within a host; TCP and UDP have separate port spaces.
- network prefix The leading address portion identifying a network; /N specifies its length in bits.
- network renderer The networking implementation for which Netplan generates configuration.
- nftables chain An ordered sequence of rules; a base chain attaches to a packet-processing hook.
- nftables table A named group of chains and other objects within an nftables family.
- nginx A web server and reverse proxy whose configuration should be checked before applying changes.
- nice value A number from -20 to 19 the scheduler uses to share the CPU: the higher it is, the smaller the process's share. Start with nice -n 10 command, change a running process with renice; the owner can lower the priority, only root can raise it.
- NoNewPrivileges The no_new_privs process flag: neither the process nor its children gain rights through setuid programs (sudo, su) or file capabilities. In a unit it is NoNewPrivileges=yes; sudo inside answers "no new privileges".
- NSS The mechanism for selecting sources that resolve users, groups, hosts, and other records.
- NTP The protocol for checking a clock against a time server over the network, UDP port 123. The client is systemd-timesyncd or chrony; a server for your machines is chrony with allow.
O
- oneshot service A systemd service with Type=oneshot: it runs a command and finishes; systemctl start waits for the end and reports success or failure.
- OOM killer A kernel mechanism: when memory runs out system-wide or in a cgroup with a limit, it picks the process with the highest oom_score and kills it with SIGKILL. Such a process exits with code 137; a container shows OOMKilled: true.
- OOM score (oom_score) The number the OOM killer uses to pick a victim: it grows with the process's memory, and the oom_score_adj adjustment from -1000 to 1000 shifts it. Shown in /proc/<pid>/oom_score and choom -p.
- open unlinked file A file whose last name was removed while a process still holds it open and retains access to its data.
P
- package A unit of files and metadata tracked by a package manager.
- package architecture The target package architecture; all means architecture-independent content, not support for every OS.
- package dependency A package requirement on another package, sometimes with a version constraint.
- package index Metadata about known packages and versions; a local copy can become outdated.
- package repository A source of packages and their indexes, accessible over a network or locally.
- packet counter The number of packets reaching a counter action, normally accompanied by a byte counter.
- page cache Copies of files that were read and written, kept in memory so that reading again skips the disk. In free it is buff/cache; the kernel frees it when programs need memory, so the reserve is available.
- PAM (Pluggable Authentication Modules) The library that login, su, sudo, sshd and passwd hand user checks to: a stack of modules from /etc/pam.d decides whether to let the user in, which new password to accept and what to do at login.
- partition A contiguous region of a disk recorded in the partition table. The kernel shows it as a device of its own (/dev/vdb1, /dev/loop0p1) that holds a filesystem.
- partition table A record at the start of a disk of where each partition begins and ends. The formats are GPT (modern systems) and MBR (msdos); fdisk or parted creates it, and blkid -p shows its type (PTTYPE).
- PATH An environment variable holding a colon-separated list of directories where the shell looks up a command given without a /. command -v or which shows which file will run.
- peer authentication Login to PostgreSQL over the local socket: the server asks the kernel which Linux user connected and admits them only to the role with the same name. Hence sudo -u postgres psql.
- pg_hba.conf PostgreSQL's access rule file: connection type, database, role, address and authentication method. The first matching line wins; no match — «no pg_hba.conf entry».
- physical extent A unit of PV space allocation within an LVM volume group.
- physical volume (PV) A device prepared for membership in an LVM volume group.
- PID A numeric process identifier within a PID namespace. It may be reused after termination.
- pipefail A bash mode (set -o pipefail): a pipeline returns the code of a failed stage; without it, the code of the last stage, even if an earlier one failed.
- pipeline A chain of commands joined by |: each command's standard output feeds the next command's standard input, and the commands run concurrently. The pipeline's exit status is that of the last command unless pipefail is set.
- playbook A YAML file with Ansible plays: on which machines (hosts) to run which tasks, in order. Run with the ansible-playbook command.
- port publishing Forwarding a host port into a container: -p 8080:80 sends requests for host port 8080 to container port 80. Without it the service is reachable only from the Docker network.
- positional parameter A script argument by number: $1, $2 and on; $# is the number of arguments, "$@" is all of them, each as a separate word.
- PostgreSQL role An account inside PostgreSQL; a role with LOGIN is a database user. It is separate from Linux users except for peer authentication.
- PPID The parent process ID as observed in the current PID namespace.
- primary group The group designated as primary for an account; a process has its own effective group identity.
- private key The secret half of a key pair; it stays on the server and proves the certificate belongs to it. Certificate and key must match, or nginx rejects the configuration (key values mismatch).
- process A running instance of a program with its own PID, address space, open files, and credentials. New processes are created by existing ones via fork() or clone().
