Ops Lexicon

The physical parts of a computer: processor (CPU), memory (RAM), storage drives, network cards, GPUs and power supplies. In ops, hardware also means the servers and racks in a data center. In the cloud you rent slices of hardware instead of buying it, but every abstraction still runs on real machines that can and do fail.

“It wasn't our code; the host had a hardware failure and took the VM with it.”

Core

Instructions (programs) that tell hardware what to do: operating systems, applications, scripts and libraries. Roughly split into system software (the OS, drivers) and application software (browsers, web servers, your service). DevOps is largely about building, shipping and running software reliably and repeatably.

“It's a software problem, not hardware: the new release broke the parser.”

Core

A computer, physical or virtual, whose job is to serve requests from other computers over a network: web pages, APIs, files, databases. The word also means the program listening for requests (nginx is a web server). Servers usually run headless and 24/7 in data centers or the cloud.

“Can you SSH into the staging server and check the logs?”

Core

The basic pattern of networked computing: a client (browser, mobile app, CLI) sends a request, and a server processes it and returns a response. Almost every web system, API and database works this way. The alternative is peer-to-peer, where every node acts as both client and server.

“The bug is client-side; the server returns the right JSON but the app renders it wrong.”

Core

Central Processing Unit

The chip that executes program instructions. Described by its number of cores, clock speed (GHz) and architecture. CPU usage (%) is one of the first metrics you check when a service is slow. In containers, CPU is allocated in cores or millicores (1000m = 1 core).

“CPU has been pegged at 100% on every pod since the deploy.”

Core

SMT, logical CPU

A core is one physical processing unit inside a CPU; modern CPUs have many. Hyper-threading (simultaneous multithreading) lets one physical core appear as two logical CPUs that share its resources, so 8 vCPUs may be only 4 physical cores. More cores help parallel workloads, not single-threaded code.

“The instance has 16 vCPUs, but our Python worker is single-threaded and uses only one.”

Core

memory, Random Access Memory

Fast working memory where running programs keep their data. It is volatile: everything in it vanishes on restart or power loss. Running out of RAM causes swapping (very slow) or the process being killed (OOM). Memory is usually the tightest resource for containers and ML models.

“The JVM heap is set to 4 GB, but the container only has 3 GB of RAM.”

Core

disk, HDD, SSD, NVMe

Persistent memory that keeps data after power-off. HDDs are spinning magnetic disks (cheap, slow); SSDs use flash (fast); NVMe SSDs connect over PCIe and are the fastest. Key numbers are capacity, IOPS (operations per second), throughput (MB/s) and latency. A full disk is one of the most common causes of outages.

“Logs filled the disk to 100% and the database stopped accepting writes.”

Core

Graphics Processing Unit

A processor with thousands of small cores built to do the same math on lots of data in parallel. Designed for graphics, now the workhorse of machine-learning training and inference. GPU memory (VRAM) limits how big a model you can load. GPUs are expensive and scarce, so scheduling and utilization are major MLOps and FinOps topics.

“A 70B model at FP16 needs about 140 GB of VRAM, so it won't fit on one GPU.”

CoreMLOps

OS

The software layer that manages hardware and gives programs a common interface: process scheduling, memory, files, networking, users and permissions. Linux dominates servers and the cloud; Windows and macOS dominate desktops. Containers share the host's OS kernel instead of shipping their own.

“Which OS is the build agent on, Ubuntu or Windows?”

Core

A running instance of a program, with its own memory space, process ID (PID), open files and at least one thread. The OS isolates processes from each other. Starting, stopping, watching and restarting processes is core operations work.

“The process exited with code 137, so something killed it.”

Core

The smallest unit of execution the OS schedules. One process can run many threads that share its memory, which makes communication fast but opens the door to race conditions and deadlocks. Thread pools reuse a fixed set of threads to handle many tasks.

“All 200 request threads are blocked waiting on the database connection pool.”

Core

Concurrency is structuring a program to handle many tasks at once by interleaving them, for example 10,000 connections on one thread with async I/O. Parallelism is literally running several tasks at the same instant on several cores. You can have concurrency without parallelism. Rob Pike: concurrency is dealing with lots of things at once; parallelism is doing lots of things at once.

“Node gives you concurrency on one core; for parallelism, run several workers.”

Core

A CPU-bound task is limited by computation (video encoding, model training), so faster or more cores help. An I/O-bound task spends most of its time waiting on disk, network or a database, so async I/O, caching or batching help instead. Knowing which one you have decides how you scale it.

“This job is I/O-bound; it waits on S3 most of the time, so more CPUs won't help.”

Core

Two regions of a program's memory. The stack holds function calls and local variables; it is fast, freed automatically and limited in size (recursing too deep causes a stack overflow). The heap holds longer-lived objects; it is managed by hand (C, C++) or by a garbage collector (Java, Go, Python).

“Infinite recursion blew the stack, hence the StackOverflowError.”

Core

A program keeps allocating memory and never releases it, so usage grows until the process slows down or gets killed. In garbage-collected languages it usually means objects are still referenced: an unbounded cache, a growing global list, listeners never removed. The classic symptom is a memory graph that climbs steadily and drops only on restart.

“Memory climbs in a straight line until the pod is OOMKilled every six hours; smells like a leak.”

Core

OOM, OOM killer

The state where a system or container has no memory left. On Linux, the kernel's OOM killer picks a process and kills it with SIGKILL, which in containers shows up as exit code 137 or OOMKilled. Fixes: raise the memory limit, fix a leak, or use less memory (smaller batches, streaming).

“The worker was OOMKilled during the big export; raise its limit or stream the rows.”

CoreSRE

paging

Virtual memory gives each process its own address space, mapped onto physical RAM in fixed-size pages. When RAM runs short, the OS can move idle pages to disk (swap). Swap prevents crashes but is thousands of times slower than RAM; heavy swapping (thrashing) makes a server crawl. Kubernetes nodes have traditionally run with swap off.

“Latency spiked because the box started swapping.”

Core

L1, L2, L3 cache

Small, extremely fast memory on the CPU itself, in levels: L1 is fastest and smallest, L3 is larger and shared between cores. Code that reads memory sequentially and keeps hot data small runs much faster because it hits cache instead of RAM. Matters for performance tuning and latency-critical systems.

“Switching to a flat array improved cache locality and halved the runtime.”

Core

KB vs KiB

A bit is a 0 or 1; a byte is 8 bits. Decimal units (KB, MB, GB, powers of 1000) differ from binary units (KiB, MiB, GiB, powers of 1024); 1 GiB is about 7% more than 1 GB. Network speeds are quoted in bits per second, file sizes in bytes, so a 100 Mbps link moves about 12.5 MB/s. Kubernetes memory uses Mi and Gi.

“Set the limit to 512Mi, not 512M; they aren't the same number.”

Core

hex, octal

Binary is base 2 (0s and 1s), how computers store everything. Hexadecimal is base 16 (0–9, A–F), a compact way to write binary where one hex digit is 4 bits. Hex shows up in memory addresses, color codes, commit hashes and MAC addresses; octal (base 8) shows up in file permissions like 755.

“The short Git SHA is just the first 7 hex characters of the commit hash.”

Core

UTF-8, Unicode, ASCII

Rules for turning text into bytes. ASCII covers 128 English characters; Unicode assigns a number to every character in every script; UTF-8 encodes Unicode in 1 to 4 bytes and is the web's default. Encoding mismatches produce garbled text (mojibake) and break names, emoji and non-Latin scripts such as Devanagari.

“The CSV was saved as Latin-1, so every accented name came out garbled.”

Core

Unix timestamp

Time represented as the number of seconds since 1970-01-01 00:00:00 UTC. Used in logs, databases, tokens (the JWT exp claim) and APIs because it is timezone-free and easy to compare. Some systems use milliseconds instead; mixing the two gives dates in 1970 or the far future. Signed 32-bit timestamps overflow in 2038.

“The exp claim is a Unix timestamp, and it expired five minutes ago.”

Core

UTC (Coordinated Universal Time) is the global reference clock with no daylight saving. The rule: store and log everything in UTC and convert to local time (IST is UTC+05:30) only for display. Time-zone and daylight-saving bugs break cron jobs, reports and billing.

“The cron runs at 02:00 UTC, which is 07:30 in India.”

Core

time sync

Clock skew is when machines disagree on the current time. NTP (Network Time Protocol) keeps clocks in sync. Skew breaks TLS certificate checks, token expiry, log ordering and any distributed logic that trusts timestamps. Never assume two servers' clocks match exactly.

“Auth fails on that node only; its clock is four minutes ahead because NTP isn't running.”

CoreSRE

VM

A software-emulated computer with its own virtual CPU, memory, disk and full operating system, running on a physical host through a hypervisor. Many isolated VMs share one physical server. Cloud instances such as EC2 and Compute Engine are VMs. Heavier than containers but with stronger isolation.

“Spin up a VM for the legacy app; it needs a full Windows install.”

CoreCloud

VMM

Software that creates and runs virtual machines and divides the physical hardware between them. Type 1 (bare-metal) hypervisors run directly on hardware: KVM, Xen, VMware ESXi, Hyper-V. Type 2 run on top of a desktop OS: VirtualBox. AWS Nitro and Firecracker (behind Lambda) are modern lightweight hypervisors.

“Firecracker microVMs give Lambda VM-grade isolation with near-container startup times.”

CoreCloud

A physical server used directly, with no virtualization layer between your software and the hardware. Chosen for maximum performance, direct hardware access (GPUs, fast networking), licensing, or cost at very large scale. Bare-metal Kubernetes means running clusters on your own physical machines.

“We run the database on bare metal; the VM overhead was hurting IOPS.”

CoreCloud

x86-64, ARM64, aarch64

The instruction set a CPU understands. x86-64 (amd64: Intel, AMD) has long dominated servers; ARM64 (aarch64: AWS Graviton, Apple Silicon, Ampere) gives better price-performance and is growing fast. Binaries and container images are built per architecture; running the wrong one fails with exec format error. Multi-arch images solve this.

“It works on my M-series Mac but crashes in prod: the image was built for arm64 only.”

CoreCloud

Firmware is low-level software built into hardware. BIOS, and its modern replacement UEFI, initializes the hardware and starts the boot process when a machine powers on. Firmware updates matter for security (Secure Boot) and for managing fleets of bare-metal servers.

“The new servers won't PXE boot until we update the UEFI firmware.”

Core

The CPU pausing one thread or process and resuming another, saving and restoring their state. Each switch costs time and cold caches, so too many threads or heavy locking can make a system spend more time switching than working. The same word describes people jumping between tasks, which costs focus.

“Thousands of threads on four cores; we're burning CPU on context switches.”

Core

ext4, XFS, NTFS

The structure an OS uses to organize files on a disk: directories, names, permissions and where data blocks live. Linux commonly uses ext4 or XFS; Windows uses NTFS; ZFS and Btrfs add snapshots and checksums. You format a new disk with a file system, then mount it.

“The new volume is /dev/nvme1n1; format it as ext4 and mount it at /data.”

Core

DC, colo

A building full of servers, storage and networking gear with redundant power, cooling and connectivity. Companies run their own, rent space in a colocation (colo) facility, or use the cloud providers' enormous ones. A cloud availability zone is one or more data centers.

“Our on-prem data center is in Navi Mumbai; disaster recovery runs in the cloud.”

CoreCloud

Running without a graphical interface, operated over the network or the command line. Servers are headless; headless Chrome runs a browser with no window for tests and scraping; a headless CMS serves content with no built-in front end.

“Run the E2E tests with headless Chrome in CI.”

Core

big-endian, little-endian

The byte order of multi-byte numbers in memory. Little-endian stores the least significant byte first (x86, ARM by default); big-endian stores the most significant first, which is also network byte order in TCP/IP. It only matters when you parse binary formats or protocols by hand, but the bugs it causes are baffling.

“The ID decodes as a huge number because we read it big-endian; the file is little-endian.”

Core

Non-Uniform Memory Access

On multi-socket servers, each CPU socket has its own local memory, and reaching another socket's memory is slower. NUMA-aware placement (keeping a process, its memory and its GPU or NIC on the same node) matters for databases, high-speed networking and GPU training boxes. Kubernetes handles it with the Topology Manager.

“Pin the inference process to the NUMA node closest to its GPU.”

CoreMLOps

A free, open-source, Unix-like operating system kernel created by Linus Torvalds in 1991; in everyday speech, a full OS built around that kernel. It runs the vast majority of servers, cloud instances, containers, Android phones and supercomputers, which makes it the most important single skill in DevOps.

“Almost all our infrastructure is Linux, so get comfortable in the terminal.”

Core

distro

A complete operating system built on the Linux kernel plus tools, a package manager and defaults. Main families: Debian/Ubuntu (apt), Red Hat, RHEL, Fedora, Rocky and Amazon Linux (dnf/yum), and Alpine (apk; tiny, popular for containers). Commands and file locations differ slightly between families.

“Which distro is the base image, Debian or Alpine?”

Core

The core of an operating system, running with full hardware privileges: it schedules processes, manages memory, drives devices and enforces permissions. Programs ask it for things through system calls. Every container on a host shares that host's kernel, which is why a kernel bug can affect all of them.

“Containers aren't VMs; they all share the host kernel.”

Core

Kernel space is the privileged zone where the kernel runs with full hardware access; user space is where ordinary programs run with restricted rights. Crossing the boundary through system calls has a cost. eBPF lets safe, verified programs run inside the kernel to observe or filter events without writing kernel modules.

“The overhead is in kernel space; look at the syscall count, not your code.”

Core

syscall

The interface a program uses to ask the kernel to do something privileged: open a file, read from a socket, start a process (fork/exec), allocate memory. strace shows the syscalls a process makes, which is how you answer why something hangs. Seccomp profiles limit which syscalls a container may use.

“strace shows it's stuck in a connect() call to the database.”

Core

Bash, Zsh, sh

The program that reads your commands and runs them, the text interface to the OS. Bash is the default on most Linux servers, Zsh on Macs, and sh (the minimal POSIX shell) is often the only one inside tiny containers. Shells also run scripts that automate tasks.

“The script uses Bash arrays, so it fails under Alpine's sh.”

Core

console, terminal emulator

The window or app that gives you a text interface where a shell runs (GNOME Terminal, iTerm2, Windows Terminal). Console originally meant the physical screen attached to a machine; cloud providers offer a serial console for rescuing VMs that won't boot.

“Open a terminal and run kubectl get pods.”

Core

Command-Line Interface

Using a program by typing commands with arguments and flags instead of clicking a GUI: git, docker, kubectl, aws, gcloud, terraform. CLIs are scriptable and repeatable, which makes them the backbone of automation. Flags look like -v or --verbose.

“Don't click through the console; use the CLI so we can put it in the pipeline.”

Core

root is the all-powerful administrator account on Linux (user ID 0); it can do anything, including destroy the system. Good practice is to log in and run apps as a normal user and elevate only when needed. Containers running as root are a well-known security risk.

“The container runs as root; add a non-root USER to the Dockerfile.”

CoreSecurity

superuser do

Runs a single command with elevated, usually root, privileges if your user is allowed by the sudoers configuration. Each use can be logged, which makes it safer than sharing the root password.

“Permission denied? Writing to /etc needs sudo.”

CoreSecurity

rwx, chmod

Every Linux file has read (r=4), write (w=2) and execute (x=1) permissions for three classes: owner, group and others. chmod changes them: 755 is rwxr-xr-x, 644 is rw-r--r--, and 600 is owner-only, which SSH requires for private keys. chmod 777 (everyone may do everything) is almost always the wrong fix.

“SSH refuses the key because its permissions are too open; chmod 600 it.”

CoreSecurity

user, group, UID

Every file belongs to a user and a group, and a process can only touch files its user is allowed to. chown changes the owner (chown app:app file). Ownership mismatches cause many permission-denied errors with containers and mounted volumes, where host and container user IDs differ.

“The volume is owned by root but the app runs as UID 1000; fix it with chown or fsGroup.”

Core

An absolute path starts at the root directory (/var/log/app.log) and means the same thing from anywhere. A relative path is resolved from the current directory (./logs/app.log, ../config). Scripts and cron jobs break when they assume a working directory, so automation should use absolute paths.

“The cron job failed because it used a relative path, and cron runs from the home directory.”

Core

~

Each user's personal directory, /home/username (or /root for root), written ~ for short. It holds per-user configuration such as ~/.bashrc, ~/.ssh and ~/.kube/config.

“Your kubeconfig lives at ~/.kube/config.”

Core

env var

A named value in a process's environment (PATH, HOME, DATABASE_URL) that child processes inherit. The standard way to pass configuration into apps and containers without changing code, as the Twelve-Factor App recommends. export sets one; env lists them. Never echo secrets stored in env vars into logs.

“The app reads its database host from the DATABASE_URL env var.”

CoreDevOps

The environment variable listing the directories the shell searches, in order, for commands. Command not found (exit code 127) usually means the program isn't installed or its directory isn't on PATH. which or command -v shows which binary will actually run.

“You installed it into ~/.local/bin, which isn't on your PATH.”

Core

standard streams

Every process gets three streams: standard input (fd 0), standard output (fd 1) for normal output, and standard error (fd 2) for errors and diagnostics. Containers should log to stdout and stderr so the platform can collect the logs. Keeping the two separate lets you filter errors.

“Don't log to a file inside the container; write to stdout and let the agent ship it.”

Core

The | operator, which feeds one command's output into the next command's input, chaining small tools into powerful one-liners such as ps aux | grep nginx | wc -l. Combining small single-purpose tools is the heart of the Unix philosophy.

“Pipe the log through grep ERROR, then sort and count.”

Core

>, >>, 2>&1

Sending a command's output to a file or another stream instead of the screen. > overwrites a file, >> appends, < reads input from a file, 2> redirects errors, and 2>&1 merges errors into normal output. > /dev/null throws output away.

“Run it with > out.log 2>&1 so the errors get captured too.”

Core

exit status, return code

The number a process returns when it ends: 0 means success, anything else failure. Scripts and CI pipelines decide pass or fail from it ($? in the shell). Common values: 1 general error, 126 not executable, 127 command not found, 130 interrupted by Ctrl+C, 137 killed by SIGKILL (often OOM), 143 terminated by SIGTERM.

“The step passed because the script swallowed the error and exited 0.”

CoreDevOps

Process ID

The unique number the kernel gives each running process, used to inspect or signal it (kill 1234, top -p 1234). PID 1 is special: the init process, which adopts orphaned processes. In a container, PID 1 is your app unless you add an init such as tini.

“Grab the PID from ps and send it a SIGTERM.”

Core

SIGTERM, SIGKILL, SIGHUP

A software interrupt sent to a process. SIGTERM (15) politely asks it to stop and can be handled for a graceful shutdown; SIGKILL (9) kills instantly and can't be caught; SIGINT (2) is Ctrl+C; SIGHUP (1) often means reload configuration. Kubernetes sends SIGTERM, waits the grace period (30 seconds by default), then sends SIGKILL.

“The app ignores SIGTERM, so every deploy drops in-flight requests after 30 seconds.”

CoreDevOps

kill sends a signal to a process by PID, SIGTERM by default. kill -9 sends SIGKILL, which always works but gives the process no chance to flush data or close connections, so it is a last resort. pkill and killall target processes by name.

“Try a plain kill first; kill -9 can leave a stale lock file behind.”

Core

background service

A long-running background process that provides a service with no user attached, traditionally named with a trailing d: sshd, dockerd, containerd, crond. Daemons start at boot and are managed by the init system.

“Cannot connect to the Docker daemon means dockerd isn't running.”

Core

systemctl, unit file

The init system and service manager on most modern distros, running as PID 1. Each service is described by a unit file; systemctl start, stop, restart, enable and status control it, and systemd can restart crashed services automatically. Its logs are read with journalctl.

“systemctl status nginx shows it failed on a config syntax error.”

Core

journald

Reads the logs collected by systemd's journal. journalctl -u nginx shows one service, -f follows live, --since "10 min ago" filters by time, -p err filters by priority. The first stop when a systemd service won't start.

“Run journalctl -u myapp -f while you restart it.”

Core

cron runs commands on a schedule; each user's schedule lives in a crontab. The five fields are minute, hour, day of month, month and day of week: */5 * * * * means every 5 minutes, 30 2 * * 1 means 02:30 every Monday. Kubernetes CronJobs and CI schedules use the same syntax. Cron runs with a minimal environment, a classic cause of works-by-hand, fails-in-cron.

“Add a crontab entry to run the backup every night at 1 AM.”

CoreDevOps

apt, dnf, yum, apk, brew

Installs, upgrades and removes software and its dependencies from trusted repositories: apt (Debian/Ubuntu), dnf/yum (RHEL family), apk (Alpine), brew (macOS). Programming languages have their own (pip, npm, Maven). In Dockerfiles, clean the package cache to keep images small.

“apt-get update && apt-get install -y curl in the Dockerfile.”

Core

Secure Shell

The encrypted protocol for logging in to remote machines and running commands, on port 22. It also tunnels traffic (port forwarding) and copies files (scp, sftp, rsync). Good practice: key-based authentication, no root login, no passwords, and increasingly SSO-based access or session managers instead of an open port 22.

“SSH into the bastion first, then hop to the private instance.”

CoreSecurity

public key, private key

A matched pair of keys for authenticating without passwords. The private key (for example ~/.ssh/id_ed25519) stays secret on your machine; the public key (.pub) goes into the server's ~/.ssh/authorized_keys. Ed25519 is the modern default. Leaking a private key is as bad as leaking a password.

“Send me your public key and I'll add it to the server. Never the private one.”

CoreSecurity

Tools for copying files between machines over SSH. scp copies files simply; rsync synchronizes directories efficiently by sending only the differences, can resume, preserves permissions and can delete extras. rsync is a workhorse for backups and simple deployments.

“rsync -avz ./dist/ user@server:/var/www/site/ deploys the static build.”

Core

Searches text for lines matching a pattern, including regular expressions. Essential for digging through logs and code: grep -i error app.log, grep -r TODO src/, -v to invert the match, -C 3 for surrounding context. ripgrep (rg) is a faster modern alternative.

“grep -c ' 500 ' access.log to count the server errors.”

