Glossary

The record that holds an IPv6 address, what the A record is for IPv4.

A per-file list of extra rights that sits outside the usual nine characters: a named group allowed to write into a directory it does not own, one account allowed to read one particular file.

A Git object in its own right, created by git tag -a v1.4.0 -m "Proxy timeout raised to 120s": it names one specific commit and carries an author, a date and a message.

A volume Docker creates for itself when nothing names one: a VOLUME /data line in an image's Dockerfile, or a -v /app/uploads with no source.

The server that holds the zone itself and answers from the file, not from memory.

The daemon that removes dead rows and refreshes the planner's statistics, on by default provided track_counts is on too.

The available column of free -h: the memory an application can obtain right now, including what the kernel would hand back by dropping disk cache.

The address a process passes to the kernel as it opens its listening socket, deciding who can reach it: 127.0.0.1 for this machine's processes alone, 0.0.0.0 for every IPv4 address it has.

A directory of the host made visible inside the container at another path: -v /srv/myapp/uploads:/app/uploads mounts the same filesystem, not a copy, and Docker manages none of it.

The choice a service makes about who may open a connection to it, set once in its own configuration: Environment=HOST=127.0.0.1 in the unit, not a firewall rule.

TLS validation compares the name you asked for against the names the certificate claims in its subjectAltName field — current clients ignore the common name entirely.

A Let's Encrypt certificate is valid for ninety days, so issuing one opens a recurring job rather than finishing a task.

systemd's own definition of a process that ended normally, and it is wider than "exit status 0": an exit is also clean when the process is killed by SIGHUP, SIGINT, SIGTERM or SIGPIPE — outside Type=oneshot — or when it exits with a status listed in SuccessExitStatus=.

In a Vite or React build, dist/ holds index.html, an assets/ folder and nothing else.

A complete snapshot of every tracked file at one moment, together with its parent commit, its author, its date and its message — all of it identified by a hash computed over exactly those things.

The mode in which an AppArmor profile logs accesses outside its rules — and then allows them.

A set of database connections opened in advance and held on the client side: the application opens them at start-up and hands them out to requests, rather than connecting and disconnecting for every call.

One process on your server, started by the same kernel as every other, except that the kernel shows it a restricted view: its own filesystem tree, its own process table, its own network interfaces.

Vite renames every file under assets/ after a hash of its contents — index-a3f9c2.js — while index.html keeps its own name and points at the new hashes.

A secret systemd copies into the service at every start, declared as LoadCredential=database-url:/etc/credstore/database-url.

A row version PostgreSQL has marked as no longer visible: an UPDATE writes a new version and marks the old one dead, a DELETE simply marks it dead.

A fault committed at one moment and revealed at another, when something finally triggers it: a reboot, a log rotation, a certificate expiry, the first restore anybody attempts.

A file whose last name rm removed while a process still held it open.

The wait that does not exist.

The directory a server block's root directive names — /var/www/mysite — and the base Nginx joins the request path onto to find a file.

A file whose name ends in .conf, sitting under /etc/systemd/system/nginx.service.d/, parsed after the packaged unit and merged into it: you write the one line you are changing instead of copying thirty that the next apt upgrade would take back.

Not a copy of the database's files: a description of the data, produced by the server itself from one consistent image, that rebuilds the schema and the rows on restore.

Two independent states, printed on two different lines of systemctl status nginx.

The source port the kernel picks for an outgoing connection, taken from the range in net.ipv4.ip_local_port_range — 32768 60999 on Ubuntu 24.04.

The number a command leaves behind when it finishes, readable as $?: 0 for success, anything else for a failure the program chose to report.

The line where one mounted filesystem ends and another begins.

Two of the three verdicts nmap -Pn 198.51.100.25 returns.

A command Docker runs inside the container on an interval, whose exit status sets the container's state to starting, healthy or unhealthy.

The file that decides, for each incoming connection, which method applies — by connection type, database, role and source address.

The pair of messages ping sends and waits for: an ICMP echo request, then an echo reply.

The state pg_stat_activity reports for a session that has run a BEGIN, is holding the transaction open, and is running nothing at all.

The record that holds everything about a file except its name: owner, group, mode, timestamps, and where the data blocks are.

One named section of /etc/fail2ban/jail.local — [sshd] — tying three things together: the source to read, the filter that recognises a failure in it, and the ban applied when maxretry matches land inside findtime.

The [1] bash prints when you background a command: one shell's private bookkeeping, written %1 when you want to name it.

The step where the certificate authority proves you control the name, by contacting the name.