- pwquality (password quality check) The PAM module pam_pwquality: on a password change it checks the new one against the rules in /etc/security/pwquality.conf (length minlen, character classes minclass, dictionary) and answers "BAD PASSWORD". pwscore checks a password in advance.
R
- Readline A command-line editing library providing history navigation and key bindings in Bash.
- redirect (301) A 3xx response with a Location header — the server sends the client to another address; 301 means permanently, 302 temporarily. curl -L follows them.
- redirection A shell instruction that connects a command's stream to a file or another descriptor: > overwrites a file, >> appends, < reads from a file, and 2>&1 sends stderr wherever stdout goes.
- regular expression A pattern that many strings match: characters, classes like [0-9], repeats * and +, anchors ^ and $. grep searches lines by it, sed replaces text, awk selects lines.
- relative path A path without a leading / that is resolved from the process's current directory. The components . and .. refer to the directory itself and its parent.
- resolver A mechanism obtaining name data from configured sources.
- restart policy The rule Docker uses to start a stopped container by itself: no, on-failure, always or unless-stopped. Set with --restart at creation or with docker update.
- restoration staging directory A separate location to extract and verify recovered data before replacing the working version.
- restore test A practical check that a backup produces the required recovered state.
- return path The response path from recipient back to the original sender.
- reverse proxy A server that accepts client requests, forwards them to an application behind it and returns the application's response. nginx with proxy_pass works this way.
- root (superuser) The account with UID 0: the kernel skips most permission checks for it. Commands are usually run as root through sudo.
- route A path-selection entry for a destination network or host, such as an interface and next gateway.
- route metric A numeric preference between otherwise comparable routes; a lower value is generally preferred.
- RSS (resident set size) How much of a process's memory is in RAM right now, in KiB: the RSS column in ps, RES in top, VmRSS in /proc/<pid>/status. Shared libraries count in the RSS of every process.
S
- SAN (subject alternative name) The certificate extension listing the names it is valid for; the client compares the name from the URL against it. A name missing from SAN gives «no alternative certificate subject name matches».
- segfault (segmentation fault) The program touched memory that is not its own; the kernel ends it with SIGSEGV (11), the exit code is 139, and the kernel log gets a line "name[PID]: segfault at address … in library".
- self-signed certificate A certificate signed by its own key: subject and issuer are the same. Every root CA is like this — it is trusted because it is in the trust store; curl rejects one it does not know (self-signed certificate).
- sequence A PostgreSQL counter that new ids of a serial column come from; a dump stores its value via setval. A counter left behind after a restore gives a duplicate key error on the next insert.
- service A program that runs in the background and performs a function for the system or network. Under systemd, a service is described by a .service unit and managed with systemctl.
- service hardening (systemd) Unit settings that take extra rights away from a service: User= instead of root, ProtectSystem= (a read-only system), NoNewPrivileges=, CapabilityBoundingSet=. systemd-analyze security rates how exposed the service is.
- set -e (errexit) A bash mode: the script exits as soon as a command returns non-zero. Tests in if and commands on the left of && and || do not trigger it.
- setgid bit (SGID) A special permission bit. On a directory, new files and subdirectories get the directory's group instead of the creator's primary group; on a program, it runs with the file's group. ls -l shows s in place of the group's x.
- setuid bit (SUID) A special bit on an executable: the program runs with the file owner's rights, not those of the user who started it. ls -l shows s in place of the owner's x, as on /usr/bin/passwd.
- shared library A .so file with code that many programs use at once (libc.so.6, libssl.so.3): the kernel maps it into the memory of every process that uses it. A new version of the library reaches a process only after the process restarts.
- shebang The first line of a script, such as #!/bin/bash: the kernel uses it to pick the interpreter when the file runs as a program. With "bash file" the interpreter is already chosen and the line is a comment.
- shell A command interpreter: it reads a command line, expands variables and patterns, and starts processes. Bash is the default interactive shell on many distributions.
- shell job A command or pipeline started by a shell and tracked in that shell's local job table.
- signal A notification of an event or request to a process; its effect depends on the signal and program.
- snapshot merge Returning an origin to a snapshot state, discarding subsequent changes within the rollback scope.
- snapshot origin The volume whose state a snapshot captures; a classic snapshot uses its unchanged blocks.
- SNI The site name the client sends at the very start of TLS, before any HTTP. A server with several sites on one address uses it to choose which certificate to present.
- socket An object through which a program interacts with the network stack or another communication mechanism.
- sparse file A file with logical regions lacking allocated data blocks; reading those holes returns zeroes.
- SSH host key An SSH server identity key pair, distinct from user login keys.
- SSH user key pair A client private key and corresponding public key for account authentication.
- standard error The diagnostic stream on file descriptor 2, separate from standard output.
- standard input The input stream on file descriptor 0; its source may be a terminal, file, or pipe.