Core

Stream-processing tools for text. sed edits on the fly (sed -i 's/old/new/g' file); awk works on columns and does small calculations (awk '{print $1}' access.log | sort | uniq -c counts requests per IP). Classic tools for log analysis and quick config edits in scripts.

“Use awk to pull the status-code column out of the nginx log.”

Core

follow logs

tail shows the end of a file; tail -f keeps following it as new lines arrive, the classic way to watch a log while you reproduce a bug. kubectl logs -f and docker logs -f do the same for containers.

“tail -f /var/log/nginx/error.log, then hit the endpoint again.”

Core

logrotate

Automatically renaming, compressing and deleting old log files so they never fill the disk. logrotate does this on Linux by size or schedule; container platforms rotate container logs for you. Missing rotation is a classic cause of disk-full outages.

“The disk filled up because nobody set up logrotate for the new app.”

CoreSRE

fd

An integer handle a process uses for every open file, socket or pipe (0, 1 and 2 are stdin, stdout and stderr). Each process has a limit, often 1024 by default. Busy servers with many connections hit Too many open files and need a higher limit, or a fix for leaked connections.

“It says too many open files; raise the nofile limit and check for socket leaks.”

Core

The structure that stores a file's metadata (owner, permissions, size, where its data blocks are) but not its name. A file system has a fixed number of inodes, so millions of tiny files can exhaust them while free space still shows. df -i shows inode usage.

“df says 40% free, yet writes fail; df -i shows every inode used by cache files.”

Core

symlink, soft link, hard link

A symlink is a special file that points to another path, like a shortcut (ln -s target link); it breaks if the target moves. A hard link is a second name for the same data, which survives until every name is deleted. Symlinks are often used for a current release directory.

“Deploy into releases/v42, then switch the current symlink to cut over.”

Core

mount point

Attaching a file system (a disk, partition, network share or virtual file system) to a directory in the single Linux directory tree, its mount point (mount /dev/sdb1 /data). /etc/fstab lists mounts to restore at boot. Containers receive volumes and config files as mounts.

“The volume wasn't mounted, so the app wrote everything to the root disk.”

Core

/etc, /var, /proc

The standard Linux directory layout: /etc for configuration, /var/log for logs, /var/lib for application state, /home for user data, /tmp for temporary files, /usr and /opt for software, and /proc and /sys for virtual files that expose kernel and process information. Knowing it tells you where to look.

“Config is in /etc/nginx and the logs are in /var/log/nginx.”

Core

the bit bucket

A special file that discards everything written to it and returns nothing when read. Used to silence output (command > /dev/null 2>&1), and jokingly as where ignored tickets go.

“Send the noisy output to /dev/null and keep only the errors.”

Core

Three numbers (1, 5 and 15-minute averages) shown by uptime and top: how many processes were running or waiting to run; on Linux this also counts processes stuck waiting on disk. Compare it with the number of CPUs: a load of 8 on an 8-core machine means fully busy, 30 means work is queuing.

“Load average is 40 on a four-core box; everything is queued behind disk I/O.”

CoreSRE

Interactive tools that show live CPU, memory, load and per-process usage; htop is the friendlier, colorful version. Often the first command run on a slow machine, alongside free -h (memory), df -h (disk) and iostat (disk I/O).

“Run htop and see which process is eating the CPU.”

Core

A zombie is a finished process whose parent hasn't collected its exit status, so it lingers in the process table. An orphan is a running process whose parent died; init (PID 1) adopts it. If your container's app runs as PID 1 and never reaps its children, zombies accumulate; tini or dumb-init fixes it.

“The container is full of defunct processes; add tini as the entrypoint.”

Core

Bash script, shebang

A text file of shell commands run as a program, starting with a shebang line such as #!/usr/bin/env bash that names the interpreter. The glue of automation, builds and CI steps. Start scripts with set -euo pipefail so they stop on errors, unset variables and failed pipes, and lint them with ShellCheck.

“Add set -euo pipefail; the script kept going after the download failed.”

CoreDevOps

.bashrc, .zshrc, .gitconfig

Hidden configuration files in your home directory whose names start with a dot. Many engineers keep theirs in a Git repo so any new machine is set up in minutes. ls -a shows them.

“Add the alias to your .zshrc and reload it.”

Core

terminal multiplexer

Terminal multiplexers: several shell sessions and split panes in one terminal and, above all, the ability to detach and reattach so long-running commands survive an SSH disconnect.

“Run the migration inside tmux so it survives if your VPN drops.”

Core

Traces the system calls a process makes and the signals it receives, answering what is this process actually doing: which files it opens, where it blocks, why it gets permission denied. It slows the target down, so prefer eBPF-based tools in production.

“strace -p 4321 shows it looping on open() of a missing config file.”

Core

extended Berkeley Packet Filter

A Linux kernel technology that runs small, verified, sandboxed programs inside the kernel, attached to events such as syscalls, network packets or function calls, without changing kernel code. It powers low-overhead observability (Pixie, Parca), networking (Cilium) and runtime security (Falco, Tetragon).

“Cilium uses eBPF instead of iptables, so service routing scales much better.”

CoreSRESecurity

mandatory access control

Linux security modules that enforce extra rules about what each program may access, beyond normal file permissions, so a compromised process stays confined. SELinux is standard on the RHEL family, AppArmor on Ubuntu. Often the hidden cause of permission denied when the file permissions look fine.

“Permissions are right; SELinux is blocking nginx from reading that directory.”

CoreSecurity

resource limits

Per-process limits on open files, processes, stack size and core dumps. Limits that are too low cause too many open files or cannot fork errors. Set in /etc/security/limits.conf, in systemd units (LimitNOFILE) or by the container runtime.

“Set LimitNOFILE=65536 in the proxy's unit file.”

Core

manual

Built-in documentation for a command, opened with man followed by its name (man rsync). Covers usage, flags and often examples; --help gives a short summary and tldr gives community examples. RTFM (read the manual) comes from here.

“Check man ssh_config for the ProxyJump option.”

Core

tarball

tar bundles many files into one archive (a tarball) and gzip compresses it, giving .tar.gz or .tgz. tar -czf out.tgz dir/ creates one and tar -xzf out.tgz extracts it. Container image layers are tar archives under the hood.

“Download the release tarball and extract it into /opt.”

Core

Two or more computers connected so they can exchange data, over cables, Wi-Fi or the internet. Networks come in layers: local networks (LAN), the wider internet (WAN) and virtual networks in the cloud (VPC). Most production mysteries eventually involve the network somewhere.

“Is it the app or the network? Can the pod even reach the database host?”

Core

The numeric address of a device on a network, used to route packets to it. IPv4 looks like 192.168.1.10; IPv6 looks like 2001:db8::1. Servers have private IPs inside their networks and sometimes public IPs reachable from the internet.

“The service resolves to 10.0.3.27, which is a private IP inside the VPC.”

Core

IPv4 uses 32-bit addresses written as four numbers (203.0.113.5); its roughly 4.3 billion addresses ran out long ago, which is why NAT is everywhere. IPv6 uses 128-bit addresses written in hex (2001:db8::5) and makes NAT unnecessary. Most clouds support dual-stack, and several now charge for public IPv4 addresses.

“The ISP gives us IPv6, but the load balancer is IPv4-only.”

Core

CIDR notation

A subnet is a range of IP addresses carved out of a larger network. CIDR notation writes the range as an address plus a prefix length: 10.0.0.0/16 holds 65,536 addresses, 10.0.1.0/24 holds 256; the smaller the suffix, the bigger the range. Plan non-overlapping CIDRs early, because overlapping ranges block VPC peering and VPNs later.

“Give each zone a /20 so we never run out of pod IPs.”

CoreCloud

RFC 1918

Address ranges reserved for internal networks and never routed on the public internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Home Wi-Fi, office LANs and cloud VPCs all use them, with NAT translating to public IPs for internet access.

“Both VPCs use 10.0.0.0/16, so we can't peer them without re-addressing one.”

CoreCloud

A number from 0 to 65535 identifying a specific service on a machine, so one IP can host many services. Well-known ports: 22 SSH, 53 DNS, 80 HTTP, 443 HTTPS, 5432 PostgreSQL, 3306 MySQL, 6379 Redis, 27017 MongoDB. Binding ports below 1024 traditionally needs root.

“The app listens on 8080, but the security group only opens 80.”

Core

127.0.0.1, loopback

The name for this machine, resolving to the loopback address 127.0.0.1 (::1 in IPv6); traffic never leaves the machine. Inside a container, localhost means the container itself, not the host, which causes a lot of connection refused errors.

“Inside the container, localhost is the container; use the service name to reach the DB.”

Core

listen address

A server listening on 127.0.0.1 only accepts connections from the same machine; one listening on 0.0.0.0 accepts them on every network interface. A dev server bound to 127.0.0.1 inside a container is unreachable through port mapping, one of the most common Docker gotchas.

“The port mapping is fine; Flask is bound to 127.0.0.1. Start it with --host 0.0.0.0.”

CoreDevOps

A hardware address assigned to each network interface (like 00:1A:2B:3C:4D:5E), used for delivery inside a local network (layer 2). IP gets a packet to the right network; the MAC gets it to the right device there. ARP maps IP addresses to MAC addresses.

“Two cloned VMs ended up with the same MAC, and the switch keeps flapping.”

Core

default gateway

A switch connects devices within one local network (layer 2). A router forwards packets between networks (layer 3). The default gateway is the router a machine sends traffic to when the destination isn't local. In the cloud, route tables do the router's job.

“The subnet has no route to the internet gateway, so nothing gets out.”

Core

Network Address Translation

Rewrites addresses as packets pass through a router, typically letting many private machines share one public IP for outbound internet access. Cloud NAT gateways let private subnets reach the internet without being reachable from it. They can run out of ports under heavy outbound traffic and are a well-known line on the bill.

“Private nodes pull images through the NAT gateway, and that's our biggest networking cost.”

CoreCloud

Dynamic Host Configuration Protocol

Automatically gives devices an IP address, gateway and DNS settings when they join a network, so nobody configures each one by hand. Your home router runs a DHCP server; clouds do it for VMs behind the scenes.

“The new box got no IP because the DHCP pool is exhausted.”

Core

Domain Name System

The internet's phone book: it translates names like api.example.com into IP addresses. Your machine asks a resolver, which walks the hierarchy (root, then .com, then example.com's nameservers) and caches the answer for the record's TTL. When DNS fails, everything fails, hence the joke that it's always DNS.

“The new endpoint isn't live because DNS still points at the old load balancer.”

Core

A, AAAA, CNAME, MX, TXT, NS

Kinds of DNS entries. A maps a name to an IPv4 address and AAAA to IPv6; CNAME makes one name an alias of another (not allowed at the bare apex domain); MX names mail servers; TXT holds text such as domain verification and SPF or DKIM email settings; NS delegates to nameservers; PTR does reverse lookups; CAA limits which certificate authorities may issue certificates.

“Add a CNAME from www to the CDN hostname and a TXT record for verification.”

Core

time to live

How many seconds resolvers may cache a DNS answer. Long TTLs reduce lookups but slow down changes; before a migration, lower the TTL to about 60 seconds a day in advance so the cutover takes effect quickly. TTL means the same expires-after idea in caches and network packets.

“Drop the TTL to 60 seconds the day before we switch load balancers.”

Core

subdomain, apex domain

A domain name is a readable address (example.com); subdomains add labels on the left (api.staging.example.com); the apex or naked domain is example.com itself. An FQDN (fully qualified domain name) is the complete name, such as a Kubernetes service's db.prod.svc.cluster.local.

“Use the FQDN in the config; the short name only resolves inside the namespace.”

Core

The delay before a DNS change is visible everywhere. Nothing is actually pushed: resolvers around the world keep serving cached answers until the old record's TTL runs out. That's why a change works for you but not yet for a customer.

“It works on my laptop but not on the customer's network; give propagation an hour.”

Core

Transmission Control Protocol

The reliable transport under HTTP, databases and most traffic. It sets up a connection, numbers the bytes, retransmits lost packets, keeps order and controls congestion. That reliability costs latency in handshakes and retransmissions.

“The TCP connection resets after 350 seconds idle; the NAT is timing it out.”

Core

User Datagram Protocol

A lightweight transport that sends packets without connections, ordering or retransmission. Fast and simple, used where speed beats perfect delivery: DNS, video calls, games, StatsD metrics, and QUIC (HTTP/3), which builds its own reliability on top.

“DNS uses UDP port 53, so open UDP, not just TCP.”

Core

SYN, SYN-ACK, ACK

How a TCP connection starts: the client sends SYN, the server replies SYN-ACK, the client answers ACK. It costs one round trip before data flows, and TLS adds more, which is why connection reuse matters so much for latency.

“Every call opens a new connection, so we pay for the handshake and TLS every time.”

Core

7-layer model

A teaching model that splits networking into seven layers: 1 physical, 2 data link (MAC, switches), 3 network (IP, routing), 4 transport (TCP, UDP, ports), 5 session, 6 presentation, 7 application (HTTP, DNS). Real stacks follow the simpler TCP/IP model, but everyone still says layer 4 and layer 7.

“That's a layer-7 problem; TCP connects fine, the HTTP route is wrong.”

Core

L4, L7

Shorthand for where a network device makes its decisions. Layer 4 sees only IPs, ports and TCP or UDP: fast and protocol-agnostic. Layer 7 understands HTTP: routing by path or header, TLS termination, retries, auth. AWS NLB is L4; ALB, nginx and Envoy usually work at L7.

“Use an L7 load balancer if you need path-based routing to different services.”

CoreCloud

datagram, frame

A small chunk of data sent across a network, with headers (source, destination, protocol) and a payload. Large messages are split into packets and reassembled. Packet loss means some never arrive: TCP retransmits them, UDP doesn't.

“Two percent packet loss on that link is enough to wreck p99 latency.”

Core

RTT

Latency is how long something takes; for networks, the round-trip time is how long a packet takes to reach its destination and come back. It's bounded by physics: Mumbai to the US East Coast is roughly 200 ms round trip. Chatty protocols multiply it, so keep services close to their users and their databases.

“Our API is fast; the 200 ms is just the round trip from Mumbai to us-east-1.”

CoreSRE

The maximum data rate a link can carry, in bits per second (Mbps, Gbps). Bandwidth is capacity, throughput is what you actually achieve, and latency is delay. A wider pipe doesn't make a single small request faster when latency dominates.

“We have 10 Gbps of bandwidth but get 2 Gbps because it's one TCP stream.”

Core

ping sends ICMP echo requests and reports whether replies come back and how long they take: the simplest reachability and latency check. Many firewalls and security groups block ICMP, so a failed ping doesn't prove the host is down; test the real port with curl or nc.

“Ping fails but the site loads; ICMP is simply blocked.”

Core

Show the path of router hops packets take to a destination and the latency at each hop; mtr runs it continuously with loss statistics. Useful for finding where along the route latency or packet loss begins.

“mtr shows the loss starts at the ISP's peering hop, not in our network.”

Core

Allows or blocks traffic by rules on source, destination, port and protocol. Comes as host firewalls (iptables/nftables, ufw), network appliances, and cloud equivalents (security groups, firewall rules, NACLs). Default-deny inbound is the standard posture.

“It times out instead of refusing, so a firewall is silently dropping it.”

CoreSecurity

Two failure signatures that point in different directions. Refused means the packet reached the host but nothing listens on that port (service down, wrong port, bound to localhost). Timed out means no answer at all, usually a firewall, security group, routing problem or a dead host.

“It's refused, not timed out, so the network's fine; the service isn't listening.”

CoreSRE

proxy, HTTPS_PROXY

A server that forwards client requests to the outside world on the clients' behalf, for filtering, caching or controlled egress. Tools pick it up from the HTTP_PROXY, HTTPS_PROXY and NO_PROXY environment variables. Corporate proxies are a frequent reason package installs fail on build agents.

“pip can't reach PyPI from the agent; set HTTPS_PROXY for the corporate proxy.”

Core

A server in front of your backends that receives client requests and forwards them inward: nginx, HAProxy, Envoy, Traefik, Caddy. It handles TLS termination, routing, compression, caching, rate limiting and load balancing so the apps don't have to.

“nginx terminates TLS as a reverse proxy and passes requests to the app on 8080.”

CoreDevOps

LB

Spreads incoming traffic across several backend servers so none is overwhelmed, and stops sending to unhealthy ones based on health checks. Algorithms include round robin, least connections and hashing. Cloud examples: AWS ALB and NLB, Google Cloud Load Balancing, Azure Load Balancer.

“Put three instances behind the load balancer and deploys become zero-downtime.”

CoreCloud

inbound, outbound

Ingress is traffic coming into a network or service; egress is traffic leaving it. Firewall rules are written per direction, and clouds mostly charge for egress. Kubernetes also uses Ingress as the name of its HTTP entry-point object.

“Egress to the internet is blocked from that subnet, so the webhook call never leaves.”

CoreCloud

North-south traffic flows between outside clients and your system; east-west traffic flows between services inside it. In microservice systems, east-west traffic usually dwarfs north-south, and it's where service meshes, mTLS and internal network policies live.

“Most of our bandwidth is east-west chatter between services, not user traffic.”

CoreSRE

HyperText Transfer Protocol

The request–response protocol of the web and most APIs. A client sends a method, a path, headers and an optional body; the server returns a status code, headers and a body. It is stateless: each request stands alone, so state lives in cookies, tokens or databases.

“The webhook is just an HTTP POST with a JSON body.”

Core

HTTP Secure

HTTP encrypted with TLS, normally on port 443. It protects data in transit from snooping and tampering and proves the server's identity through its certificate. Now the default everywhere; browsers mark plain HTTP as not secure, and Let's Encrypt issues certificates for free.

“Redirect port 80 to HTTPS and add an HSTS header.”

CoreSecurity

GET, POST, PUT, PATCH, DELETE

The verb saying what a request wants. GET reads (no side effects, cacheable), POST creates or triggers something, PUT replaces a resource, PATCH changes part of it, DELETE removes it. GET, PUT and DELETE should be idempotent; POST usually isn't. HEAD and OPTIONS fetch metadata and handle CORS preflights.

“Use PATCH to change just the email, not PUT with the whole user.”

Core

2xx, 3xx, 4xx, 5xx

Three-digit result codes: 2xx success (200 OK, 201 Created, 204 No Content), 3xx redirection (301 permanent, 302 temporary, 304 Not Modified), 4xx client errors (400 Bad Request, 401 not authenticated, 403 Forbidden, 404 Not Found, 409 Conflict, 429 Too Many Requests), 5xx server errors. The 5xx rate feeds most availability SLIs.

“4xx are the client's fault and don't burn our SLO; 5xx do.”

CoreSRE

Bad Gateway, Service Unavailable, Gateway Timeout

Errors that usually come from the proxy or load balancer in front of your app. 502: the upstream sent something invalid or dropped the connection (crash, wrong port). 503: no healthy backends, overload or maintenance. 504: the upstream didn't answer in time (slow query, deadlock, timeout too short).

“It's a 504, so the app is reachable but too slow; look at the database, not the deploy.”

CoreSRE

Key-value metadata on requests and responses: Content-Type, Authorization, Cache-Control, User-Agent, Host, Set-Cookie, X-Request-ID. Headers drive caching, auth, content negotiation, CORS and tracing; proxies add X-Forwarded-For to pass on the original client IP.

“The app sees the load balancer's IP; read the client IP from X-Forwarded-For.”

Core

A cookie is a small piece of data the server asks the browser to store and send back on every request to that site, used for sessions, preferences and tracking. A session is server-side state, such as logged in as user 42, linked to a cookie ID. Session cookies should carry the Secure, HttpOnly and SameSite flags.

“The session cookie lacks HttpOnly, so any XSS bug could steal it.”

CoreSecurity

scheme, host, path, query string

A URL such as https://api.example.com:443/v1/users?id=42#top has a scheme (https), host, optional port, path (/v1/users), query string (?id=42, key=value pairs) and fragment (#top, never sent to the server). Special characters must be URL-encoded; a space becomes %20.

“Put the filter in the query string, not the path.”

Core

persistent connection

Keeping a TCP and TLS connection open for many requests instead of opening a new one each time, which skips repeated handshakes. HTTP keep-alive and connection pools in clients and database drivers do this. Mismatched idle timeouts between a client and a load balancer cause intermittent connection reset errors.

“Random 502s: the app's keep-alive timeout is shorter than the load balancer's.”

Core

QUIC

HTTP/2 multiplexes many requests over one TCP connection with binary framing and header compression; gRPC is built on it. HTTP/3 runs over QUIC on UDP, avoiding TCP head-of-line blocking and surviving network changes such as Wi-Fi to mobile.

“gRPC needs HTTP/2 end to end; the old proxy downgrades to HTTP/1.1 and breaks it.”

Core

A protocol that upgrades an HTTP connection into a long-lived two-way channel, so either side can push messages at any time. Used for chat, live dashboards, multiplayer and collaboration tools. Proxies and load balancers must support the upgrade and allow long idle timeouts.

“Notifications run over a WebSocket, so check the load balancer's idle timeout.”

Core

Transport Layer Security, SSL

The cryptographic protocol that encrypts traffic and authenticates servers, and optionally clients. TLS 1.2 and 1.3 are current; SSL is its broken predecessor, though people still say SSL certificate. TLS termination means decrypting at a proxy or load balancer and forwarding the request inward.

“Terminate TLS at the load balancer, and use mTLS inside if we need encryption end to end.”

CoreSecurity

X.509, certificate authority

A certificate is a signed file that binds a domain name to a public key and proves the server's identity. Certificate authorities such as Let's Encrypt sign them; clients trust a built-in list of root CAs, and the server must send the full chain. Certificates expire (90 days for Let's Encrypt), and an expired one is a classic outage.

“The outage was an expired certificate nobody owned; let cert-manager renew them.”

CoreSecurity

Server Name Indication

A TLS extension where the client names the hostname it wants during the handshake, so one IP address can serve many HTTPS sites with different certificates. Load balancers and ingress controllers route on it.

“One ingress IP serves fifty domains thanks to SNI.”