A socket a process has asked the kernel to receive new connections on: it appears in the socket table in state LISTEN, bound to one address and port — 127.0.0.1:5432, 0.0.0.0:80.

The three figures at the end of uptime: one, five and fifteen minute averages of how many processes are running or waiting for their turn.

The interface every Linux machine carries, lo, holding the address 127.0.0.1: a packet sent there is delivered by the kernel back to the same machine without ever touching the network card.

Rewriting the addresses in a packet as it passes through a router.

The packet filter built into the kernel: the tables, chains and rules every packet is matched against on its way in, out or through.

The target that means an interface is configured and reachable, as opposed to network.target, which the manual calls "only very weakly defined": reaching it means the stack was set up, not that any address is up.

After= and Before=: the second of systemd's two dependency graphs.

A file whose owner id matches no account on this machine: ls -l has no name to print and shows the number instead, -rw-r----- 1 998 998 config.php.

A file on disk that ISPConfig writes out of its own database: the Nginx vhost under /etc/nginx/sites-available/, the zone in /etc/bind/pri.example.com, the system account, the backup job.

A pg_hba.conf method available only on local lines, the ones for the Unix socket /var/run/postgresql/.s.PGSQL.5432: the server asks the kernel which system user sits at the other end and requires that name to match the role being asked for.

A journal written to /var/log/journal, the only place that carries it across a reboot.

The number the kernel gives a process when it starts, and the only handle kill, ps and renice take without ambiguity.

One running PostgreSQL server: one data directory, one port, and the whole set of databases that share it.

The record that maps an address back to a name, and the only one you cannot publish yourself.

The two ways a TCP handshake fails, and they do not accuse the same suspects.

A complete, dated directory under releases/ — /var/www/example.com/releases/2026-08-03T14-40-58 — written while nothing is reading it, then put into service by pointing current at it: ln -sfn, one operation, with no moment where current does not exist.

Restoring a real archive into a throwaway target, then counting what came back.

How long you keep an archive before deleting it.

An HTTP server that accepts the client's connection itself and then makes its own request to the application behind it: proxy_pass http://127.0.0.1:3000 in an nginx location block.

Pointing current back at a release still on disk, then restarting the service: ln -sfn /var/www/example.com/releases/2026-08-01T09-12-03 /var/www/example.com/current, then systemctl restart example-api.

The plan node that reads every row of a table to keep the ones that match: what EXPLAIN ANALYZE prints as Seq Scan.

Nginx's unit of one site: a server { … } block naming the ports it listens on, the domain names it handles, and the root it serves files from.

Signal 1.

Signal 9, the one signal that is not a message: it is never delivered to the program at all.

Signal 15, and what kill sends when you name no signal: kill 1841 and kill -15 1841 are the same command.

systemd holds the listening port itself and starts the service only on the first connection.

Stream 2, the channel a process writes its diagnostics and failures to, separate from stream 1, standard output, which carries the result you asked for.

The counter that ends a crash loop, set in [Unit]: five starts — StartLimitBurst=5 — inside the ten seconds of StartLimitIntervalSec=10s, and systemd stops bringing the service back.

What Ctrl+Z produces: [2]+ Stopped in the shell, state T in ps.

A file whose contents are a path.

A unit that runs nothing.

On a directory, x does not mean execute: it means you may pass through it and look up a name inside.

The number of seconds a resolver may keep an answer before asking again.

The D in ps's STAT column: the process is inside a system call the kernel will not interrupt, and that call is nearly always waiting on storage.

Anything systemd manages: the unit is the object, and .service is only one of its eleven types, alongside .socket, .timer, .target, .mount, .slice, .scope, .device, .swap, .path and .automount.

The handshake that turns one HTTP request into a two-way connection: the client sends Upgrade: websocket and Connection: Upgrade, and the server answers 101 Switching Protocols.

In the Local Address column of ss -ltn, 0.0.0.0 means every IPv4 address the machine has, and [::] the same for IPv6 — usually IPv4 as well, since net.ipv6.bindv6only is 0 on Ubuntu.

A request header listing the addresses a request has passed through, appended to by each hop: proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for takes whatever arrived and adds $remote_addr, the address nginx actually saw.

The header that tells the application which scheme the client used, since the request the proxy makes to it is plain HTTP on 127.0.0.1:3000: proxy_set_header X-Forwarded-Proto $scheme sends https when the browser arrived on 443.

An entry in the process table kept for a process that has already exited, held there until its parent collects its exit status.

The bare domain itself, example.com with nothing in front — the name the zone is named after.

Three copies of the data, on two different kinds of media, one of them off-site — and the count is the least interesting part.

An nginx error page, produced by nginx, saying the application behind it gave no usable answer.