- standard output The main output stream on file descriptor 1; it can be redirected.
- state D (uninterruptible sleep) The process waits for the kernel to finish an operation for it: disk I/O, a filesystem write, a reply from an NFS server. Signals, even SIGKILL, take effect only after the wait ends. It counts towards load average.
- sticky bit A special bit on a directory: only the file's owner, the directory's owner or root can delete or rename a file in it. ls -l shows t in place of the others' x, as on /tmp.
- subnet Addresses sharing one network number, such as 192.0.2.0/24: neighbours in it exchange packets directly; another subnet needs a route.
- supplementary group Additional membership considered for access; an existing process retains its own group list.
- swap A disk partition or file where the kernel moves rarely needed program pages to free memory. It helps when memory is short, but the disk is slower than memory: busy swap means slowness.
- symbolic link A separate file that stores a path to another file. If the target is removed or moved, the link becomes dangling. Created with ln -s.
- system call A program's request to the kernel: open a file (openat), read, write, connect, exit (exit_group). strace prints every call with its result; a failure is -1 plus the error name.
- systemctl Command for managing systemd units and inspecting their state.
- systemd System and service manager that manages units and their dependencies.
- systemd timer A .timer unit that starts a service, usually the one with the same name, on a schedule or after a delay.
T
- target A systemd unit with no work of its own — a name for a group of units and a system state that systemd brings the boot up to: multi-user.target on a server, rescue.target for repairs.
- TCP A transport protocol providing connection establishment and an ordered byte stream.
- terminal An input and output interface for text programs. A shell interprets the command language.
- time zone The rule for showing time: the offset from UTC and clock changes. The machine's zone is the /etc/localtime link to a file in /usr/share/zoneinfo, changed with timedatectl set-timezone.
- timeout An elapsed waiting limit, which does not by itself identify the reason for a delay.
- TLS The protocol for encrypted connections over TCP: the client checks the server certificate, then both sides encrypt the exchange. HTTPS is HTTP inside TLS.
- trust store The root CA certificates a client trusts. On Ubuntu it is /etc/ssl/certs, and update-ca-certificates adds your own CA; for a single request curl --cacert names the CA.
U
- UDP A datagram transport protocol without TCP-style connection establishment.
- UID A numeric user identifier; names are mapped to identifiers through name services.
- umask A process's mask for new files: its bits are removed from 666 for a file and 777 for a directory. With 022 a file gets 644 and a directory 755; with 002 the group keeps write access.
- unattended-upgrades The Ubuntu service that installs updates from allowed origins once a day on an apt timer — by default only security updates. It does not restart running services itself; needrestart does.
- unit An object managed by systemd, such as a service, socket, timer, or mount.
- unit ordering The After= and Before= lines of a unit: who waits for whom when both start. They do not start a unit themselves — Wants= or Requires= do that, so they are written as a pair.
- unix socket A file that is a meeting point for processes on one machine (s as the first letter in ls -l): the server listens on it, the client connects by path. Connecting needs write permission on the file.
- upstream (backend) The application behind a reverse proxy that nginx forwards requests to — an address and port or a unix socket from proxy_pass. nginx error.log names it in the upstream field.
- user-defined network A network made with docker network create or by compose. Containers on it find each other by name through Docker DNS (127.0.0.11); the default bridge network has no names.
- UTC Coordinated Universal Time — with no time zones or clock changes. The kernel keeps time in UTC (seconds since 1970); the time zone affects only how it is shown.
V
- veth pair Two virtual interfaces joined like a cable: what goes into one end comes out of the other. They connect network namespaces.
- volume A directory managed by Docker (/var/lib/docker/volumes/<name>/_data) mounted into a container. Removing the container leaves it alone: the data lives until the volume itself is removed.
- volume group (VG) A pool of physical volume space from which LVM allocates logical volumes.
W
- word splitting A step of command parsing: the shell splits the value of an unquoted $name on spaces into separate arguments. In double quotes "$name" stays one argument.
- working directory The directory from which a process resolves relative paths. In a shell, pwd prints it and cd changes it; a child process inherits it from its parent.
Y
- YAML A text format for structured data in which indentation establishes nesting.
Z
- zombie process An exited process whose status has not yet been collected by its parent; it no longer runs application code.
#
- /dev/null A special device file: it accepts any output and keeps nothing, and reading from it gives end of file at once. 2> /dev/null throws error messages away.
- /proc (procfs) A filesystem with no disk behind it: the kernel shows processes there (/proc/<PID> — state, open files, limits) and its own state — memory, load, parameters in /proc/sys.
- ~/.pgpass file PostgreSQL passwords for the client: lines host:port:database:role:password, mode 0600 — otherwise the file is skipped with a warning. The PGPASSWORD variable takes precedence.
Nothing found. Try a shorter query.