Core

Content Delivery Network

A global network of edge servers that cache and serve content (images, scripts, video, even API responses) close to users, cutting latency and shielding the origin. Examples: Cloudflare, Akamai, CloudFront, Fastly. CDNs also absorb DDoS traffic; Cache-Control headers decide what they keep.

“Serve static assets from the CDN and purge its cache on every release.”

CoreCloud

edge computing, PoP

The parts of the network closest to users: CDN points of presence (PoPs), regional caches, on-device or on-site compute. Edge computing runs code there (Cloudflare Workers, Lambda@Edge) for very low latency, as opposed to the origin region.

“Do the redirect logic at the edge so it never touches our origin.”

CoreCloud

Border Gateway Protocol

BGP is the protocol networks use to tell each other which IP ranges they can reach; it is how internet routes get built. Anycast announces the same IP from many locations so each user reaches the nearest one; CDNs and public DNS resolvers (1.1.1.1, 8.8.8.8) rely on it. BGP mistakes cause some of the biggest outages.

“The 2021 Facebook outage started with a BGP change that withdrew their own routes.”

Core

Virtual Private Network

An encrypted tunnel that joins a device or a whole network to another network over the internet, as if directly connected. Used for remote access to internal systems and for site-to-site links between offices, data centers and the cloud. WireGuard, IPsec and OpenVPN are common; zero-trust access is replacing many VPN use cases.

“Connect to the VPN before you try the internal dashboards.”

CoreSecurity

Maximum Transmission Unit

The largest packet a link carries, usually 1500 bytes on Ethernet (9000 with jumbo frames). Tunnels and overlay networks add headers, so packets that used to fit become too big; if the too-big signals are blocked, small requests work and large ones hang. A classic, maddening bug in VPNs and Kubernetes overlays.

“SSH works but large responses hang; it's an MTU mismatch on the tunnel.”

Core

ephemeral ports, SNAT exhaustion

Every outbound connection uses a temporary local port from a limited range (about 28,000 by default on Linux). Services making huge numbers of short-lived outbound connections, especially through a single NAT IP, can run out and see intermittent failures. Fixes include connection reuse, more NAT IPs and TIME_WAIT tuning.

“The connection errors under load were SNAT port exhaustion on the NAT gateway.”

CoreSRE

The command-line tool for making HTTP and many other requests, used constantly to test APIs. -v shows headers and the TLS handshake, -X sets the method, -H adds a header, -d sends a body, -w prints timings.

“curl -v the health endpoint from inside the pod to see what's really returned.”

Core

Command-line DNS lookup tools. dig example.com A shows the answer, its TTL and which server replied; dig +trace walks the delegation chain; nslookup is the older, simpler tool. The first stop when a name resolves to the wrong place.

“dig the hostname from the node; it still returns the old IP.”

Core

Show network connections and listening ports on a machine. ss -tlnp lists listening TCP ports with the owning process; netstat is the older equivalent. Answers questions like is anything listening on 8080 and how many connections sit in TIME_WAIT.

“ss -tlnp shows nginx on port 80 but nothing on 443.”

Core

packet capture

tcpdump captures raw packets from the command line; Wireshark captures and decodes them visually. The last-resort tools for seeing exactly what's on the wire: failing TLS handshakes, retransmissions, resets, wrong addresses.

“Grab a tcpdump on the node; I want to see who sends the RST.”

CoreSecurity

Cross-Origin Resource Sharing

A browser rule that blocks web pages from calling APIs on a different origin (scheme, domain and port) unless the API allows it with headers such as Access-Control-Allow-Origin. Non-simple requests send a preflight OPTIONS request first. Only browsers enforce it, so it works in curl proves nothing.

“It's a CORS error; the API must allow https://app.example.com.”

CoreSecurity

Unix domain socket

An endpoint for network communication identified by an IP address, a port and a protocol; a TCP connection is identified by source IP, source port, destination IP and destination port. Unix domain sockets do the same on one machine through a file path such as /var/run/docker.sock.

“Mounting docker.sock into a container hands it control of the host's Docker.”

Core

HOL blocking

When one slow or lost item at the front of a queue holds up everything behind it. HTTP/1.1 suffers it per connection; HTTP/2 fixes it at the HTTP layer, but one lost TCP packet still stalls every stream, which QUIC fixes. The same idea applies to queues, Kafka partitions and thread pools.

“One poisoned message stalled the whole partition: head-of-line blocking.”

Core

split DNS

Giving different DNS answers for the same name depending on who asks: internal clients get a private IP, internet clients a public one. Common with private cloud endpoints and VPNs, and confusing when you debug from the other side.

“It resolves to 10.x on the VPN and to a public IP from home; that's split-horizon DNS.”

Core

A formal language for writing instructions a computer can run. In infrastructure work you'll meet Python (automation, ML), Go (Kubernetes, Terraform and most cloud-native tools), Bash (glue), JavaScript and TypeScript (web, CDK), Java and Kotlin (enterprise backends), Rust (systems) and HCL or YAML for configuration.

“Most cloud-native tools are written in Go, so reading Go helps when you debug them.”

Core

A precise, step-by-step procedure for solving a problem, such as sorting a list, finding a shortest path or hashing a key. A better algorithm usually beats faster hardware. Interviews test algorithms; production rewards knowing which standard one fits.

“Don't sort the whole list to find the top 10; use a heap.”

Core

A way of organizing data in memory for efficient access: arrays and lists, hash maps (dictionaries), sets, stacks, queues, trees, heaps and graphs. The right choice turns an O(n) operation into O(1).

“Use a set for membership checks; scanning a list every time is O(n).”

Core

time complexity

Describes how an algorithm's time or memory grows with input size, ignoring constants: O(1) constant, O(log n) logarithmic, O(n) linear, O(n log n) typical sorting, O(n²) quadratic (nested loops), O(2ⁿ) exponential. Code that's fine on 100 rows can die on 10 million if it's O(n²).

“The dedupe is O(n²); with two million rows, that's why the job never finishes.”

Core

A variable is a named place to store a value; its type says what kind of value (integer, float, string, boolean, list, object) and which operations make sense. Floating-point numbers are approximate (0.1 + 0.2 isn't exactly 0.3), so never store money as floats.

“Store money in paise as an integer, not as a float.”

Core

method, subroutine

A named, reusable block of code that takes inputs (parameters), does one job and returns a result. A method is a function attached to an object or class. Small, single-purpose functions are easier to test and reason about.

“Extract that 200-line block into a function and unit-test it.”

Core

OOP, class, object

Organizing code into classes (blueprints) and objects (instances) that bundle data with behavior. Its pillars are encapsulation (hide internals), inheritance (reuse by subclassing), polymorphism (one interface, many implementations) and abstraction.

“Each cloud provider is a class implementing the same Storage interface.”

Core

FP

A style built on pure functions, immutable data and composing functions (map, filter, reduce) instead of mutating state in loops. Code without hidden side effects is easier to test and parallelize. Haskell, Elixir and Clojure are functional; most languages borrow the ideas.

“Keep the transform pure: same input, same output, no writes to globals.”

Core

You call a library when you need it (requests, NumPy); a framework calls your code within its own structure and lifecycle (Django, Spring, React), which is called inversion of control. Frameworks trade flexibility for speed and conventions.

“requests is a library you call anywhere; Django is a framework your code lives inside.”

Core

Software Development Kit

A package of libraries, tools and docs for building on a platform: the AWS SDK (boto3), Google Cloud client libraries, the Android SDK, the Anthropic and OpenAI SDKs. SDKs wrap raw APIs with authentication, retries and types.

“Use the SDK instead of raw HTTP; it handles request signing and retries.”

CoreCloud

External code or services your project relies on: libraries, packages, base images, other APIs. Dependencies save effort but bring breaking updates, vulnerabilities and license obligations, and direct dependencies pull in transitive ones you never chose.

“That CVE is in a transitive dependency we didn't know we had.”

CoreDevOps

JIT

A compiler translates source code to machine code or bytecode before it runs (C, Go, Rust; Java to bytecode). An interpreter executes code more directly at run time (Python, Bash, Ruby). Just-in-time (JIT) compilers compile hot code while running (the JVM, V8). Compiled languages catch more errors early and usually run faster.

“Go compiles to one static binary, which keeps the container tiny.”

Core

type system

Static typing checks types before the program runs (Go, Java, Rust, TypeScript), catching whole classes of bugs at build time. Dynamic typing checks at run time (Python, JavaScript), faster to write but errors show up in production. Python type hints and TypeScript add static checks to dynamic languages.

“Turn on mypy; it would have caught that string being passed as an int.”

Core

Two meanings. The period while a program runs (a runtime error, as opposed to a compile-time error), and the environment that runs it: the JVM, Node.js, the Python interpreter, .NET, or a container runtime. Runtime versions must match what the code expects.

“It's a runtime error, not a build error; it only fails when that branch executes.”

Core

defect, regression

An error that makes software behave incorrectly, from typos to subtle concurrency issues. A regression is a bug in something that used to work. Fixing one means reproducing, isolating, fixing, testing and preventing it from coming back.

“Can you reproduce the bug locally, or only in prod?”

Core

debugger, breakpoint

Finding and fixing the cause of a bug: reproduce it, form a hypothesis, inspect state, narrow it down. Tools include debuggers with breakpoints that pause execution, logging, profilers and git bisect. It is the scientific method applied to code.

“Set a breakpoint in the handler and inspect the payload.”

Core

traceback

The list of function calls active when an error happened, with file names and line numbers. Python prints the most recent call last; Java prints it first. Always include the full stack trace in a bug report.

“Paste the full stack trace, not just it crashed.”

Core

try/catch

An exception is an error that interrupts normal flow; error handling catches it and decides what happens next: retry, fall back, report or fail cleanly. Anti-patterns include silently swallowing errors, catching everything and showing stack traces to users. Go returns errors as values instead of throwing them.

“Don't wrap it in except: pass; at least log it with context.”

Core

null, None, nil

A reference that points to nothing; using it as if it held a value crashes the program (NullPointerException, NoneType has no attribute, nil pointer dereference). Tony Hoare called inventing null his billion-dollar mistake. Optional types and explicit checks prevent it.

“The crash is a nil pointer: that config section is missing, so the struct is nil.”

Core

corner case

The happy path is the normal flow where everything goes right. Edge cases are unusual inputs or conditions at the boundaries: empty lists, zero, huge values, time-zone changes, non-Latin names, the network failing halfway. Most bugs live in edge cases.

“Works on the happy path; what happens with an empty file, or a 5 GB one?”

Core

fencepost error

Using a boundary that is one too high or too low: a loop that runs once too often, a slice that stops one short, < where <= was meant. One of the most common bugs in programming.

“It's off by one; we skip the last page of results.”

Core

Restructuring code to improve its design or readability without changing what it does, in small steps protected by tests: rename, extract a function, remove duplication. It's how you pay down technical debt continuously.

“No behavior change in this PR; it's a pure refactor.”

Core

tech debt

Ward Cunningham's metaphor for shortcuts and dated designs that speed you up now but charge interest later as extra effort on every change. Some debt is deliberate and fine; unmanaged debt slows teams and causes incidents. Good teams track it and pay it down on purpose.

“Ship with the hardcoded config, but log it as tech debt for next sprint.”

CoreLeadership

A surface sign that code may hide a deeper design problem without being a bug: very long functions, duplicated code, huge classes, long parameter lists, deeply nested conditionals, magic numbers. A prompt to refactor; the term was popularized by Martin Fowler.

“A 900-line function with six boolean flags is a code smell.”

Core

readable code

Code others can read, understand and change easily: clear names, small focused functions, consistent style, no surprises, comments that explain why rather than what. Code is read far more often than it's written.

“Call it retry_count, not rc; clean code is for the next reader.”

Core

Don't Repeat Yourself

Every piece of knowledge should have one authoritative home, so a change happens in one place. Overdone, it produces tangled abstractions; a little duplication is cheaper than the wrong abstraction.

“The same validation is pasted into five handlers; pull it into one function.”

Core

Keep It Simple, Stupid

Prefer the simplest design that works. Complexity is the main source of bugs, outages and onboarding pain, and simple systems are easier to operate at 3 AM.

“Do we really need Kafka? A cron job and a table will do.”

Core

You Aren't Gonna Need It

Don't build features or abstractions for imagined future needs; build what's needed now and keep it easy to change. Speculative generality costs time and adds complexity that rarely pays off.

“A plugin system for a single plugin? YAGNI.”

Core

Five object-oriented design principles from Robert C. Martin: Single responsibility (one reason to change), Open/closed (extend without modifying), Liskov substitution (a subtype must work wherever its parent does), Interface segregation (small, focused interfaces), Dependency inversion (depend on abstractions, not concrete classes). A favorite interview topic.

“This class sends email, writes the DB and renders HTML; that breaks single responsibility.”

Core

Gang of Four

Named, reusable solutions to common design problems, cataloged by the Gang of Four in 1994: Singleton, Factory, Builder, Adapter, Decorator, Observer, Strategy and more. They give teams a shared vocabulary; misused, they add pointless layers.

“Use the strategy pattern so each cloud provider plugs in its own uploader.”

Core

DI, inversion of control

Passing a component's dependencies in through its constructor or parameters instead of letting it create them. It makes code testable (inject a fake database) and loosely coupled; frameworks like Spring automate it.

“Inject the HTTP client so the test can pass a mock.”

Core

Coupling is how much one module depends on another's internals; cohesion is how closely the parts inside one module belong together. Aim for low coupling and high cohesion so changes stay local. Tight coupling between services turns microservices into a distributed monolith.

“Those two services share a table, so they're tightly coupled and must deploy together.”

Core

Hiding complex details behind a simpler interface so people rely on what something does, not how. Every layer of computing is one: files over disk blocks, Kubernetes over machines. Abstractions leak when the hidden details break through.

“The storage abstraction lets us swap S3 for GCS without touching business logic.”

Core

Build behavior by combining small objects or functions instead of deep class hierarchies. Inheritance ties children to their parents' internals; composition stays flexible. Go has no class inheritance at all.

“Don't add a fifth subclass; compose a retrier into the client instead.”

Core

immutable

Values that can't change after creation; you make a new version instead. Immutable data is safe to share between threads and easy to reason about. The same idea scales up to immutable container images and immutable infrastructure.

“Make the config object immutable so no request handler can change it mid-flight.”

CoreDevOps

A pure function returns the same output for the same input and changes nothing outside itself. A side effect is anything else: writing a file, calling an API, changing a global, printing. Pure functions are trivial to test, so push side effects to the edges of a program.

“Keep the pricing logic pure and do the database writes outside it.”

Core

A function that calls itself on a smaller piece of the problem until a base case stops it. Natural for trees, graphs and nested data such as JSON or directories; without a correct base case it never stops and overflows the stack.

“Walk the directory tree recursively, but cap the depth.”

Core

async/await, promise, future

Starting a slow operation (network call, file read) and doing other work instead of waiting, then resuming when the result arrives. async/await makes such code read like sequential code; promises and futures stand for results that arrive later. Ideal for I/O-bound services.

“Fire the three API calls concurrently and await them together, not one by one.”

Core

The mechanism in Node.js, Python's asyncio and browsers: one thread pulls events and callbacks off a queue and runs them. It handles huge numbers of concurrent I/O operations, but any CPU-heavy or blocking call stalls everyone, so don't block the event loop.

“One synchronous parse of a 200 MB payload blocked the event loop for every user.”

Core

A bug where the outcome depends on the unpredictable timing of concurrent operations, such as two requests reading a balance and both writing back. Intermittent and hard to reproduce; fixed with locks, atomic operations, transactions or idempotent design.

“Two workers grabbed the same job: a race between the read and the update.”

Core

Two or more threads or transactions each holding something the other needs, so all of them wait forever. Prevent it by always taking locks in the same order, using timeouts or avoiding shared locks; databases detect deadlocks and abort one transaction.

“Thread A holds the cache lock and wants the DB lock; thread B the reverse. Deadlock.”

Core

mutual exclusion, semaphore

A lock that lets only one thread at a time into a critical section or shared data. It prevents races but costs performance, and careless use causes deadlocks and contention. Variants include read-write locks, semaphores and spinlocks.

“Wrap the counter update in a mutex, or use an atomic increment.”

Core

Code is thread-safe when it behaves correctly while many threads call it at once, achieved with immutability, locks, atomic operations or per-thread state. Libraries document whether their clients may be shared between threads.

“That client isn't thread-safe; create one per worker or guard it with a lock.”

Core

idempotent

An operation is idempotent if doing it once or many times has the same effect: setting a value is, incrementing it isn't. Vital wherever retries happen: APIs, message consumers, deployments, Ansible and Terraform runs. Payment APIs use idempotency keys so a retried request never charges twice.

“Retries are safe because the endpoint is idempotent: same request ID, same result.”

CoreDevOpsSRE

marshalling

Turning in-memory objects into a storable or sendable format (JSON, YAML, XML, Protocol Buffers, Avro, pickle) and deserializing them back. Binary formats are smaller and faster, text formats human-readable. Deserializing untrusted data with unsafe formats such as Python pickle can execute an attacker's code.

“Never unpickle a model file from an untrusted source; it can run code.”

Core

JavaScript Object Notation

A lightweight text format for data: objects in braces, arrays in brackets, strings, numbers, booleans and null. The default for web APIs, structured logs and much configuration. Strict syntax: double quotes, no comments, no trailing commas. jq queries it from the command line.

“Pipe the API response through jq '.items[].name'.”

Core

YAML Ain't Markup Language

A human-friendly, indentation-based data format used for Kubernetes manifests, CI pipelines, Ansible and Docker Compose. Gotchas: spaces only, never tabs; one wrong indent changes the meaning; YAML 1.1 parsers turn NO into false (the Norway problem). Quote strings when in doubt.

“The pipeline broke because of one wrong indent in the YAML.”

CoreDevOps

regex

A pattern language for matching text: \d+ matches digits, ^ and $ anchor a line, .* matches anything, parentheses capture groups. Used in grep, log parsing, validation, routing rules and alert filters. Powerful but easy to get wrong, and badly written patterns can be catastrophically slow (ReDoS).

“Write a regex that pulls the request ID out of each log line.”

Core

hash function, checksum

A hash function maps data of any size to a fixed-size fingerprint (SHA-256, MD5, xxHash): the same input always gives the same output, and a tiny change gives a completely different one. Used for checksums, Git commits, image digests, cache keys and hash maps. Hashing is one-way; it is not encryption.

“Compare the SHA-256 checksum to confirm the download wasn't corrupted.”

CoreSecurity

GC

Automatic memory management: the runtime finds objects nothing references any more and frees them (Java, Go, Python, JavaScript, C#). It prevents manual memory bugs, but GC pauses can cause latency spikes, and memory still leaks if references linger.

“The p99 spikes line up exactly with full GC pauses on the JVM.”

Core

Protection against bugs such as buffer overflows and use-after-free, which cause crashes and most serious security holes in C and C++. Memory-safe languages (Rust, Go, Java, Python) prevent them by design, and government security agencies now urge moving to them.

“The CVE is a buffer overflow in a C library, one more reason to port that parser to Rust.”

CoreSecurity

ESLint, Ruff, gofmt, Prettier

A linter analyzes code for errors, suspicious patterns and style problems without running it (ESLint, Ruff, ShellCheck, hadolint, tflint). A formatter rewrites code into one consistent style (Prettier, Black, gofmt). Both run in pre-commit hooks and CI so reviews can focus on logic.

“CI failed on lint, not tests; run the formatter and push again.”

CoreDevOps

Integrated Development Environment

An editor with built-in coding tools: syntax highlighting, autocomplete, debugging, refactoring, Git and a terminal. VS Code, the JetBrains family and Vim or Neovim setups are common; AI-first editors add coding agents on top.

“Install the Terraform extension in your IDE for autocomplete.”

Core

Read-Eval-Print Loop

An interactive prompt that reads an expression, runs it, prints the result and waits for the next: python, node, the browser console. Ideal for quickly testing an idea or poking at an API.

“Paste it into a Python REPL and check what the regex returns.”

Core

Repetitive standard code you write again and again with little variation: setup, configuration, scaffolding. Frameworks, templates, code generators and AI assistants cut it down.

“The generator writes the boilerplate; you only fill in the handler.”

Core

Hardcoding puts values that should be configurable (URLs, credentials, limits) directly in code; a magic number is an unexplained literal such as if retries > 7. Both make change risky, and hardcoded secrets are a breach waiting to happen. Move them into named constants, configuration or a secrets manager.

“The prod URL is hardcoded, so staging was writing to the production database.”

CoreDevOps

config

Settings that change how software behaves without changing its code: URLs, toggles, timeouts, credentials. Kept separate from code (env vars, config files, ConfigMaps) so the same build runs in every environment. Bad config changes cause a large share of outages.

“It's only a config change, but it still goes through review.”

CoreDevOps

legacy system

Old code or systems still in service, often on dated technology, poorly documented and scary to change; Michael Feathers defines it as code without tests. Legacy systems usually make the money, so you modernize them gradually instead of rewriting in one go.

“It's legacy COBOL, but it processes every payment, so we change it carefully.”

Core

deprecated

Marking a feature, API or version as discouraged and scheduled for removal, giving users time to migrate. The deprecation warning is the polite step before a breaking change. Kubernetes API deprecations are a common upgrade blocker.

“That Ingress API version is deprecated; migrate the manifests before the upgrade.”

Core

A metric counting the independent paths through code; every if, loop and case adds one. High values mean code that's hard to test and understand, and quality tools flag functions above a threshold, often 10.

“Its complexity is 37; split the function before adding another branch.”

Core

Caching a function's results by its arguments so repeated calls with the same inputs return instantly. A simple, powerful optimization for expensive pure functions (Python's functools.lru_cache).

“Memoize the price lookup; it's called 10,000 times with the same five SKUs.”

Core

type parameters

Writing functions and data structures that work for any type while keeping type safety, such as List<T>. Java, C#, TypeScript, Rust and Go (since 1.18) support them; they remove copy-paste versions for each type.

“Write it once with generics instead of separate copies for ints, strings and floats.”

Core

VCS, source control

A system that records every change to files over time, so you can see history, compare versions, undo mistakes and let many people work on the same code safely. Git is the standard; older systems include SVN and Perforce. In modern DevOps, code, infrastructure, pipelines and docs all live in version control.

“If it isn't in version control, it doesn't exist.”

CoreDevOps

The distributed version control system Linus Torvalds created in 2005. Every clone holds the full history, so you can commit, branch and browse offline, then sync with remotes hosted on GitHub, GitLab or Bitbucket.

“Clone the repo and create a branch for your fix.”

CoreDevOps

repo

A project folder tracked by Git, holding the files plus their complete history in the hidden .git directory. Local repos live on your machine; remote repos live on a server such as GitHub.

“The Terraform code is in the infra repo, not the app repo.”

Core

A saved snapshot of changes with a message, author, timestamp and unique hash; history is a chain of commits. Good commits are small, focused and explain why the change was made.

“One commit per logical change, with a message that says why.”

Core

SHA, commit ID

A commit's unique ID: a 40-character hexadecimal hash of its contents and history (Git is moving from SHA-1 to SHA-256), usually shortened to 7 characters. Images and deployments are often tagged with it so you can trace exactly what is running.

“Prod runs commit a3f9c21; check what changed since then.”

Core

index, git add

The step between editing files and committing: git add moves chosen changes into the staging area, and git commit records exactly what's staged. It lets you craft focused commits from a messy working directory; git status shows what's staged.

“Stage only the config change and leave the debug prints out.”

Core

A movable pointer to a line of commits, letting you work on a feature or fix in isolation without touching the main code. Branches are cheap and instant in Git and get merged back through pull requests.

“Create a branch called fix/login-timeout and open a PR when you're done.”

Core

default branch, trunk

The primary branch of a repository, holding the official and usually deployable code. main is the modern default name; older repos use master. It is normally protected so changes arrive only through reviewed pull requests.

“Never push straight to main; it auto-deploys to production.”

Core

detached HEAD

Git's pointer to what you have checked out, normally the latest commit of your current branch; HEAD~1 is one commit earlier. Detached HEAD means you checked out a commit or tag directly, so new commits there belong to no branch.

“You're in detached HEAD after checking out the tag; create a branch before committing.”

Core

Copying a remote repository with its history to your machine (git clone URL). A shallow clone (--depth 1) fetches only recent history, which speeds up CI.

“CI does a shallow clone to save time.”

Core

Your own server-side copy of someone else's repository, used to propose changes to projects where you can't push. You push to your fork and open a pull request back to the original, called upstream.

“Fork the project, push your fix and open a PR upstream.”

Core

push uploads your local commits to a remote; fetch downloads new commits without touching your work; pull is fetch plus a merge or rebase into your branch. Pull before you push to avoid rejected pushes.

“Your push was rejected; pull the latest changes first.”

Core

upstream

A remote is a named reference to a repository hosted elsewhere. origin is the default name for the one you cloned; upstream conventionally names the original project when you work from a fork. git remote -v lists them.

“Add the original repo as upstream so you can keep your fork in sync.”

Core

Combining the changes of one branch into another. If the target hasn't moved, Git simply fast-forwards; otherwise it creates a merge commit joining the two histories. Pull requests end in a merge.

“Merge main into your branch to pick up the latest changes.”

Core

When two branches changed the same lines, or one deleted what the other edited, Git can't decide which wins and marks the spot with <<<<<<<, ======= and >>>>>>> for you to resolve by hand. Small, frequent merges keep conflicts small.

“Resolve the conflict in values.yaml, then commit.”

Core

interactive rebase

Replaying your branch's commits on top of another branch's latest commit, giving a straight line of history instead of merge commits. It rewrites commit hashes, so never rebase commits other people have already pulled. git rebase -i lets you reorder, squash and edit commits.

“Rebase onto main before merging so the history stays linear.”

Core

squash merge

Combining several commits into one, typically when merging a pull request, so main gets one clean commit per change instead of a trail of fix typo commits. The branch's fine-grained history is lost.

“We squash-merge PRs so main reads like a changelog.”

Core

Copying one specific commit from one branch onto another without merging the whole branch, commonly to apply a hotfix to a release branch.

“Cherry-pick the security fix onto the release-2.3 branch.”

Core

Temporarily shelving uncommitted changes (git stash) so you can switch branches with a clean working directory, then bringing them back with git stash pop.

“Stash your work, fix the hotfix on main, then pop the stash.”

Core

release tag

A named, permanent pointer to one commit, usually marking a release (v1.4.0). Annotated tags carry a message and author and can be signed. Pushing a tag often triggers the release pipeline.

“Tag the commit v2.1.0 and the release pipeline builds the artifacts.”

CoreDevOps

The line-by-line difference between two versions: additions marked +, deletions marked -. git diff shows unstaged changes, and code review is mostly reading diffs; terraform plan is effectively a diff for infrastructure.

“Send me the diff; I want to see exactly which lines changed.”

Core

annotate

Shows who last changed each line of a file, in which commit and when. It's for understanding why code is the way it is, not for blaming people.

“git blame shows that check was added in 2019 to fix a payment bug; don't delete it.”

Core

git revert creates a new commit that undoes an earlier one, safe on shared branches because history isn't rewritten. git reset moves the branch pointer backwards and can discard changes (--hard): fine locally, dangerous on shared branches. Roll back production through revert.

“Don't reset main; revert the bad commit so everyone's history stays intact.”

Core

--force-with-lease

Overwriting the remote branch with your local one even if that throws away remote commits. Needed after rebasing your own branch, destructive on shared ones. --force-with-lease refuses if someone else pushed meanwhile, so prefer it.

“Use --force-with-lease after rebasing your PR branch, and never force-push main.”

Core

A file listing patterns Git should never track: build output, dependencies (node_modules), local env files (.env), logs, large data and secrets. Committing secrets because .gitignore was missing is a very common security incident.

“Add .env and *.tfstate to .gitignore before your first commit.”

CoreSecurity

PR, merge request, MR

A request to merge one branch into another, carrying a description, the diff, automated checks and review comments. GitHub and Bitbucket call it a pull request; GitLab calls it a merge request. It's where code review, CI and approval happen.

“Open a PR and tag the platform team for review.”

CoreDevOps

Teammates reading a proposed change before it merges, to catch bugs, share knowledge, keep standards and improve design. Good reviews are prompt, specific and kind, and small PRs get much better reviews.

“Keep PRs under 400 lines; nobody reviews 3,000 lines properly.”

CoreDevOps

Looks Good To Me

The classic approval comment in code review: the reviewer is happy for the change to merge. Variants include LGTM with nits and LGTM once CI is green. A rubber-stamp LGTM on a huge PR is a well-known anti-pattern.

“LGTM; just fix the README typo before merging.”

Core

nitpick

A review comment about a minor, non-blocking issue such as naming, formatting or wording. Prefixing nit: tells the author it's optional. Automate style nits with linters so people can focus on substance.

“nit: rename tmp to retry_delay. Not blocking.”

Core

A repository file mapping paths to the people or teams who must review changes there, for example /terraform/ @platform-team. With branch protection, any PR touching those paths needs an owner's approval, which builds ownership into the workflow.

“The PR touches /infra, so CODEOWNERS pulled in the platform team automatically.”

CoreDevOps

protected branch

Rules guarding important branches: require pull requests, a number of approvals, passing CI checks, signed commits or linear history, and block force pushes and deletion. A core change-management and supply-chain control.

“Branch protection blocks the merge until the security scan passes.”

CoreDevOpsSecurity

Git flow, GitHub flow

A team's agreed way of using branches. Git flow keeps long-lived develop and main branches plus feature, release and hotfix branches, suited to versioned releases but heavy. GitHub flow is simple: short-lived branches off main, a PR, merge and deploy. Trunk-based development goes further still.

“We dropped Git flow for GitHub flow; the release branches only slowed us down.”

CoreDevOps

TBD

Everyone integrates small changes into the main branch (the trunk) at least daily, using very short-lived branches or none, with unfinished work hidden behind feature flags. DORA research links it with high delivery performance because it avoids painful long-lived branches.

“With trunk-based development, no branch lives longer than a day.”

CoreDevOps

topic branch

A branch for a single feature or fix, merged back through a pull request and then deleted. Short-lived ones are healthy; branches that live for weeks drift away from main and make merging painful.

“Your feature branch is three weeks old; rebase it before it drifts further.”

Core

A monorepo keeps many projects in one repository (Google, Meta): atomic cross-project changes and shared tooling, but it needs serious build tooling such as Bazel or Nx. A polyrepo setup gives each service its own repository: clear ownership and independent pipelines, but cross-repo changes and version drift hurt.

“In the monorepo, renaming that API across 30 services is one PR.”

CorePlatform

A commit message convention of type(scope): description, such as feat(api): add pagination or fix: handle empty input, plus chore, docs and refactor, with BREAKING CHANGE marking major changes. Tools read the messages to generate changelogs and pick the next version automatically.

“Use feat: and fix: prefixes; semantic-release reads them to bump the version.”

CoreDevOps

Scripts Git runs automatically at moments such as pre-commit, commit-msg or pre-push. The pre-commit framework manages shared hooks for linting, formatting and secret scanning, catching problems before code leaves your laptop. Hooks can be skipped, so CI must enforce the same checks.

“The pre-commit hook blocked my commit; it found an AWS key in the diff.”

CoreDevOps

GPG, SSH signing

Commits signed with your cryptographic key so the platform can verify they came from you, shown as Verified on GitHub. Without signing, anyone can put any name and email on a commit. Security-sensitive repos often require it through branch protection.

“Branch protection requires signed commits, so set up SSH signing first.”

CoreSecurity

Large File Storage

A Git extension that stores large binaries (models, datasets, media) outside normal history and keeps small pointer files in the repo. Plain Git handles big binaries badly because every version stays in history forever. Hugging Face model repositories use it.

“Track the model weights with Git LFS or every clone will take forever.”

CoreMLOps

A binary search through history to find the commit that introduced a bug: mark one good and one bad commit, test the midpoints, and Git narrows it down in about log2(n) steps. It can be fully automated with a test script.

“git bisect between last week's tag and HEAD found the bad commit in six steps.”

Core

Git's local record of everywhere HEAD and your branches have pointed, including commits no longer on any branch. It's the safety net for recovering lost work after a bad reset or rebase.

“Don't panic about the reset; find the old commit in the reflog.”

Core

git commit --amend

Changing the most recent commit, its message or its contents, instead of adding a new one. It rewrites the commit's hash, so only amend commits you haven't shared, or force-push your own branch afterwards.

“Forgot a file? Stage it and amend the last commit.”

Core

merge train

Lines up approved PRs, tests each against the latest main plus the PRs ahead of it, then merges them in order, so a PR that passed on its own branch can't break main. GitHub merge queue and GitLab merge trains provide it.

“Main kept breaking from conflicting PRs, so we turned on the merge queue.”

CoreDevOps

stacked diffs

Splitting a large change into a chain of small dependent pull requests, each building on the previous one, so reviews stay small and work isn't blocked waiting. Popular at Meta and supported by tools such as Graphite.

“I split the migration into four stacked PRs so you can review them one at a time.”

Core

Applying open-source practice inside a company: any team can read others' code and contribute changes by pull request, with the owning team reviewing. It reduces duplicated effort and waiting on other teams' backlogs.

“Don't wait for their backlog; it's inner source, so send them a PR.”

CoreLeadership

Application Programming Interface

A defined contract that lets one piece of software use another without knowing its internals: the operations, their inputs and outputs, and the rules. Web APIs (REST, GraphQL, gRPC) connect services over a network; library APIs connect code to code. Nearly all cloud and DevOps tooling is driven through APIs.

“Everything in the cloud console is just a UI over the API.”

Core

route

A specific URL and method where an API accepts requests, such as GET /v1/orders/{id}. Also used loosely for the address of any service: the model endpoint, the database endpoint.

“The health endpoint is GET /healthz; point the load balancer at it.”

Core

RESTful API

The most common style of web API: resources identified by URLs (/users/42), acted on with HTTP methods, stateless requests and standard status codes, usually with JSON bodies. Simple, cacheable and understood by every tool.

“Keep it RESTful: POST /orders creates, GET /orders/{id} reads.”

Core

A query language for APIs where the client asks for exactly the fields it needs, in one request, against a single typed endpoint. It avoids over-fetching and round trips but is harder to cache and rate-limit, and naive resolvers cause N+1 queries.

“The mobile app uses GraphQL so one request fetches the user, orders and addresses.”

Core

Google's high-performance remote procedure call framework: services and messages are defined in Protocol Buffers and client and server code is generated for many languages. It runs over HTTP/2 with binary encoding, streaming and deadlines, and is popular for internal service-to-service calls.

“Internal calls use gRPC; only the public API is REST.”

Core

protobuf

Google's language-neutral binary serialization format, defined by a schema in .proto files. Smaller and faster than JSON, strictly typed, with rules for evolving schemas safely, such as never reusing a field number. Used by gRPC and many data systems.

“Never reuse a protobuf field number; old clients will misread the data.”

CoreData

Remote Procedure Call

Calling a function on another machine as if it were local: the framework ships the call over the network and returns the result. gRPC, Thrift and JSON-RPC are RPC frameworks. The catch is that the network makes local-looking calls slow and unreliable, so every RPC needs a timeout.

“It looks like a local call, but it's an RPC; give it a deadline.”

Core

An HTTP callback: a service calls your URL when an event happens (a push to GitHub, a successful payment) so you don't have to poll. Receivers should verify signatures, be idempotent because deliveries can repeat, and acknowledge quickly.

“GitHub sends a webhook on every push, which triggers the pipeline.”

CoreDevOps

long polling

Polling means the client keeps asking whether anything is new: simple but wasteful and laggy. Push means the server sends updates as they happen, through webhooks, WebSockets or server-sent events. Long polling holds a request open until there is news.

“Stop polling every second; subscribe and let the server push.”

Core

SSE

A simple standard for a server to stream a series of text events to a client over one long-lived HTTP response. One-way, auto-reconnecting and proxy-friendly; it's how most LLM APIs stream tokens as they are generated.

“The chat UI streams tokens over SSE, so turn off response buffering in nginx.”

CoreLLMOps

Ways to change an API without breaking existing clients: a version in the URL (/v2/), a version header, or strictly additive changes. A new major version signals breaking changes, and old versions get a deprecation period.

“The new response shape is breaking, so it goes in /v2 and /v1 stays for six months.”

Core

cursor pagination

Returning large result sets in pages. Offset pagination (?page=3) is simple but slow and inconsistent on large, changing data; cursor pagination (?after=token) is stable and efficient. Clients must keep following pages to the end.

“The export missed records because it read only the first page; follow the next cursor.”

Core

A front door for APIs that handles cross-cutting concerns in one place: routing to backend services, authentication, rate limiting, request transformation, caching and analytics. Examples: Kong, Apigee, AWS API Gateway, Envoy-based gateways.

“Put auth and rate limits in the gateway instead of in every service.”

CoreCloud

Capping how many requests a client may make in a time window, such as 100 per minute, to protect a service from overload and abuse. Excess requests get 429 Too Many Requests, often with a Retry-After header. Common algorithms: token bucket, leaky bucket, fixed or sliding window.

“The provider is returning 429s; add backoff and respect Retry-After.”

CoreSRESecurity

Swagger

A standard machine-readable format (YAML or JSON) describing REST APIs: endpoints, parameters, schemas and auth. It generates docs, client SDKs, mocks and tests; Swagger is the older name and toolset. Design-first teams write the spec before the code.

“Update the OpenAPI spec and the client SDK regenerates automatically.”

Core

The promise an API makes: its operations, request and response formats, error codes and behavior. Consumers depend on it, so changing it carelessly breaks them; contract tests check that both sides keep it.

“Adding a required field breaks the contract for every existing client.”

Core

backward compatibility

A change that makes existing clients, configs or integrations stop working: removing a field, renaming an endpoint, changing a type or default. Backward compatible means old clients keep working with the new version. Breaking changes need a new major version and a migration path.

“Renaming the field is breaking; add the new one and deprecate the old.”

Core

An application built and deployed as one unit, all features in one codebase and process. Simple to develop, test and deploy at first; harder to scale teams and components independently as it grows. A well-structured monolith is often the right place to start.

“Start with a monolith and split services out only for a real reason.”

Core

One deployable application with strong internal boundaries between modules: separate packages, clear interfaces, no reaching into another module's data. It delivers much of the design clarity of microservices without the cost of running a distributed system.

“One deploy, but each domain owns its module and its tables.”

Core

An architecture that splits an application into many small services, each owning one business capability and its data, deployed independently and talking over the network. It enables team autonomy and independent scaling at the price of distributed-systems complexity: network failures, observability, data consistency and operational load.

“Each microservice has its own pipeline and its own database.”

CoreDevOps

SOA, ESB

The 2000s predecessor of microservices: business functions exposed as reusable services, often wired through an enterprise service bus (ESB) and SOAP. Microservices kept the services and dropped the central bus and heavyweight standards.

“It's old-school SOA; everything goes through the ESB.”

Core

A strict XML-based protocol for web services with formal contracts (WSDL) and built-in standards for security and transactions. Mostly replaced by REST and gRPC but still common in banking, insurance and government integrations.

“The bank's API is SOAP, so we need the WSDL and XML envelopes.”

Core

EDA

Services communicate by publishing events (OrderPlaced) instead of calling each other; interested services subscribe and react. It decouples producers from consumers and absorbs spikes, but flows become harder to trace, and consumers must handle duplicates and ordering.

“Billing just listens for OrderPlaced; the order service doesn't know billing exists.”

CoreData

A buffer where producers put messages and consumers take them off to process asynchronously, each message usually handled by one consumer. It smooths spikes, allows retries and decouples services. Examples: RabbitMQ, Amazon SQS, Google Cloud Tasks, Celery or Sidekiq on Redis.

“Put image resizing on a queue so the upload request returns instantly.”

CoreData

publish–subscribe

A messaging pattern where publishers send messages to a topic and every subscriber gets its own copy, without publishers knowing who listens. Kafka, Google Pub/Sub, SNS and NATS all offer it. In a plain queue, by contrast, each message goes to one consumer.

“Publish the event once; analytics, email and search each subscribe.”

CoreData

Kafka, RabbitMQ

Server software that receives, stores and routes messages between producers and consumers: RabbitMQ (classic queues, flexible routing), Apache Kafka (a durable, replayable distributed log), NATS, plus managed cloud services. Its durability and delivery guarantees shape your whole design.

“Kafka keeps seven days of messages, so a new consumer can replay the week.”

CoreData

Storing every change to an entity as an immutable sequence of events (deposited 100, withdrew 30) instead of only its current state, which is rebuilt by replaying the events. It gives a perfect audit trail and time travel, at the cost of complex schema evolution and queries.

“The ledger is event-sourced, so we can rebuild any account as of any date.”

CoreData

Command Query Responsibility Segregation

Separating the model that handles writes (commands) from the one that serves reads (queries), often in different stores tuned for each and synced asynchronously. Useful for complex domains or very lopsided read and write loads; overkill for simple CRUD.

“Writes go to Postgres and reads come from a denormalized search index: classic CQRS.”

CoreData

Running a business transaction that spans several services as a series of local transactions, each with a compensating action that undoes it if a later step fails (cancel the hotel if the flight booking fails). It replaces distributed transactions in microservices and is coordinated by events or by an orchestrator.

“Payment failed, so the saga ran its compensation and released the reserved stock.”

Core

client-side, server-side

The frontend is what users see and touch (web UI, mobile app), running in the browser or on the device. The backend is the server side: APIs, business logic, databases, background jobs. Full-stack engineers work on both.

“It's a backend bug; the API returns the wrong total and the frontend just shows it.”

Core

BFF

A dedicated backend layer per client type (web, mobile, partners) that gathers and shapes data from many services exactly as that client needs it, keeping client-specific logic out of the core services.

“The mobile BFF turns five service calls into one response for the home screen.”

Core

A stateless service keeps no client data in its own memory between requests, so any instance can serve any request and instances can be added or killed freely. A stateful service holds data that must survive (databases, in-memory sessions) and needs careful scaling, failover and upgrades.

“Keep the API stateless and put sessions in Redis, so we can kill any pod at any time.”

CoreDevOps

session affinity

A load balancer setting that sends all of one client's requests to the same backend, usually via a cookie. A workaround for apps that keep sessions in memory; it hurts load balancing and failover, so storing sessions externally is the better fix.

“Logins break when we scale because the app needs sticky sessions; move sessions to Redis.”

Core

DDD

Eric Evans' approach of modeling software around the business domain, using the experts' own words (the ubiquitous language) and splitting a large system into bounded contexts. Widely used to decide microservice boundaries.

“Talk to the finance team and use their terms; that's the heart of DDD.”

CoreLeadership

A DDD term for a boundary inside which a model and its words have one consistent meaning. Customer in billing may mean something different from customer in support, so each context owns its own model; good service boundaries usually follow bounded contexts.

“Billing and support are separate bounded contexts, so don't share one Customer table.”

CoreLeadership

ports and adapters, clean architecture

Keeping core business logic independent of the outside world: the core defines ports (interfaces), and adapters plug in databases, queues, web frameworks and third-party APIs. The core becomes easy to test and the infrastructure swappable; onion and clean architecture are close relatives.

“With ports and adapters, moving from MySQL to Postgres touches one adapter.”

Core

n-tier, MVC

Organizing an application into layers with separate jobs (presentation, business logic, data access), each talking only to the layer below. MVC (model-view-controller) is the classic web version; the three-tier web, app and database stack is its infrastructure twin.

“Classic three-tier: load balancer and web servers, app servers, then the database.”

Core

12-factor

Heroku's methodology for portable, cloud-friendly services: one codebase, explicit dependencies, config in the environment, backing services as attached resources, separate build, release and run stages, stateless processes, port binding, scaling through processes, fast startup and graceful shutdown, dev/prod parity, logs as event streams, admin tasks as one-off processes.

“Config in env vars and logs to stdout; just follow twelve-factor.”

CoreDevOpsPlatform

Running a helper process next to the main application container, in the same Kubernetes pod, to add capabilities without changing the app: proxies such as Envoy, log shippers, secret fetchers, monitoring agents. The sidecar shares the app's network and storage.

“mTLS is handled by the Envoy sidecar, so the app code doesn't change.”

CoreDevOps

Replacing a legacy system gradually: put a routing layer in front, build new functionality as new services, and move traffic over piece by piece until the old system can be switched off. Named after a vine that slowly envelops its host tree; far safer than a big-bang rewrite.

“We're strangling the monolith; checkout already routes to the new service.”

CoreLeadership

ACL

A translation layer between your clean domain model and a legacy or external system with a messy or foreign model, so its concepts never leak into your code. Common during migrations and third-party integrations.

“Wrap the old ERP in an anti-corruption layer so its strange field names never reach our services.”

Core

sync, async

Synchronous: the caller sends a request and waits for the answer (HTTP, gRPC); simple, but latency and failures cascade along the chain. Asynchronous: the caller sends a message and moves on (queues, pub/sub); more resilient and scalable, harder to trace and debug.

“With six services in a synchronous chain, one slow service makes every request slow.”

Core

Two ways to coordinate a multi-step workflow across services. Choreography: each service reacts to events and emits its own, with no central controller, which is decoupled but hard to see end to end. Orchestration: a central coordinator (Temporal, Step Functions, Airflow) tells each step what to do, which is visible and controllable but central.

“The refund flow has seven steps; orchestrate it so we can see where it's stuck.”

CoreDevOps

The anti-pattern of microservices so tightly coupled (shared databases, lockstep deploys, chains of synchronous calls) that they carry all the costs of distribution and none of the independence. If you can't deploy one service without the others, you have one.

“Forty services that must all deploy together is a distributed monolith.”

Core

tenant

One system serving many customers (tenants) whose data and configuration are kept apart. Designs range from shared everything with a tenant ID column to a separate database or cluster per tenant, trading cost for isolation. Failures can leak data between customers, and noisy tenants can slow down the rest.

“Large enterprise customers get a dedicated database; everyone else is multi-tenant.”

CoreCloudPlatform

NFRs, quality attributes

Requirements about how a system behaves rather than what it does: availability, latency, scalability, security, durability, maintainability, cost, compliance, observability. They shape the architecture far more than features do.

“The feature list is fine; what are the NFRs for latency, uptime and data residency?”

CoreLeadership

Designing a whole system's architecture to meet functional and non-functional requirements: components, data flow, storage, scaling, failure handling and trade-offs. Also a standard interview round, such as design a URL shortener.

“In the system design round, start with requirements and scale estimates before drawing boxes.”

CoreLeadership

A unique, client-generated ID sent with a request (often an Idempotency-Key header) so the server can recognize retries of the same operation and return the original result instead of doing it twice. Essential for payments and any POST a client may retry.

“The client retried after a timeout, and the idempotency key prevented a double charge.”

CoreSRE

cells

Splitting a system into many independent, identical copies (cells), each serving a subset of customers with its own full stack, so a failure or bad deploy reaches only one cell's users. Used by AWS, Slack and others to cap the blast radius.

“A bad config took down cell 4, so only 3% of customers noticed.”

CoreSRE

A way for a slow consumer to make producers slow down instead of drowning: bounded queues that block, flow-control windows, 429 responses, reactive streams. Without it, queues grow until memory runs out or latency explodes.

“The consumer can't keep up and nothing applies backpressure, so the queue just grows.”

CoreSRE

A culture and set of practices that brings software development (Dev) and IT operations (Ops) together so teams deliver changes quickly, safely and reliably. It rests on shared ownership, automation, fast feedback, measurement and continuous improvement. It isn't a tool, although DevOps engineer is now a common job title.

“DevOps isn't buying Jenkins; it's devs and ops owning delivery together.”

DevOps

Dev vs Ops silos

The traditional split where developers throw code over the wall to an operations team that must keep it running without understanding it, while devs are rewarded for change and ops for stability. DevOps exists to tear that wall down.

“Before DevOps, a deploy was a ticket thrown over the wall to ops.”

DevOps

A framework for assessing DevOps adoption: Culture (shared responsibility), Automation (pipelines, IaC), Lean (small batches, less waste), Measurement (metrics and feedback) and Sharing (knowledge, tools, blameless learning).

“We're strong on automation but weak on sharing, in CALMS terms.”

DevOpsLeadership

From The Phoenix Project and The DevOps Handbook. The First Way is flow: fast, smooth movement of work from dev to production. The Second Way is feedback: fast signals from production back to developers. The Third Way is continual learning and experimentation.

“Adding canary metrics to the pipeline is the Second Way in practice.”

DevOpsLeadership

Four Keys

Four delivery measures from the DORA research program (the book Accelerate): deployment frequency, lead time for changes, change failure rate and time to restore service (now called failed deployment recovery time). Elite teams deploy on demand, rarely fail and recover in under an hour; the research shows speed and stability rise together.

“Deployment frequency is weekly, but lead time is 12 days, and that's the real problem.”

DevOpsSRELeadership

How often an organization successfully releases to production, one of the two DORA throughput metrics. Higher frequency usually means smaller and safer changes; elite performers deploy on demand, many times a day.

“We moved from monthly releases to daily deploys and incidents went down.”

DevOps

The time from a change being committed to it running successfully in production, a DORA throughput metric. Long lead times usually come from waiting on reviews, queues, manual approvals and batched releases, not from writing code.

“Commit-to-prod lead time is nine days, and seven of them are waiting on the CAB.”

DevOps

CFR

The percentage of deployments that cause a production failure needing a rollback, hotfix or patch, a DORA stability metric. Small batches, good tests and progressive delivery keep it low.

“Change failure rate fell to 5% after we added canary analysis.”

DevOpsSRE

failed deployment recovery time

How long it takes to recover from a production failure, a DORA stability metric. Fast rollback, good observability, feature flags and practiced incident response keep it short; recovering in minutes matters more than never failing.

“We can't prevent every bad deploy, but we can make rollback a two-minute button.”

DevOpsSRE

Moving testing, security, performance and compliance checks earlier in the lifecycle, toward the developer, where problems are cheaper and faster to fix, instead of discovering them in a late QA or security phase.

“Shift left: run the dependency scan on every PR, not before the quarterly release.”

DevOpsSecurity

Validating in production or with production traffic, using canary releases, feature flags, A/B tests, chaos experiments and observability. It complements shift left, because some problems only appear with real users at real scale.

“Staging can't reproduce real traffic, so we shift right with a 1% canary.”

DevOpsSRE

service ownership

Werner Vogels' principle at Amazon: the team that builds a service also operates it in production, including the pager. It creates a direct feedback loop, because teams feel the pain of unreliable code and fix it.

“There's no separate ops team for this service; you build it, you run it.”

DevOpsSRE

Replacing repetitive manual work such as builds, tests, deployments, provisioning and patching with code and tools, so it becomes fast, consistent and auditable. A good rule of thumb: the third time you do something by hand, automate it.

“Don't SSH in and edit configs by hand; automate it so it's repeatable.”

DevOps

X as code

Defining infrastructure, configuration, pipelines, policies, dashboards, alerts and docs as version-controlled code, so they get review, history, testing and automation like application code.

“The dashboards are code too, so a bad change is just a reverted PR.”

DevOpsPlatform

The cycle of acting, observing the result and adjusting. DevOps aims for short loops at every level: seconds for linting, minutes for CI, hours for canaries, days for user metrics. The faster the loop, the faster you learn and the cheaper mistakes are.

“CI takes 50 minutes, so devs batch up changes; we need a tighter feedback loop.”

DevOpsLeadership

batch size

Delivering work in small increments instead of large releases. Small changes are easier to review, test, deploy, debug and roll back, and they cut risk and lead time. A core Lean idea and one of the strongest drivers of delivery performance.

“Ship the feature behind a flag in five small PRs, not one giant one.”

DevOpsLeadership

VSM

Drawing every step from idea or commit to running in production, with the time spent working versus waiting at each step, to expose bottlenecks and waste. It usually shows that most lead time is spent waiting in queues.

“The value stream map showed code waits four days for a test environment.”

DevOpsLeadership

Lean, muda

In Lean thinking, anything that adds no value for the customer: waiting, handoffs, half-finished work, unneeded features, task switching, defects and rework. DevOps borrowed Lean from Toyota's manufacturing to remove waste from software delivery.

“Three approval handoffs for a config change is pure waste.”

DevOpsLeadership

A team or department working in isolation with its own goals, tools and knowledge, communicating poorly with others. Silos create handoffs, blame and slow delivery; cross-functional teams and shared metrics break them down.

“The network team is a silo; every firewall change takes three weeks.”

DevOpsLeadership

A team with all the skills needed to deliver and run a product end to end (development, testing, operations, security, product, design), which cuts handoffs and dependencies on other teams.

“Each squad is cross-functional, so they ship without waiting on central ops.”

DevOpsLeadership

A family of iterative development approaches based on the 2001 Agile Manifesto: deliver working software in small increments, collaborate with customers, respond to change and seek frequent feedback. Scrum and Kanban are the common frameworks; DevOps extends agile thinking into delivery and operations.

“We're agile on paper, but releasing quarterly defeats the point.”

DevOpsLeadership

An agile framework built on fixed-length sprints, with defined roles (product owner, scrum master, developers), events (sprint planning, daily standup, sprint review, retrospective) and artifacts (product backlog, sprint backlog).

“Pull the bug into the sprint only if the product owner agrees.”

DevOpsLeadership

iteration

A fixed time-box, usually one or two weeks, in which a team completes a planned set of work, ending with a review and a retrospective. The sprint goal is the one thing the sprint must achieve.

“That won't fit in this sprint; plan it for the next one.”

DevOpsLeadership

daily scrum

A short daily meeting, around 15 minutes, where each person shares what they did, what they'll do next and what's blocking them. Its point is coordination and surfacing blockers, not reporting status to a manager.

“Raise the blocked deploy in standup so someone can help.”

DevOpsLeadership

retro

A regular team meeting, usually at the end of a sprint, to reflect on what went well, what didn't and what to change. The engine of continuous improvement, and it only works if the action items get done.

“In the retro we agreed to cap PRs at 400 lines.”

DevOpsLeadership

WIP limit

A flow-based method that shows work on a board (to do, in progress, done) and limits work in progress (WIP) per column to keep work moving and expose bottlenecks. Common for ops, support and platform teams whose work arrives unpredictably.

“The review column is at its WIP limit, so stop starting and start finishing.”

DevOpsLeadership

product backlog, refinement

The prioritized list of work a team might do: features, bugs, tech debt and improvements. Refinement (grooming) keeps it ordered, estimated and clear, so the top items are always ready to start.

“Add the flaky test to the backlog and we'll prioritize it in planning.”

DevOpsLeadership

epic, ticket

A short description of a feature from the user's side: as a (user), I want (goal) so that (benefit), plus acceptance criteria. Large stories are grouped into epics, and individual work items are usually just called tickets.

“Split that epic into stories small enough for one sprint.”

DevOpsLeadership

velocity

A relative unit for estimating the size and complexity of work, often on a Fibonacci scale (1, 2, 3, 5, 8, 13), instead of hours. Velocity is the points a team completes per sprint, useful for planning but not for comparing teams or judging people.

“It's an 8-pointer; the migration has a lot of unknowns.”

DevOpsLeadership

DoD

A team's shared checklist for when work counts as complete: reviewed, tested, documented, deployed to staging, with monitoring and alerts in place. It prevents done except for the testing.

“It isn't done until the alerts and runbook exist; that's in our definition of done.”

DevOpsLeadership

Running operations from chat (Slack, Teams) through bots that execute commands, show results and post alerts in shared channels, such as /deploy api staging. It makes ops work visible, collaborative and auditable; LLM-powered assistants are its latest form.

“Deploys go through the ChatOps bot, so the whole channel sees them.”

DevOpsSREAIOps

A team's shared belief that it's safe to take interpersonal risks: admit mistakes, ask questions, raise concerns and challenge ideas without fear of punishment or humiliation. Google's Project Aristotle found it the strongest predictor of team effectiveness, and blameless culture depends on it.

“Nobody reported the near miss because people didn't feel safe to.”

DevOpsLeadership

generative culture

Ron Westrum's classification of organizations by how information flows: pathological (power-oriented, messengers get shot), bureaucratic (rule-oriented) and generative (performance-oriented, information flows freely, failure leads to inquiry). DORA research found generative cultures predict better delivery and business outcomes.

“A generative culture treats bad news as information, not as someone to blame.”

DevOpsLeadership

stream-aligned, platform, enabling team

Skelton and Pais' model of four team types (stream-aligned teams delivering business value, platform teams offering self-service internal services, enabling teams coaching new skills, complicated-subsystem teams owning hard specialist parts) and three interaction modes (collaboration, X-as-a-service, facilitating), designed around limiting cognitive load.

“Make the platform X-as-a-service so stream-aligned teams don't have to file tickets.”

DevOpsPlatformLeadership

The mental effort a team needs to understand and operate everything it owns. When a team must master too many tools, systems and domains, delivery slows and errors rise; platform engineering and Team Topologies try to keep it manageable.

“Asking app teams to also run Kafka, Vault and Istio is too much cognitive load.”

DevOpsPlatformLeadership

Building security into every stage of delivery (design, code, build, deploy, run) as a shared responsibility, mostly through automation: dependency and secret scanning, SAST, image scanning, policy as code, runtime protection. Security becomes a fast feedback loop instead of a late gate.

“DevSecOps means the scanner runs in the pipeline, not a security PDF at the end.”

DevOpsSecurity

SPACE framework

How effectively engineers can deliver value. Single numbers such as lines of code or commit counts are harmful; frameworks like SPACE (satisfaction, performance, activity, communication, efficiency) and DevEx (flow, feedback loops, cognitive load) combine surveys with system data.

“Don't measure productivity by commit count; survey the friction and measure lead time.”

DevOpsPlatformLeadership

Turning source code into something runnable: resolving dependencies, compiling, generating code, bundling and packaging into a binary, archive or container image. The build is broken means this step, or its tests, is failing.

“The build fails on main; someone merged a missing import.”

DevOpsCore

Compiling turns source code into machine code or bytecode (Go, Java, C++). Transpiling turns it into other source code at a similar level, such as TypeScript into JavaScript.

“The TypeScript transpiles to JavaScript during the build step.”

Core

Make, Maven, Gradle, npm scripts, Bazel

Automates the build: dependencies, compilation, tests and packaging. Each ecosystem has its own: Maven and Gradle (Java), npm, pnpm and yarn scripts (JavaScript), Cargo (Rust), go build, Poetry and uv (Python), plus general-purpose Make and Bazel.

“Run gradle build locally before pushing; CI runs the same task.”

DevOpsCore

make

A file of named targets and their commands for the make tool. Built for compiling C, it's now widely used as a simple task runner (make test, make lint, make docker-build) that gives every project the same entry points.

“Just run make deploy-staging; the Makefile wraps all the flags.”

DevOpsCore

Code plus metadata (name, version, dependencies) distributed through a package manager or registry: an npm package, a Python wheel, a .deb or .rpm, a Helm chart. Packaging makes code installable and versioned.

“Publish the shared client as an internal package instead of copy-pasting it.”

CoreDevOps

package-lock.json, poetry.lock, go.sum

Records the exact version, and often the hash, of every dependency resolved at install time, including transitive ones. Committing it makes builds reproducible: every developer and CI get the same versions. In CI, install from the lockfile (npm ci, not npm install).

“Commit the lockfile; CI pulled a new minor version and broke the build.”

DevOpsCoreSecurity

SemVer

The MAJOR.MINOR.PATCH scheme (2.4.1): bump MAJOR for breaking changes, MINOR for backward-compatible features, PATCH for backward-compatible fixes. Pre-releases look like 3.0.0-rc.1. Dependency ranges such as ^2.4.0 assume everyone follows it, which not everyone does.

“Removing that flag is a breaking change, so it's 3.0.0, not 2.5.0.”

DevOpsCore

Locking a dependency, base image, tool or provider to an exact version or digest instead of a floating range or latest, so builds don't change underneath you. Pinned versions must then be updated deliberately, usually by bots such as Dependabot or Renovate.

“Pin the Terraform provider; its new major release changed the defaults.”

DevOpsSecurity

The pain of conflicting dependency requirements: library A needs version 1 of X while B needs version 2, deep transitive trees, upgrades that cascade. Lockfiles, isolated environments and small regular updates keep it contained.

“Upgrading one package pulled in forty others; welcome to dependency hell.”

DevOpsCore

indirect dependency

A dependency of your dependency. Most code in a typical application arrives this way without anyone choosing it, which is why vulnerability scans and SBOMs must cover the whole tree.

“We don't use log4j directly; it came in through the reporting library.”

DevOpsSecurity

build artifact

The stored, deployable output of a build: a binary, JAR, wheel, npm package, zip, Helm chart or container image. Build it once, give it an immutable version, and promote that same artifact through every environment.

“Don't rebuild for prod; promote the exact artifact that passed staging.”

DevOps

Artifactory, Nexus, package registry

A server that stores and serves versioned artifacts and packages, often also proxying and caching public registries (npm, PyPI, Maven Central, Docker Hub). Examples: JFrog Artifactory, Sonatype Nexus, GitHub Packages, Google Artifact Registry, AWS CodeArtifact.

“Pull dependencies through Artifactory so builds survive a PyPI outage.”

DevOps

incremental build

Reusing outputs from earlier builds when inputs haven't changed, so only what changed is rebuilt: Docker layer caching, Gradle and Bazel caches, dependency caches in CI. It can cut builds from tens of minutes to seconds, but a stale or poisoned cache causes baffling failures.

“Cache node_modules keyed on the lockfile hash and CI drops to three minutes.”

DevOps

deterministic build

A build that produces bit-for-bit identical output from the same source, whenever and wherever it runs. It needs pinned tools and dependencies, fixed timestamps and no hidden network state, and it lets anyone verify a binary really came from the claimed source.

“With reproducible builds we can prove the released binary matches the tagged source.”

DevOpsSecurity

A build fully isolated from the host machine and network: every input (compilers, tools, dependencies) is declared and fetched by the build system, so nothing undeclared can change the result. Bazel is the classic example, and hermeticity is what makes caching trustworthy at scale.

“Builds are hermetic, so a developer's local Python version can't change the output.”

DevOps

changelog

A release is a specific, versioned set of changes made available to users. Release notes or a changelog say what's new, fixed and breaking, so users and support know what to expect; they're often generated from commits and PRs.

“Put the breaking config change in the release notes, in bold.”

DevOps

shared library

Static linking copies library code into the binary, producing a self-contained executable (Go's default). Dynamic linking loads shared libraries (.so, .dll) at run time, saving space but requiring them on the target system. Binaries dynamically linked against glibc often fail on Alpine, which uses musl.

“The binary is statically linked, so it runs on distroless with no libc at all.”

Core

venv, conda

An isolated Python environment with its own interpreter and packages, so projects don't clash over versions (python -m venv .venv). Conda environments do the same for data science; uv and Poetry manage them for you.

“Activate the venv first; you're installing into the system Python.”

CoreMLOps

matrix build

Running the same CI job across many combinations in parallel, such as several language versions, operating systems or CPU architectures, to catch compatibility bugs without writing separate jobs.

“The matrix tests Python 3.10 to 3.13 on Linux and macOS.”

DevOps

Bazel, Nx, Turborepo

Build systems for large monorepos that understand the dependency graph between projects, so they build and test only what a change affects and share remote caches across machines. Without them, every commit rebuilds everything.

“Nx runs tests only for the three packages the PR touches.”

DevOpsPlatform

.whl, .jar, fat JAR

Standard distribution formats. A Python wheel is a pre-built package that installs without compiling; a Java JAR is a zip of compiled classes and resources, and a fat (uber) JAR includes all dependencies too.

“Build a fat JAR so the container needs only a JRE and one file.”

Core

Copying dependencies' source code into your own repository (a vendor/ directory) instead of downloading it at build time. It guarantees availability and exact versions at the cost of a bigger repo and manual updates; common in Go.

“We vendor dependencies so builds work even if an upstream repo disappears.”

DevOps

dependency update bots

Bots that watch your dependencies and open pull requests to update them, with changelogs and security advisories attached. They keep pinned versions fresh; grouping and auto-merge rules stop the PR flood.

“Renovate opened 30 PRs; turn on grouping so minor bumps arrive as one.”

DevOpsSecurity

Checking that software behaves as intended, and keeps doing so as it changes, by running it against known inputs and expected outputs, automatically or by hand. Automated tests are the safety net that makes continuous delivery possible.

“No tests, no confidence; no confidence, no continuous deployment.”

CoreDevOps

Quality Assurance

The activities that make sure software meets its quality bar: test planning, manual and automated testing, and process improvement. In modern teams quality is everyone's job, and QA engineers focus on automation, strategy and exploratory testing.

“QA found the bug in the payment flow before release.”

DevOps

A small, fast test of one function or class in isolation, with external dependencies replaced by fakes. It runs in milliseconds, so you can have thousands and run them on every change; the base of the test pyramid.

“Add a unit test for the date parser that covers leap years.”

CoreDevOps

Checks that several components work together for real: your code with an actual database, broker or neighboring service, often started in containers with Testcontainers. Slower than unit tests but catches wiring, configuration and contract problems.

“Unit tests pass, but the integration test shows the SQL breaks on Postgres 16.”

CoreDevOps

E2E test

Drives the whole system as a user would, through the UI or public API across all the real services, with tools such as Playwright, Cypress or Selenium. The most realistic confidence, but slow, brittle and expensive, so keep a small set for critical journeys.

“The E2E suite clicks through signup, checkout and payment every night.”

CoreDevOps

A guide to balancing tests: many fast unit tests at the base, fewer integration tests in the middle and very few slow end-to-end tests at the top. The inverted ice-cream cone of mostly manual and E2E tests is the anti-pattern.

“Our pyramid is upside down: 400 E2E tests and almost no unit tests.”

CoreDevOps

A quick, shallow check that the essentials work at all, usually run right after a deploy: the app starts, the homepage loads, login works, the health endpoint returns 200. A failing smoke test should trigger an automatic rollback.

“Deploy finished and smoke tests passed, so the canary moves to 10%.”

DevOpsSRE

A narrow, quick check that one specific fix or change works before deeper testing. Often confused with smoke testing: smoke tests check the whole system broadly, sanity tests check one area narrowly.

“Quick sanity test on the fixed endpoint before the full regression run.”

DevOps

regression suite

A test proving that previously working behavior still works after a change. Every fixed bug deserves one so it can't quietly return; the regression suite is the collection run before releases.

“Write a regression test for that bug so it can never come back.”

CoreDevOps

UAT, user acceptance testing

Testing that a feature meets its business requirements and acceptance criteria, ideally from the user's point of view. In UAT, real users or business stakeholders sign off a release before go-live, still standard in enterprise and IT-services projects.

“The client's UAT sign-off is the last gate before go-live.”

DevOps

performance test

Measuring how a system behaves under expected and peak traffic (latency, throughput, resource use) to find bottlenecks before users do. Tools: k6, JMeter, Locust, Gatling.

“The load test shows p99 doubles past 800 RPS; the DB connection pool is the limit.”

SREDevOps

endurance test

Stress tests push beyond expected capacity to see how the system fails and recovers. Soak (endurance) tests hold steady load for hours to expose memory leaks, connection leaks and disk growth. Spike tests throw sudden bursts at autoscaling and queues.

“The soak test found a leak that only appears after six hours.”

SRE

TDD

Write a failing test first, then just enough code to pass it, then refactor: red, green, refactor. It produces testable designs, and the tests double as executable documentation.

“With TDD, the edge cases become tests before they become bugs.”

Core

BDD, Gherkin

An extension of TDD where tests describe behavior in near-plain language shared by business and engineers, often in Gherkin: Given a logged-in user, When they add an item, Then the cart shows 1 item. Tools: Cucumber, Behave.

“The product owner wrote the Gherkin scenarios and we automate them.”

Core

test double

Stand-ins for real dependencies in tests. A stub returns canned answers; a mock also records and verifies how it was called; a fake is a working lightweight version, such as an in-memory database. Overusing mocks gives passing tests while the real integration is broken.

“Mock the payment gateway in unit tests, but keep one real sandbox test.”

Core

The setup a test needs to start from a known state (sample data, config, temporary files, database rows) plus the cleanup afterwards. Frameworks like pytest provide reusable, injectable fixtures.

“Use the db fixture so every test starts with a clean schema.”

Core

A test that passes or fails without any code change, because of timing, test order, shared state, network calls or randomness. Flaky tests train people to ignore red builds; quarantine them and fix the root cause.

“It's just flaky, rerun it, said right before a real bug shipped.”

DevOpsCore

test coverage

The share of code lines or branches your tests execute. Good for finding untested areas, but high coverage doesn't mean good tests: code can run without anything meaningful being asserted. Teams often block PRs that lower coverage.

“Coverage is 90%, yet nothing checks the error paths.”

CoreDevOps

A statement inside a test that checks an expected condition, such as the response status being 200. A test with no meaningful assertions only proves the code didn't crash.

“The test calls the function but asserts nothing, so it can never fail.”

Core

consumer-driven contracts, Pact

Verifying that a service and its consumers agree on the API without starting the whole system. Consumers record their expectations, and the provider's pipeline checks it still satisfies them; Pact is the common tool. It catches breaking API changes early.

“Contract tests failed: the provider renamed a field the mobile app relies on.”

CoreDevOps

SonarQube, CodeQL, Semgrep

Analyzing source code without running it to find bugs, code smells, complexity, duplication and security issues, from simple linters to deep analyzers such as SonarQube, CodeQL and Semgrep. Often wired in as a CI quality gate.

“Static analysis flagged an unchecked error on the payment path.”

CoreDevOpsSecurity

Conditions a change must meet before it moves on in the pipeline: tests pass, coverage doesn't drop, no new critical vulnerabilities or high-severity findings. It turns standards into consistent automatic checks.

“The quality gate blocks the merge until the critical vulnerability is fixed.”

DevOps

Measuring test quality by planting small bugs (mutants), such as turning > into >=, and checking whether the tests catch them. Surviving mutants reveal weak tests that coverage numbers hide. Tools: Stryker, PIT, mutmut.

“90% coverage, but half the mutants survived; the tests check almost nothing.”

Core

Hypothesis

Instead of hand-picked examples, you state properties that must always hold (sorting twice equals sorting once; decoding an encoded value returns the original) and the framework generates hundreds of random inputs, shrinking any failure to the smallest case.

“Property-based testing found the parser crashes on an empty string with a BOM.”

Core

fuzzing

Feeding a program huge volumes of random or malformed input to find crashes, hangs and security bugs. Coverage-guided fuzzers (libFuzzer, AFL, Go's built-in fuzzing) mutate inputs to reach new code paths; Google's OSS-Fuzz has found thousands of vulnerabilities this way.

“A week of fuzzing the image decoder found a buffer overflow.”

CoreSecurity

golden files

Saving a piece of output (rendered HTML, JSON, a generated manifest) as a reference and failing when future output differs. Quick to write, but risky if people update snapshots without reading the diff.

“The golden-file diff shows the generated manifest lost its resource limits.”

Core

QA environment

An environment set up for testing: shared QA, integration, performance or UAT environments, or ephemeral ones created per pull request. Long-lived shared test environments become bottlenecks and drift away from production.

“Two teams are fighting over the only QA environment again.”

DevOps

A test that depends only on what it sets up itself, with no shared environments, external networks or ordering assumptions, so it gives the same result anywhere, every time. The cure for flakiness at scale.

“Make it hermetic: start Postgres in a container instead of hitting the shared DB.”

CoreDevOps

Deliberately validating behavior with real production traffic, safely, using feature flags, canaries, dark launches, synthetic transactions and strong observability. It accepts that staging can never fully match production, and it demands fast rollback.

“Staging can't reproduce ten million users, so we test in production behind a flag.”

DevOpsSRE

microbenchmark

A repeatable performance measurement (speed, throughput, memory) under controlled conditions, used to compare implementations or catch performance regressions. Microbenchmarks of tiny code paths are easy to get misleadingly wrong.

“The benchmark shows the new JSON library is three times faster for our payloads.”

CoreSRE

CI

Merging every developer's changes into the shared main branch frequently, at least daily, with each merge automatically built and tested, so integration problems show up within minutes instead of at the end of a project. CI also loosely means the system that runs these builds.

“CI runs the tests on every PR; don't merge until it's green.”

DevOps

CD

Keeping software always releasable: every change that passes the pipeline is ready to go to production at the push of a button, while the decision to deploy stays with people or business timing.

“With continuous delivery, releasing is a business decision, not an engineering project.”

DevOps

One step beyond continuous delivery: every change that passes all automated checks deploys to production automatically, with no manual approval. It needs strong tests, monitoring and automatic rollback.

“We do continuous deployment; merging to main ships to prod in 15 minutes.”

DevOps

CI/CD pipeline

An automated sequence of stages taking a change from commit to production: build, test, scan, package, deploy to staging, verify, deploy to production. Defined as code in the repo and triggered by events such as pushes and tags.

“The pipeline failed at the security-scan stage.”

DevOps

The building blocks of a pipeline. A stage is a phase (build, test, deploy); a job is a unit of work on one runner, often running in parallel with others in its stage; a step is a single command or action inside a job. Exact naming varies by tool.

“The test stage runs three parallel jobs, and the lint job's second step is failing.”

DevOps

agent, executor

The machine, VM or container that executes pipeline jobs. Runners can be hosted by the CI provider or self-hosted in your own network for private access, GPUs or lower cost.

“Jobs are queued because every self-hosted runner is busy.”

DevOps

The event that starts a pipeline: a push, a pull request, a tag, a schedule, a manual click, a webhook from another system, or another pipeline finishing.

“Nightly builds use a schedule trigger; releases trigger on tags.”

DevOps

Defining pipelines in version-controlled files inside the repository (.github/workflows/*.yml, .gitlab-ci.yml, Jenkinsfile) instead of clicking through a UI, so they get review, history and reuse like any other code.

“The pipeline lives in the repo, so your PR can change the build too.”

DevOps

workflow

GitHub's built-in CI/CD. Workflows are YAML files in .github/workflows, triggered by repository events and run on hosted or self-hosted runners, built from reusable actions published in a marketplace. Pin third-party actions to a full commit SHA for security.

“Add a workflow that builds the image and pushes it on every tag.”

DevOps

Jenkinsfile

The long-standing open-source automation server, flexible through thousands of plugins, with pipelines written in a Groovy-based Jenkinsfile. Still very common in enterprises and IT-services companies; plugin upkeep and security are its main pains.

“The client still runs Jenkins, so write a Jenkinsfile, not a GitHub workflow.”

DevOps

.gitlab-ci.yml

GitLab's built-in CI/CD, configured by a .gitlab-ci.yml file of stages and jobs and executed by GitLab Runners, tightly integrated with merge requests, the container registry and environments.

“The MR pipeline runs the tests, then spins up a review app.”

DevOps

build status

Green means the pipeline passed; red means something failed. Keep main green is a core CI rule: when main is red, fixing it is everyone's top priority, because nobody can safely integrate on top of a broken build.

“Main has been red since lunch; who's fixing it?”

DevOps

dev, QA, staging, production

A separate deployment of the system for a purpose: development, testing or QA, staging (a production-like rehearsal) and production (real users). Changes are promoted through them in order. Environments drifting apart is the classic reason something worked in staging.

“Deploy to staging first; if the smoke tests pass, promote to prod.”

DevOps

pre-production, pre-prod

A production-like environment for final checks before release: same configuration, similar infrastructure and data shape, no real users. Its value depends entirely on how closely it matches production.

“It worked in staging because staging has 1% of prod's data.”

DevOps

prod

The live environment serving real users and real data, where changes have real consequences. Access is restricted and audited. The old rule was never test in prod; mature teams test in prod deliberately and safely.

“Never run that script against prod without a backup and a second pair of eyes.”

DevOpsSRE

Deployment installs a new version of code in an environment; release makes a feature available to users. Feature flags separate the two, so you can deploy dark code at any time and release it later to some or all users.

“We deployed on Monday, but the feature isn't released until the flag flips on Thursday.”

DevOps

build once, deploy many

Building an artifact once and moving that identical, immutable artifact through dev, staging and production, changing only configuration. Rebuilding per environment risks shipping something that was never tested.

“Promote the image digest that passed staging; don't rebuild for prod.”

DevOps

Gradually putting a new version into service across instances, regions or users. Rollouts can be watched (kubectl rollout status), paused, resumed or undone.

“Pause the rollout at 25%; error rates are creeping up.”

DevOps

Returning to the previous known-good version after a bad deployment, the fastest and safest first move in most change-caused incidents. It requires keeping old artifacts and making database changes backward compatible.

“Error rate tripled after the deploy; roll back first, investigate second.”

DevOpsSRE

fix forward

Fixing a bad release by quickly deploying a new fix instead of reverting. Sometimes unavoidable, as after an irreversible data migration, but riskier under pressure than a rollback.

“We can't roll back past the migration, so we have to roll forward with a fix.”

DevOpsSRE

An urgent fix deployed outside the normal release cycle to resolve a critical bug or security issue, often built from a release branch and later merged back into main.

“Ship a hotfix for the checkout crash; everything else waits for Thursday.”

DevOps

rolling deployment

Replacing old instances with new ones a few at a time so the service stays up throughout; the default for Kubernetes Deployments, controlled by maxSurge and maxUnavailable. Simple and cheap, but both versions run side by side during the rollout.

“The rolling update replaces two pods at a time so capacity never dips.”

DevOps

Running two identical production environments, blue (current) and green (new). You deploy and test green, then switch all traffic to it at once through the load balancer or DNS, and can switch straight back if something breaks. It costs double capacity during the switch.

“Green passed the smoke tests; flip the load balancer and keep blue warm for an hour.”

DevOps

canary release

Releasing a new version to a small slice of traffic first (1%, then 5%, 25%, 100%) and watching its metrics before going further. If errors or latency rise, only the canary's users are affected and it is rolled back. Named after the canaries that warned coal miners of gas.

“The canary shows 2% errors against a 0.1% baseline; abort the rollout.”

DevOpsSRE

automated canary analysis

Automatically comparing the canary's metrics (errors, latency, saturation, business KPIs) with the baseline using statistics, then promoting or rolling back without a human. Tools include Argo Rollouts, Flagger and Spinnaker's Kayenta.

“Automated canary analysis rolled it back at 3 AM before anyone woke up.”

DevOpsSRE

feature toggle

A runtime switch that turns a feature on or off without deploying, for everyone or for chosen users, regions or percentages. It enables trunk-based development, dark launches, gradual rollouts, experiments and instant kill switches; stale flags become tech debt.

“The new search is behind a flag; enable it for internal users first.”

DevOps

Deploying a feature to production without exposing it to users, sometimes exercising it with real traffic behind the scenes, to test correctness and performance before the visible launch.

“The recommender is dark-launched: it computes results for every request, but nobody sees them yet.”

DevOps

traffic mirroring, shadow traffic

Sending a copy of real production traffic to a new version alongside the live one and comparing the results, while users only ever get the current version's responses. Common for validating rewrites and new ML models.

“The new model runs in shadow mode for a week while we compare its predictions.”

DevOpsMLOps

split testing

Showing different variants to randomly split groups of users and measuring which does better on a chosen metric, with statistical significance. A product experiment built on the same machinery as feature flags.

“The A/B test shows the new checkout lifts conversion by 3%, and it's significant.”

DevOpsData

An umbrella term for releasing gradually with automated control: canaries, feature flags, traffic shifting and metric-driven rollback. It combines continuous delivery with fine-grained control of the blast radius.

“With progressive delivery, a bad change reaches 1% of users for five minutes, not everyone.”

DevOpsSRE

deployment rings

Rolling out to ever-larger groups in order: ring 0 internal staff, ring 1 early adopters, ring 2 a region, ring 3 everyone, with each ring healthy before the next. Used by Microsoft and other companies with huge user bases.

“Ring 0 is our own staff; they find the bugs first.”

DevOps

Deploying without users noticing any interruption. It requires several instances, readiness checks, graceful shutdown with connection draining, and backward-compatible database changes.

“Zero downtime means old pods finish their in-flight requests before they exit.”

DevOpsSRE

Never modifying running servers or containers in place: every change ships as a new artifact on new instances that replace the old ones. It eliminates configuration drift and turns rollback into pointing back at the previous version.

“Don't patch the running pod; build a new image and roll it out.”

DevOps

Releasing on a fixed schedule, such as every second Tuesday: whatever is ready catches the train, and anything else waits for the next one. Predictable for large organizations and mobile apps, but slower than continuous delivery.

“The feature missed the release train, so it ships in two weeks.”

DevOps

A branch cut from main to stabilize one release (release/2.4): only fixes go in while main keeps moving, with fixes cherry-picked between them. Common for versioned products and mobile apps.

“Cherry-pick the fix into release/2.4 and cut a patch.”

DevOps

change freeze

A period when no changes, or only critical ones, may be deployed, typically around big launches, holidays, sale events and financial year-end. It lowers risk but piles up changes for afterwards.

“Code freeze starts Friday for the festive sale.”

DevOpsSRE

CAB

The traditional ITIL group that reviews and approves production changes. DORA research found heavyweight external approval slows delivery without reducing failures, so modern teams rely on peer review, automated checks and small changes, keeping a CAB only for the riskiest work.

“The CAB meets weekly, so every deploy waits up to seven days.”

DevOpsLeadership

manual approval

A pipeline step that pauses until an authorized person approves, typically before production. It provides control and an audit trail; too many gates slow everything down.

“The prod stage has an approval gate, and the on-call lead approves it.”

DevOps

An operating model where the desired state of infrastructure and applications is declared in Git and an agent (Argo CD, Flux) continuously reconciles the live system to match. Every change is a pull request, rollback is a revert, and drift gets corrected automatically.

“With GitOps nobody runs kubectl apply; you merge a PR and Argo CD syncs it.”

DevOpsPlatform

GitOps controllers

The two main GitOps tools for Kubernetes, both CNCF graduated projects. They watch Git repositories of manifests, Helm charts or Kustomize overlays, sync clusters to match, and show drift and health. Argo CD has a rich UI; Flux is lightweight and composable.

“Argo CD shows the app OutOfSync; someone edited the deployment by hand.”

DevOpsPlatform

In push deployment, the CI system connects to the target and deploys, so CI needs production credentials. In pull deployment (GitOps), an agent inside the environment pulls the desired state and applies it, so CI never holds those credentials.

“With pull-based GitOps, our CI runners don't need cluster-admin credentials.”

DevOpsSecurity

desired state

A control loop that keeps comparing the desired state you declared with the actual running state and acts to close any gap. The idea behind Kubernetes controllers, GitOps agents and Terraform-style tools.

“Delete the pod and the reconciliation loop recreates it within seconds.”

DevOpsPlatform

ephemeral environment, review app

A temporary, isolated environment created automatically for each pull request with its own URL and destroyed when the PR closes, so reviewers, QA and product can try changes without fighting over a shared staging.

“Every PR gets a preview environment; click the link in the PR to try it.”

DevOpsPlatform

post-deploy checks

Automated checks right after a deploy confirming the new version is healthy: smoke tests, synthetic checks, and error rate and latency compared with the previous version. A failure triggers automatic rollback.

“Verification failed on latency, so the pipeline rolled back by itself.”

DevOpsSRE

How long a new version runs under real traffic in an environment or ring before the rollout continues, giving slow-burning problems such as leaks, daily batch jobs and rare code paths time to surface.

“Each region gets two hours of bake time before we move to the next.”

DevOpsSRE

RC

A build believed ready for release that is undergoing final testing, versioned like 2.5.0-rc.1. If nothing blocking turns up, the same artifact becomes the final release.

“rc.2 fixes the crash; if QA passes it, it becomes 2.5.0.”

DevOps

pipeline secrets

Credentials pipelines need (cloud keys, registry passwords, tokens), held in the CI system's secret store or fetched from a vault, injected at run time and masked in logs. Leaks through logs, forked PRs or compromised actions are a top supply-chain risk, so short-lived OIDC-based credentials are preferred.

“Don't echo the token into the build log, even for debugging.”

DevOpsSecurity

caching, test sharding

The two big levers for fast pipelines: caching dependencies, image layers and build outputs between runs, and splitting work into parallel jobs (test sharding, matrix builds). Fast pipelines get used properly; a 60-minute pipeline gets bypassed.

“Shard the tests across eight jobs and cache dependencies; CI drops from 40 minutes to 6.”

DevOps

A CI runner you operate on your own machines or cloud account, for private network access, GPUs, special operating systems or lower cost. Harden it and make it ephemeral (one job per runner), because a malicious job on a persistent runner can tamper with later jobs.

“Use ephemeral self-hosted runners so no job can leave anything behind for the next.”

DevOpsSecurity

A lightweight, isolated package holding an application and everything it needs to run (code, runtime, libraries, config) while sharing the host's OS kernel. It starts in milliseconds and runs the same on a laptop, in CI and in production, which ends works on my machine.

“Package the service as a container so it runs the same everywhere.”

DevOps

dockerize

Packaging an application and its dependencies into a container image so it runs consistently anywhere a container runtime exists. Dockerizing an app means writing its Dockerfile, usually the first step towards Kubernetes or modern CI/CD.

“First containerize the app, then we can talk about Kubernetes.”

DevOps

A VM virtualizes hardware and runs a full guest OS: strong isolation, gigabytes in size, minutes to boot. A container virtualizes the OS and shares the host kernel: megabytes, milliseconds to start, weaker isolation. They're often combined, with containers running on cloud VMs.

“Containers share the kernel, so one kernel exploit can reach every container on the node.”

DevOpsCloud

The tool that made containers mainstream in 2013: a CLI and daemon to build images (docker build), run containers (docker run) and push and pull images from registries. Production clusters often use other runtimes such as containerd, but Docker remains the standard developer tool and image format.

“docker build -t api:1.4 . then docker run -p 8080:8080 api:1.4.”

DevOps

Docker image

A read-only, layered template with the filesystem and metadata needed to start a container: base OS files, runtime, dependencies, your app and the default command. Identified by name:tag and by content digest. You build images and run containers from them.

“The image is 1.2 GB; a slim base would cut the pull time.”

DevOps

Containerfile

A text file of instructions for building an image: FROM (base image), RUN (run commands), COPY (add files), ENV, EXPOSE, USER, and CMD or ENTRYPOINT (what to start). Each instruction creates a layer, so ordering matters for caching; hadolint lints it.

“Copy requirements.txt and install before copying the source, so code changes don't bust the dependency cache.”

DevOps

Each Dockerfile instruction produces a filesystem layer; layers stack to form the image and are cached and shared between images. Changing an early layer invalidates all later ones. Deleting a file in a later layer doesn't remove it from the image, so a secret added in any layer stays recoverable.

“Install and clean up in the same RUN, or the cache stays in an earlier layer.”

DevOps

parent image

The image your Dockerfile builds on (FROM python:3.12-slim). It decides your OS packages, much of your size and a large share of your vulnerabilities. Use small, maintained, pinned base images and rebuild regularly to pick up patches.

“Most of our CVEs come from the base image; move to slim or distroless.”

DevOpsSecurity

distroless, Alpine, slim, scratch

Images containing only what the app needs. Distroless images have no shell or package manager; Alpine is a tiny distro built on musl and BusyBox; -slim variants trim Debian; scratch is completely empty, for static binaries. Smaller images pull faster and carry far fewer vulnerabilities, but are harder to debug.

“The distroless image has no shell, so debug it with an ephemeral container.”

DevOpsSecurity

A Dockerfile with several FROM stages: build in a full image with compilers and tools, then copy only the final artifact into a minimal runtime image. Small, secure images with no build tools inside.

“The multi-stage build takes the Go image from 900 MB to 15 MB.”

DevOps

The build context is the set of files sent to the builder (the dot in docker build .). .dockerignore excludes files from it (.git, node_modules, .env, local data), speeding up builds and keeping secrets and junk out of images.

“The build uploads 3 GB of context because .dockerignore misses node_modules.”

DevOps

A human-readable label on an image, such as nginx:1.27, api:2.4.1 or api:git-a3f9c21. Tags are mutable and can be moved to a different image, so deploy by version or commit-SHA tags, never just latest.

“Tag every image with the Git SHA so we always know what's running.”

DevOps

The default tag Docker applies when you give none. It means untagged, not newest, and it moves whenever someone pushes; deploying :latest makes deployments unreproducible and rollbacks guesswork.

“Two nodes run different code because both pulled :latest a day apart.”

DevOps

sha256 digest

The immutable content hash of an image (sha256:9f86d0...). Unlike a tag, a digest always refers to exactly the same bytes, so pinning by digest guarantees what runs and protects against tag tampering.

“Pin the base image by digest so a re-pushed tag can't change our build.”

DevOpsSecurity

Docker Hub, ECR, GHCR, Artifact Registry

A server that stores and distributes images in repositories with tags. Public ones include Docker Hub, GitHub Container Registry and Quay; cloud ones include Amazon ECR, Google Artifact Registry and Azure Container Registry. Docker Hub rate-limits anonymous pulls, which breaks CI.

“CI pushes the image to Artifact Registry and the cluster pulls it from there.”

DevOps

Persistent storage for containers that lives outside the container's writable layer, so data survives restarts and replacement. Without one, everything written inside a container disappears when the container is removed.

“Mount a volume for the Postgres data directory or the database vanishes on restart.”

DevOps

Mounting a specific host file or directory into a container (-v $(pwd):/app). Great for local development with live reload, but it ties the container to the host's layout and permissions.

“Bind-mount the source folder so code changes show up without a rebuild.”

DevOps

publish, -p

Exposing a container port on the host so outside traffic can reach it: -p 8080:80 maps host port 8080 to container port 80. EXPOSE in a Dockerfile only documents a port; it doesn't publish it.

“Run it with -p 3000:3000 or the browser can't reach it.”

DevOps

bridge, host network

How containers reach each other and the outside world. Docker's default bridge gives containers private IPs behind NAT; user-defined networks add DNS by container name; host networking shares the host's stack directly. Kubernetes replaces all this with a flat pod network provided by CNI plugins.

“Put both containers on one user-defined network so the app can reach db by name.”

DevOps

docker-compose.yml

Defines and runs a multi-container application on one machine from a YAML file of services, networks and volumes; docker compose up starts the whole stack. Ideal for local development and simple single-host deployments.

“docker compose up brings up the API, Postgres and Redis together.”

DevOps

Both define what runs when a container starts. ENTRYPOINT sets the executable; CMD gives default arguments, or the whole command if there's no ENTRYPOINT, and is easy to override. Use the exec form (a JSON array) so signals reach your process instead of a wrapping shell.

“With the shell form, SIGTERM goes to sh and the app never sees it.”

DevOps

tini, dumb-init

The first process in a container is PID 1, which the kernel treats specially: it gets no default signal handlers, so SIGTERM may be ignored, and it must reap zombie children. Apps not written for this shut down slowly or leak zombies; an init such as tini (docker run --init) fixes it.

“Shutdowns take 30 seconds because the app is PID 1 and ignores SIGTERM; add --init.”

DevOps

containerd, CRI-O, runc

The software that actually runs containers. High-level runtimes (containerd, CRI-O) manage images and container lifecycles; low-level runtimes (runc, crun) create the isolated processes. Kubernetes talks to them through the CRI and dropped direct Docker Engine support in 1.24, though Docker-built images still run.

“The node runs containerd, so inspect containers with crictl, not docker.”

DevOps

Open Container Initiative

The standards body defining the container image format, runtime specification and registry distribution API. Thanks to OCI, images built by Docker, Buildah or Kaniko run on any compliant runtime, and registries can also store Helm charts, signatures and ML models.

“It's a standard OCI image, so containerd runs it even though Docker built it.”

DevOps

The kernel feature that gives a container its own isolated view of the system: PID (own process tree), NET (own network stack), MNT (own mounts), UTS (own hostname), IPC, USER (own user IDs) and cgroup namespaces. A container is essentially a process running inside its own set of namespaces.

“Inside the container, ps shows only its own processes thanks to the PID namespace.”

DevOpsCore

control groups

The kernel feature that limits and accounts for the CPU, memory, I/O and process count a group of processes may use. Container and Kubernetes resource limits are enforced through cgroups; cgroup v2 is the current version.

“The memory limit is a cgroup limit; cross it and the kernel OOM-kills the container.”

DevOpsCore

OverlayFS

A filesystem that stacks layers into one view: the image's read-only layers below and a thin writable layer on top for the running container. Writes use copy-on-write, so heavy writing inside the container filesystem is slow; use volumes for data.

“The database is slow because it writes into the overlay layer instead of a volume.”

DevOps

Non-root containers run the app as an unprivileged user (USER 1000 in the Dockerfile), limiting the damage if it's compromised. Rootless mode goes further and runs the whole container engine without root on the host (Podman, rootless Docker). Many platforms enforce runAsNonRoot.

“The pod was rejected because the image runs as root and policy requires runAsNonRoot.”

DevOpsSecurity

A container granted almost all host capabilities and device access (--privileged), effectively root on the host. Needed only for rare low-level jobs and a major risk otherwise; grant specific capabilities instead.

“Why would a web app need --privileged? Drop it and add only the capability it needs.”

DevOpsSecurity

docker.sock

Mounting /var/run/docker.sock into a container gives it full control of the host's Docker daemon, which equals root on the host. Common in CI and tooling and a well-known escalation path; prefer daemonless builders.

“Mounting docker.sock into CI jobs hands every PR author root on the runner.”

DevOpsSecurity

A daemonless, rootless-capable container engine from Red Hat with a Docker-compatible CLI, so most docker commands work unchanged. It can also run Kubernetes-style pods and generate systemd units.

“On RHEL we use Podman: same commands, no root daemon.”

DevOps

Kaniko, Buildah, buildx

BuildKit is Docker's modern build engine, with parallel stages, smarter caching, build secrets that never land in layers and cross-platform builds through docker buildx. Kaniko and Buildah build images without a Docker daemon, which suits CI running inside Kubernetes.

“Use a BuildKit secret mount for the npm token so it never lands in a layer.”

DevOps

manifest list, image index

One image name pointing to variants for several CPU architectures (amd64, arm64) through a manifest list; each machine pulls the variant matching its CPU. Built with docker buildx build --platform. Needed for ARM cloud instances and Apple Silicon laptops.

“Build multi-arch so the image runs on both the Graviton and the x86 nodes.”

DevOpsCloud

dive

Shrinking images to speed up pulls, cold starts and scaling while cutting attack surface: minimal bases, multi-stage builds, cleanup in the same RUN step, no caches, a good .dockerignore. The dive tool shows what each layer adds.

“dive shows 600 MB of pip cache in one layer; add --no-cache-dir.”

DevOps

HEALTHCHECK

A command the runtime runs periodically to decide whether a container is healthy (HEALTHCHECK in a Dockerfile, probes in Kubernetes), so unhealthy containers can be restarted or pulled from load balancing. A running process isn't necessarily a working one.

“The process is up but stuck; a health check on /healthz would have restarted it.”

DevOps

What the runtime does when a container exits: no, on-failure, always or unless-stopped in Docker; Always, OnFailure or Never in Kubernetes. Automatic restarts hide crashes, so alert on restart counts too.

“It has restarted 300 times; the restart policy is hiding a crash loop.”

DevOps

gVisor, Kata Containers, Firecracker

Runtimes that add a stronger isolation boundary than namespaces for untrusted workloads. gVisor intercepts syscalls with a user-space kernel; Kata Containers and Firecracker give each container its own lightweight VM. Used by multi-tenant platforms, serverless and sandboxes for AI-generated code.

“Run customer-submitted code under gVisor, not as an ordinary container.”

DevOpsSecurity

Wasm, WASI

A portable, sandboxed binary format that runs at near-native speed in browsers and, through WASI, on servers. Wasm modules are tiny, start in microseconds and are isolated by design, so they're used for edge functions and plugins and explored as a lighter alternative to containers.

“The edge functions compile to Wasm, so cold starts take under a millisecond.”

DevOpsCore

K8s

The open-source system, created at Google and now run by the CNCF, for running containers at scale across a cluster of machines. You declare what you want (five replicas of this image, exposed on port 80, with these resources) and Kubernetes schedules, connects, scales, restarts and updates it, constantly reconciling reality to your declaration. K8s is K, eight letters, s.

“We run 200 services on Kubernetes across three clusters.”

DevOpsPlatform

Automating the deployment, scheduling, networking, scaling, health management and updating of containers across many machines. Kubernetes dominates; alternatives include HashiCorp Nomad, Amazon ECS and Docker Swarm.

“With 300 containers you need orchestration, not docker run in a loop.”

DevOps

A set of machines (nodes) managed together by Kubernetes: a control plane that makes decisions and worker nodes that run workloads. Organizations often run several clusters, per environment, region or team.

“The staging cluster is in Mumbai; prod has clusters in two regions.”

DevOps

worker node, node pool

A VM or physical machine in the cluster that runs pods. Every node runs the kubelet, a container runtime and usually kube-proxy. Nodes with the same machine type are grouped into node pools or node groups.

“The node is NotReady; its kubelet stopped reporting.”

DevOps

The cluster's brain: the API server, etcd, the scheduler and the controller managers, which store desired state and make decisions. Managed services such as EKS, GKE and AKS run it for you. If it goes down, running pods keep running, but nothing can be changed or rescheduled.

“GKE manages the control plane; we only manage the node pools.”

DevOps

API server

The control plane's front door: every component and every kubectl command goes through its REST API. It authenticates and authorizes requests, runs admission control, and reads and writes state in etcd.

“kubectl hangs because a controller is flooding the API server with LIST calls.”

DevOps

The distributed, strongly consistent key-value store, using Raft consensus, that holds all cluster state. Lose etcd and the cluster loses its memory, so back it up and run an odd number of members (three or five) to keep quorum.

“Back up etcd before the upgrade; it's the source of truth for the whole cluster.”

DevOps

kube-scheduler

Decides which node each new pod runs on, weighing resource requests, node selectors, affinity rules, taints and tolerations, and spread constraints. If no node fits, the pod stays Pending.

“The scheduler can't place it: no node has 16 GiB of unrequested memory.”

DevOps

controller manager

A control loop that watches the cluster's actual state and works to make it match the desired state: the Deployment controller creates ReplicaSets, the ReplicaSet controller keeps the pod count right, the node controller handles dead nodes. Operators are custom controllers.

“Delete a pod and the ReplicaSet controller immediately starts another.”

DevOpsPlatform

The agent on every node that turns pod specs into running containers: it pulls images, starts containers through the runtime, mounts volumes, runs probes and reports status. If it dies, the node goes NotReady.

“Check the kubelet logs on that node; pods are stuck in ContainerCreating.”

DevOps

The node component that implements Service virtual IPs by programming iptables or IPVS rules that route traffic to the right pods. eBPF-based networking such as Cilium can replace it for better performance at scale.

“With 5,000 Services, the iptables rules got slow, so we moved to Cilium.”

DevOps

The command-line tool for Kubernetes. Daily commands: get pods, describe pod, logs -f, exec -it, apply -f, rollout status and undo, port-forward, top. Pronounced cube-control, cube-cuttle or cube-C-T-L; all are accepted.

“kubectl describe pod shows the real reason: ImagePullBackOff.”

DevOps

The kubeconfig file (~/.kube/config) stores cluster addresses, credentials and contexts; a context combines a cluster, a user and a default namespace. Running a command in the wrong context, prod instead of staging, is a classic mistake that kubectx and prompt indicators help prevent.

“Check your context before you delete anything; you're pointed at prod.”

DevOpsSecurity

YAML manifest

A YAML or JSON file describing Kubernetes objects declaratively, with apiVersion, kind, metadata (name, labels) and spec (desired state). Applied with kubectl apply -f and normally kept in Git.

“Add resource limits to the deployment manifest.”

DevOps

The smallest deployable unit in Kubernetes: one or more containers sharing a network namespace (one IP, they talk over localhost) and volumes, always scheduled together on one node. Pods are ephemeral and replaceable and are usually created through higher-level objects such as Deployments.

“The pod was rescheduled to another node and came back with a new IP.”

DevOps

A pod running several tightly coupled containers that must live and scale together: the main app plus sidecars, init containers or adapters. If they could run independently, they belong in separate pods.

“The pod has two containers, the app and an Envoy sidecar.”

DevOps

native sidecar

A helper container in the same pod as the app, adding a mesh proxy, log collection or secret syncing. Since Kubernetes 1.28, native sidecars (init containers with restartPolicy: Always) start before the main container and stop after it.

“The Istio sidecar intercepts all of the pod's traffic to add mTLS.”

DevOps

A container that runs to completion before the main containers start, for setup work: waiting for a database, running migrations, downloading config or model files, fixing permissions. If it fails, the pod keeps retrying it.

“The init container waits for Postgres to be reachable before the app starts.”

DevOps

The standard object for stateless applications: you declare the image, replica count and update strategy, and it manages ReplicaSets to create pods, roll out updates gradually and roll back (kubectl rollout undo). Most web services run as Deployments.

“Bump the image tag in the Deployment and it rolls out gradually.”

DevOps

Keeps a specified number of identical pods running, replacing any that die. Deployments create and manage ReplicaSets, one per version during a rollout, so you rarely create them yourself.

“Each rollout creates a new ReplicaSet and scales the old one down.”

DevOps

Runs stateful applications (databases, Kafka, Elasticsearch) whose pods need stable identities: fixed names (db-0, db-1), a persistent volume that follows each pod, and ordered startup, scaling and updates. Harder to operate than Deployments, so managed services or operators often make more sense.

“Kafka runs as a StatefulSet so broker-2 always gets the same disk.”

DevOpsData

Ensures one copy of a pod runs on every node, or every matching node, including new ones. Used for node-level agents: log collectors (Fluent Bit), monitoring agents (node-exporter), networking plugins and security agents.

“Fluent Bit runs as a DaemonSet so every node ships its logs.”

DevOps

A Job runs pods until a task finishes successfully (a batch run, a migration, a backup), retrying failures up to a limit. A CronJob creates Jobs on a cron schedule; set concurrencyPolicy and deadlines so slow runs don't pile up.

“The nightly report is a CronJob at 0 2 * * * with concurrencyPolicy: Forbid.”

DevOps

ClusterIP, NodePort, LoadBalancer

A stable virtual IP and DNS name in front of a changing set of pods chosen by labels, load-balancing traffic across them. Types: ClusterIP (internal, the default), NodePort (a port on every node), LoadBalancer (provisions a cloud load balancer) and ExternalName (a DNS alias).

“The frontend calls orders.prod.svc.cluster.local and the Service finds the healthy pods.”

DevOps

A Service with clusterIP: None: no virtual IP and no load balancing, just DNS records returning the individual pod IPs. Used with StatefulSets so clients can reach specific pods, and by databases that manage their own clustering.

“Cassandra uses a headless service so each node can find its peers.”

DevOps

Endpoints

Objects listing the actual pod IPs and ports behind a Service, updated as pods come, go and change readiness. A Service with no endpoints means its selector matches no ready pods, a top debugging clue.

“The Service has no endpoints; it selects app=api but the pods say app=api-v2.”

DevOps

A Kubernetes object defining HTTP and HTTPS routing from outside the cluster to Services by hostname and path, with TLS certificates. It does nothing on its own; an ingress controller implements it. The Gateway API is gradually succeeding it.

“Add a rule to the Ingress so /api goes to the api Service.”

DevOps

ingress-nginx, Traefik

The reverse proxy running in the cluster that reads Ingress objects and routes traffic accordingly: ingress-nginx, Traefik, HAProxy, Contour, or cloud controllers that provision cloud load balancers. Usually exposed through a LoadBalancer Service.

“The ingress controller returns 404 because no rule matches that host.”

DevOps

HTTPRoute

The newer, more expressive Kubernetes networking API replacing Ingress, with role-based resources: GatewayClass (the infrastructure provider), Gateway (listeners, owned by the platform team) and HTTPRoute or GRPCRoute (routing, owned by app teams). It supports traffic splitting and header matching natively.

“App teams manage their own HTTPRoutes while the platform team owns the Gateway.”

DevOpsPlatform

A logical partition within a cluster that scopes names, access control, resource quotas and network policies, used to separate teams, apps or environments. Namespaces alone are not a strong security boundary.

“Each team gets its own namespace with a resource quota.”

DevOpsPlatform

Labels are key-value tags on objects (app=api, env=prod, team=payments); selectors query objects by label. They are how Services find pods and Deployments own ReplicaSets, and how you filter (kubectl get pods -l app=api). Label mismatches are a classic bug.

“The Service selector has a typo, so it matches zero pods.”

DevOps

Key-value metadata on objects meant for tools and humans rather than selection: ingress settings, scrape configuration, change causes, owner contacts. Many controllers are configured entirely through annotations.

“Add the scrape annotation so Prometheus picks up the pod.”

DevOps

An object holding non-secret configuration as key-value pairs or files, injected into pods as environment variables or mounted files, so one image works in every environment. Pods don't restart automatically on changes: mounted files update eventually, environment variables never do.

“Change the log level in the ConfigMap, then restart the deployment to pick it up.”

DevOps

An object for sensitive values such as passwords, tokens and keys, injected like a ConfigMap. By default it is only base64-encoded, not encrypted, so enable encryption at rest, restrict access with RBAC and often sync from an external manager (External Secrets Operator, Sealed Secrets, Vault).

“Base64 isn't encryption; anyone who can read the Secret can decode it.”

DevOpsSecurity

PV, PVC

A PersistentVolume is a piece of storage in the cluster (a cloud disk, an NFS share); a PersistentVolumeClaim is a pod's request for storage of a size and access mode. Kubernetes binds claims to volumes, usually provisioning them on demand, so data outlives individual pods.

“The PVC is Pending because the StorageClass can't provision in that zone.”

DevOpsData

dynamic provisioning

Defines a kind of storage (SSD or HDD, replication, reclaim policy, binding mode) and the provisioner that creates volumes when a PVC asks for one. volumeBindingMode: WaitForFirstConsumer avoids creating disks in the wrong zone.

“Use the premium-ssd StorageClass for the database PVCs.”

DevOps

RWO, RWX

How a volume can be mounted: ReadWriteOnce (one node read-write, typical of cloud block disks), ReadOnlyMany, ReadWriteMany (many nodes read-write, needs a shared filesystem such as NFS, EFS or Filestore) and ReadWriteOncePod. Replicas spread across nodes can't share one RWO disk.

“Three replicas can't share an RWO disk; use RWX storage or object storage.”

DevOps

Container Network Interface

The plugin standard that gives pods their network: IP addresses and connectivity across nodes. Popular plugins are Calico, Cilium (eBPF), Flannel and cloud-native ones such as the AWS VPC CNI. The choice affects performance, network policy support and IP address use.

“The AWS VPC CNI gives pods real VPC IPs, so we ran out of subnet addresses.”

DevOps

Container Storage Interface

The plugin standard that lets Kubernetes use any storage system (cloud disks, NFS, Ceph) through drivers that provision, attach and mount volumes. The Secrets Store CSI driver also mounts secrets from external vaults as files.

“Install the EBS CSI driver or the PVCs will never bind on the new cluster.”

DevOps

Container Runtime Interface

The API the kubelet uses to talk to container runtimes such as containerd and CRI-O, so Kubernetes can swap runtimes without changing itself. crictl is the CLI for inspecting containers through it.

“Since the move to containerd, use crictl ps on the node instead of docker ps.”

DevOps

resource requests, resource limits

A request is what a container is guaranteed and what the scheduler uses to place it; a limit is the most it may use. Over its CPU limit a container is throttled; over its memory limit it is OOMKilled. Missing requests overcommit nodes, and tight CPU limits cause hidden throttling.

“Set the memory request equal to the limit for the database so it's never OOM-evicted.”

DevOpsSRE

Guaranteed, Burstable, BestEffort

Kubernetes' quality-of-service classes, derived from requests and limits: Guaranteed (requests equal limits for every container), Burstable (some requests set) and BestEffort (none). Under memory pressure, BestEffort pods are evicted first and Guaranteed pods last.

“Critical pods should be Guaranteed so they're the last to go.”

DevOpsSRE

CFS throttling

When a container reaches its CPU limit, the kernel pauses it for the rest of each scheduling period, which shows up as latency spikes even while average CPU looks low. Many teams set CPU requests but no CPU limits for latency-sensitive services.

“p99 doubles because the pod is throttled on its CPU limit at 40% average CPU.”

DevOpsSRE

exit code 137

A container status meaning the kernel killed it for exceeding its memory limit, or the node ran out of memory. kubectl describe shows reason OOMKilled and exit code 137. Fix it by raising the limit, finding a leak or using less memory.

“Last state OOMKilled: the JVM heap is bigger than the container limit.”

DevOpsSRE

A pod status meaning its container keeps crashing at startup and Kubernetes waits longer between restarts, up to five minutes. Usual causes: application errors, bad config, missing environment variables or secrets, failing liveness probes, a wrong command. kubectl logs --previous shows the last crash.

“It's in CrashLoopBackOff; logs --previous shows DATABASE_URL is missing.”

DevOpsSRE

ErrImagePull

A pod status meaning the node can't pull the image and is backing off between retries. Usual causes: a typo in the image name or tag, a tag that was never pushed, missing registry credentials (imagePullSecrets), registry rate limits or no network route to the registry.

“ImagePullBackOff: tag 1.4.2 was never pushed because CI failed before that step.”

DevOps

A pod the cluster accepted but hasn't started, usually because the scheduler can't find a node that fits (not enough requested CPU or memory, taints, affinity rules, an unbound PVC) or images are still pulling. The Events section of kubectl describe pod gives the reason.

“Pending: 0/12 nodes available, insufficient memory. The autoscaler will add a node.”

DevOps

A periodic check (HTTP, TCP, command or gRPC) that tells the kubelet whether a container still works; after repeated failures the container is restarted. It should catch deadlocks, not check dependencies such as the database, or one database blip restarts every pod at once.

“Don't point the liveness probe at the DB check; a database blip would restart the whole fleet.”

DevOpsSRE

A check that tells Kubernetes whether a container should receive traffic; failing pods are removed from Service endpoints but not restarted. Used during startup, warm-up and temporary overload, and essential for zero-downtime rollouts.

“New pods take traffic before their cache is warm; add a readiness probe.”

DevOpsSRE

A probe that runs only while a container starts and holds off liveness and readiness checks until it succeeds, so slow starters (large JVMs, apps loading ML models) aren't killed before they're up.

“The model takes three minutes to load, so give it a startup probe.”

DevOps

HPA

Automatically changes the number of pod replicas based on metrics: CPU or memory utilization relative to requests, or custom and external metrics such as requests per second or queue length. It needs resource requests and a metrics source.

“The HPA went from 4 to 20 pods during the sale and back down overnight.”

DevOpsSRE

VPA

Recommends, or automatically applies, CPU and memory requests based on observed usage. Great for right-sizing; in auto mode it restarts pods to apply changes and shouldn't fight an HPA scaling on the same metric.

“Run VPA in recommendation mode to find realistic requests for every service.”

DevOpsSRE

Cluster Autoscaler, Karpenter

Adding nodes when pods can't be scheduled and removing underused nodes to save money. Cluster Autoscaler scales predefined node groups; Karpenter chooses the best instance types for pending pods in real time, uses spot capacity and consolidates aggressively.

“Pending pods triggered Karpenter and a new node joined within a minute.”

DevOpsCloudSRE

event-driven autoscaling

Kubernetes Event-Driven Autoscaling: scales workloads on event sources such as queue depth (Kafka, SQS, RabbitMQ), cron schedules or Prometheus queries, including down to zero when idle.

“KEDA scales the workers on Kafka lag and down to zero at night.”

DevOpsSRE

A taint on a node repels pods (key=value:NoSchedule); only pods with a matching toleration may land there. Used to reserve nodes for GPU workloads or system components. A toleration allows scheduling but doesn't force it; affinity does that.

“GPU nodes are tainted, so only pods tolerating nvidia.com/gpu land on them.”

DevOps

nodeSelector

Rules for where pods go. nodeSelector and node affinity attract pods to nodes with certain labels (zone, instance type, GPU). Pod affinity places pods near each other; pod anti-affinity spreads replicas across nodes or zones so one failure can't take them all.

“Add pod anti-affinity so the three replicas never share a node.”

DevOpsSRE

maxSkew

Rules that spread pods evenly across failure domains such as zones and nodes, with a maximum allowed imbalance (maxSkew). More flexible than anti-affinity for high availability across zones.

“Spread across zones with maxSkew 1 so one zone outage takes at most a third of the pods.”

DevOpsSRE

PDB

Limits how many of an app's pods may be down at once during voluntary disruptions such as node drains, upgrades and autoscaler scale-downs (minAvailable: 2 or maxUnavailable: 1). It protects availability during maintenance, but an overly strict PDB blocks node upgrades forever.

“The drain is stuck because the PDB allows zero unavailable pods.”

DevOpsSRE

kubectl cordon marks a node unschedulable so no new pods land on it; kubectl drain also evicts its existing pods, respecting PodDisruptionBudgets, so the node can be patched, upgraded or removed safely.

“Cordon and drain the node before patching its kernel.”

DevOpsSRE

node-pressure eviction

Kubernetes removing pods from a node, either voluntarily (drains, autoscaling, preemption) or because the node is short of memory, disk or PIDs, in which case the kubelet evicts by QoS class and usage. Pods owned by controllers are rescheduled elsewhere.

“Pods were evicted for DiskPressure because container logs filled the node's disk.”

DevOpsSRE

PriorityClasses rank pods by importance; when the cluster is full, the scheduler may preempt (evict) lower-priority pods to fit higher-priority ones, protecting critical services during resource crunches.

“Batch jobs have low priority, so they get preempted when the API needs room.”

DevOpsSRE

terminationGracePeriodSeconds, preStop

When a pod is deleted, Kubernetes removes it from Service endpoints and sends SIGTERM, then waits terminationGracePeriodSeconds (30 by default) before SIGKILL. Apps must stop taking new work and finish in-flight requests; a short preStop sleep covers the lag before load balancers notice.

“Add a 10-second preStop sleep so the load balancer stops sending traffic before shutdown.”

DevOpsSRE

The package manager for Kubernetes. A chart bundles templated manifests with default values; helm install and helm upgrade render them with your values file and track releases so you can roll back. Huge public ecosystem (Prometheus, ingress-nginx, cert-manager), though heavy templating gets unreadable.

“Install it with the Helm chart and override replicas in values-prod.yaml.”

DevOpsPlatform

values.yaml

A chart is a directory of Go templates, a Chart.yaml with metadata and a values.yaml of defaults. A release is one installed instance of a chart in a cluster, with its own values and revision history. helm template renders locally; helm rollback reverts to an earlier revision.

“helm rollback api 41 takes us back to yesterday's revision.”

DevOps

overlays

A template-free way to customize Kubernetes YAML, built into kubectl (-k). You keep a base set of manifests and apply per-environment overlays that patch fields such as replicas, image tags and resources, without copy-paste. Popular with GitOps.

“The prod overlay sets six replicas and adds the HPA; the base stays untouched.”

DevOps

CRD

Extends the Kubernetes API with your own object types (Certificate, KafkaTopic, Database) that then work with kubectl, RBAC and GitOps like built-in objects. A controller or operator gives them behavior.

“cert-manager adds a Certificate CRD, so certificates are just YAML in the repo.”

DevOpsPlatform

operator pattern

A custom controller plus CRDs that encodes the operational know-how for one application (a database, Kafka, Prometheus): provisioning, scaling, backups, failover and upgrades, automated as a reconciliation loop. Software that does a human operator's job.

“The Postgres operator handles failover and nightly backups for every database.”

DevOpsPlatformData

admission webhook

Code that intercepts requests to the API server after authentication but before objects are stored, to validate them (reject pods running as root) or mutate them (inject sidecars, add default labels). Policy engines such as OPA Gatekeeper and Kyverno work this way.

“The admission webhook rejected the deployment because it has no resource limits.”

DevOpsSecurityPlatform

Role, ClusterRole, RoleBinding

Kubernetes' role-based access control: Roles (one namespace) and ClusterRoles (whole cluster) list allowed verbs on resources, and RoleBindings or ClusterRoleBindings grant them to users, groups or ServiceAccounts. Least privilege here stops one compromised pod from owning the cluster.

“The CI account only needs patch on deployments in one namespace, not cluster-admin.”

DevOpsSecurity

workload identity

An identity for processes running in pods, used to call the Kubernetes API and, through workload identity (IRSA on AWS, Workload Identity on GKE), cloud services without static keys. Give each workload its own minimally privileged account instead of the namespace default.

“Bind the pod's ServiceAccount to a cloud IAM role instead of mounting access keys.”

DevOpsSecurity

Firewall rules for pods: which pods or namespaces may connect to which, on which ports, inbound and outbound. By default every pod can reach every pod; a default-deny policy plus explicit allows is the secure baseline, enforced by the CNI plugin.

“Add a network policy so only the api pods can reach the database.”

DevOpsSecurity

Pod Security Admission

Kubernetes' built-in pod security profiles: privileged (unrestricted), baseline (blocks known escalations) and restricted (non-root, no privilege escalation, dropped capabilities, seccomp). Enforced per namespace by Pod Security Admission, which replaced PodSecurityPolicy.

“Label the namespace to enforce the restricted profile.”

DevOpsSecurity

Per-pod or per-container security settings: runAsUser, runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, dropped Linux capabilities, seccomp and AppArmor profiles, and fsGroup for volume permissions. The main lever for hardening workloads.

“Set readOnlyRootFilesystem and mount an emptyDir for /tmp.”

DevOpsSecurity

Istio, Linkerd

An infrastructure layer for service-to-service traffic, using sidecar proxies (usually Envoy) or node-level ambient proxies: mutual TLS, retries, timeouts, traffic splitting, circuit breaking and uniform metrics and traces, with no app code changes. Powerful, but it adds complexity and resource overhead.

“The mesh gives us mTLS between all services and per-route latency metrics for free.”

DevOpsSRESecurity

A high-performance layer-7 proxy, created at Lyft and now a CNCF graduated project, that powers most service meshes and many API gateways and ingress controllers. It is configured dynamically through its xDS APIs and is rich in observability.

“Envoy's access log shows response flag UF: the upstream connection failed.”

DevOps

EKS, GKE, AKS

Kubernetes as a cloud service (Amazon EKS, Google GKE, Azure AKS): the provider runs and upgrades the control plane, and sometimes the nodes too (GKE Autopilot, EKS Auto Mode), while you manage workloads and configuration. Upgrading every few months is still your job.

“We use GKE Autopilot, so we don't manage nodes at all.”

DevOpsCloud

k3s, kind, minikube

Small Kubernetes distributions for laptops, CI and edge devices: kind (Kubernetes inside Docker containers), minikube, k3s and k3d (light enough for edge and small servers) and MicroK8s. Ideal for learning and for testing manifests locally.

“Spin up a kind cluster in CI to test the Helm chart.”

DevOps

version skew

Kubernetes ships a minor version about three times a year, each supported for roughly 14 months, so clusters must be upgraded regularly: control plane first, then nodes, one minor version at a time, after checking for removed APIs. Skipped upgrades turn into painful forced jumps.

“The cluster is three versions behind; plan the path and check deprecated APIs first.”

DevOpsSRE

Short-lived records of what happened to objects (scheduled, image pulled, probe failed, OOM, evicted), shown at the bottom of kubectl describe and by kubectl get events. Often the fastest route to why it isn't working; they expire after about an hour by default.

“The events say FailedMount: the Secret it needs doesn't exist.”

DevOps

A marker on an object that blocks its deletion until a controller has finished cleanup (deleting a cloud load balancer, a disk or other external resources) and removed the marker. Objects stuck in Terminating usually have a finalizer whose controller is gone.

“The namespace is stuck Terminating because a finalizer's controller was uninstalled.”

DevOpsPlatform

fleet management

Running many clusters (per region, environment, team or tenant) and managing them as a fleet: consistent configuration through GitOps, cross-cluster discovery and traffic, central policy and observability. More resilience and isolation in exchange for more complexity.

“A cluster per region per environment is 18 clusters, all managed through Argo CD.”

DevOpsPlatformSRE

kubectl debug

A temporary container attached to a running pod for debugging (kubectl debug -it pod --image=busybox), sharing the pod's namespaces. Essential for distroless images that have no shell.

“The image has no shell, so attach an ephemeral debug container.”

DevOps

kubectl port-forward

Tunnels a local port to a pod or Service inside the cluster, so you can reach internal services from your laptop without exposing them publicly. For debugging, not for production traffic.

“kubectl port-forward svc/grafana 3000:80, then open localhost:3000.”

DevOps

the cloud

Renting computing resources (servers, storage, databases, networking, AI models) on demand over the internet and paying for what you use, instead of buying and running your own hardware. Its defining traits are self-service, elasticity, pay-as-you-go pricing and global reach.

“Moving to the cloud swaps a big hardware purchase for a monthly bill.”

Cloud

on-prem

Running infrastructure in your own data center or server room and owning the hardware yourself. Still common in regulated industries, banking, government and for very steady workloads.

“Core banking stays on-prem; the mobile backend runs in the cloud.”

Cloud

Public cloud is shared infrastructure run by a provider (AWS, Azure, GCP). Private cloud is cloud-style infrastructure dedicated to one organization (OpenStack, VMware). Hybrid cloud combines the two, connected by networking and shared management.

“It's hybrid: customer data stays on-prem and analytics bursts into GCP.”

Cloud

Using more than one public cloud, deliberately (avoiding lock-in, best-of-breed services, regulation) or by accident (acquisitions, team preferences). It adds complexity in networking, identity, skills and tooling, and true workload portability is rarer than it sounds.

“We're multi-cloud by accident: ML on GCP and everything else on AWS.”

CloudLeadership

AWS, Azure, GCP

The largest public cloud providers: Amazon Web Services (the biggest), Microsoft Azure (strong in enterprise and Microsoft shops) and Google Cloud (strong in data, Kubernetes and AI). Others include Oracle Cloud, IBM Cloud, Alibaba Cloud and specialist GPU clouds.

“All three hyperscalers have regions in India now.”

Cloud

Infrastructure as a Service

Renting raw building blocks (virtual machines, disks, networks) and managing everything above them yourself: the OS, patches, runtime and app. The most flexible model and the most work. Examples: EC2, Compute Engine, Azure VMs.

“With IaaS, OS patching is still our job.”

Cloud

Platform as a Service

A managed platform where you deploy code or containers and the provider runs the servers, OS, scaling and patching: Heroku, App Engine, Azure App Service, Cloud Run. Less control, far less operational work.

“Just push it to the PaaS; there are no servers to manage.”

Cloud

Software as a Service

Complete applications delivered over the internet on subscription (Gmail, Slack, Salesforce, Jira, Datadog). The provider runs everything; you use and configure it.

“We don't host our own issue tracker; it's SaaS.”

Cloud

The split of security duties between provider and customer. The provider secures the cloud itself: buildings, hardware, hypervisors and managed-service internals. The customer secures what they put in it: data, identities, configuration, network rules and, on IaaS, the OS. Most cloud breaches are customer-side misconfigurations.

“The provider won't stop you making a bucket public; that's your side of shared responsibility.”

CloudSecurity

A geographic area where a provider runs a cluster of data centers, such as ap-south-1 or asia-south1 in Mumbai. The choice affects latency, price, available services and data-residency compliance, and regions are isolated from one another.

“Deploy in Mumbai; most users are in India and the data must stay in the country.”

Cloud

AZ, zone

One or more physically separate data centers inside a region, with independent power, cooling and networking, linked by fast low-latency connections. Spreading instances across zones survives a single data-center failure, the basic high-availability pattern.

“Run at least one replica in each of the three zones.”

CloudSRE

EC2, Compute Engine

A virtual machine rented from a cloud provider, chosen by machine type and image and billed per second or hour; the basic unit of IaaS.

“Spin up a small instance for the cron jobs.”

Cloud

machine type, instance family

The predefined size and shape of a cloud VM (vCPUs, memory, network, local disk, accelerators), grouped into families for general-purpose, compute-optimized, memory-optimized, storage-optimized and GPU workloads. AWS names look like m7g.large; GCP like n2-standard-4.

“It's memory-bound, so move it to a memory-optimized family.”

Cloud

virtual CPU, burstable instance

A virtual processor assigned to a VM, usually one hyper-thread of a physical core, so 2 vCPUs are often one real core. Burstable instances (AWS t-series, GCP e2 shared-core) get only part of a vCPU sustained and earn credits to burst.

“It's a burstable instance; it ran out of CPU credits and got throttled.”

Cloud

preemptible VM, spot VM

Spare cloud capacity sold at a deep discount (often 60–90% off) that the provider can reclaim at short notice, two minutes on AWS and about 30 seconds on GCP. Ideal for fault-tolerant, stateless or batch work such as CI runners and checkpointed ML training.

“Train on spot GPUs and checkpoint every 15 minutes.”

CloudSRE

ASG, managed instance group

Keeps a fleet of identical VMs at the desired size, replacing unhealthy ones and scaling the count up or down on schedules or metrics. AWS Auto Scaling Groups, GCP Managed Instance Groups, Azure Virtual Machine Scale Sets.

“The ASG replaced the dead instance before anyone was paged.”

CloudSRE

Scalability is a system's ability to handle more load by adding resources. Elasticity is doing that automatically and quickly in both directions, growing for peaks and shrinking to save money when it's quiet; it's the cloud's big economic promise.

“It scales, but it isn't elastic; someone adds servers by hand before every sale.”

CloudSRE

Running code and using services without managing servers: the provider handles provisioning, scaling (down to zero) and patching, and bills per request or execution time. Covers functions (Lambda, Cloud Functions), serverless containers (Cloud Run, Fargate) and serverless databases and queues. There are still servers; they're just not your problem.

“The image resizer is serverless, so it costs nothing when nobody uploads.”

CloudDevOps

Functions as a Service, Lambda

Running individual functions in response to events (HTTP requests, file uploads, queue messages, schedules), billed per invocation and duration: AWS Lambda, Google Cloud Functions, Azure Functions. Limits on run time, memory and cold starts decide what fits.

“An upload event triggers a Lambda that generates the thumbnail.”

CloudDevOps

The extra delay when a serverless platform must create a fresh execution environment (fetch the code, start the runtime, initialize your app) because no warm instance is free. It can add from hundreds of milliseconds to seconds; minimum instances, provisioned concurrency and smaller packages reduce it.

“The first request after idle takes three seconds; that's a Java cold start.”

CloudSRE

S3, GCS, Blob Storage

Storage for unstructured data as objects (files plus metadata) in flat buckets, accessed over HTTP APIs: Amazon S3, Google Cloud Storage, Azure Blob Storage. Practically unlimited, extremely durable (S3 is designed for eleven nines) and cheap; the backbone of data lakes, backups, static sites and ML datasets. It's not a filesystem, so renames and in-place edits are expensive.

“Write the model artifacts to object storage, not the pod's disk.”

CloudData

The top-level container in object storage, with a globally unique name on S3 and GCS, its own region, access policy, versioning and lifecycle rules. Publicly exposed buckets are among the most common causes of data leaks.

“Turn on public access blocking for every bucket by default.”

CloudSecurity

EBS, Persistent Disk

Network-attached virtual disks that behave like hard drives for VMs: AWS EBS, Google Persistent Disk, Azure Managed Disks. Usually attached to one instance at a time and tied to one zone; performance depends on the disk type and provisioned IOPS.

“The database needs a provisioned-IOPS volume; the general-purpose disk is maxed out.”

Cloud

EFS, Filestore, NFS

Managed shared filesystems (NFS or SMB) that many machines can mount at once: AWS EFS, Google Filestore, Azure Files. Used for shared content, legacy apps and ReadWriteMany Kubernetes volumes; usually slower and pricier than block storage.

“Three pods need the same files, so mount an EFS volume.”

Cloud

hot, cool, archive

Object-storage price classes that trade access speed and retrieval cost for cheaper storage: standard (hot), infrequent access or nearline (cool), and archive tiers such as Coldline or Glacier for data read rarely, with retrieval taking minutes to hours. Lifecycle rules move objects between tiers automatically.

“Move logs older than 90 days to the archive tier and cut their storage cost by 80%.”

CloudData

Virtual Private Cloud, VNet

Your own isolated private network inside a cloud provider, with your IP ranges, subnets, route tables, gateways and firewall rules; Azure calls it a VNet. Every serious cloud deployment starts with VPC design.

“The database sits in a private subnet with no route to the internet.”

Cloud

A public subnet routes to an internet gateway, so resources with public IPs are reachable from the internet (load balancers, bastions). A private subnet has no inbound path from the internet, and its outbound traffic goes through a NAT gateway. Apps and databases belong in private subnets.

“Only the load balancer is public; the app servers are in private subnets.”

CloudSecurity

cloud firewall rules

A virtual, stateful firewall attached to instances, load balancers and databases that allows specific inbound and outbound traffic by protocol, port and source; return traffic is allowed automatically. GCP uses VPC firewall rules; network ACLs are the stateless subnet-level equivalent.

“The database security group allows 5432 only from the app servers' group.”

CloudSecurity

An internet gateway connects a VPC to the internet for resources with public IPs, in both directions. A NAT gateway lets resources in private subnets make outbound connections (pulling packages, calling APIs) without being reachable. NAT gateways bill per hour and per gigabyte processed.

“The private nodes can't pull images because the NAT gateway route is missing.”

Cloud

Transit Gateway, Private Service Connect

Ways to connect networks privately. VPC peering links two VPCs directly (non-transitive, CIDRs must not overlap); a transit gateway or hub VPC connects many networks hub-and-spoke; PrivateLink and Private Service Connect expose a single service into another network without opening the rest.

“Expose the API to the partner over PrivateLink instead of peering our whole VPC.”

CloudSecurity

Direct Connect, Interconnect, ExpressRoute

Linking on-premises networks to the cloud, either with site-to-site VPNs over the internet (quick, cheaper) or with dedicated private circuits such as AWS Direct Connect, Google Cloud Interconnect and Azure ExpressRoute (steady bandwidth and latency, higher cost).

“Replication needs a dedicated interconnect; the VPN can't sustain the throughput.”

Cloud

Identity and Access Management

The cloud system controlling who (users, groups, roles, service accounts) may do what (actions) on which resources, through policies. Getting IAM right (least privilege, roles instead of long-lived keys) is the single most important cloud security control.

“The pipeline failed with AccessDenied because its role can't push to the registry.”

CloudSecurity

assume role

An IAM user is a long-lived identity with permanent credentials such as passwords and access keys. An IAM role is an identity that trusted principals (services, workloads, federated users) assume temporarily to receive short-lived credentials. Prefer roles; leaked long-lived keys are a top cause of breaches.

“Don't create an IAM user for the app; attach a role to the instance.”

CloudSecurity

A document listing allowed or denied actions on resources, optionally with conditions such as IP range, tags, MFA or time; JSON on AWS, role bindings on GCP. Policies attach to identities or to resources. An allow on every action for every resource is effectively admin.

“Scope the policy to that one bucket; s3:* on * is far too broad.”

CloudSecurity

A non-human identity that applications, VMs and pipelines use to call cloud APIs (the GCP and Azure term; AWS uses roles). Avoid downloading service-account keys; attach identities to workloads or use workload identity federation instead.

“Give the Cloud Run service its own service account with read-only storage access.”

CloudSecurity

A cloud offering where the provider runs the underlying infrastructure (patching, backups, scaling, high availability): managed databases, Kubernetes, queues, ML platforms. You trade some control and cost for far less operational work.

“Use managed Postgres; nobody here wants to be on call for database failover.”

Cloud

RDS, Cloud SQL, Aurora

A database run by the cloud provider with automated backups, patching, replication, failover and scaling: Amazon RDS and Aurora, Google Cloud SQL and AlloyDB, Azure SQL, DynamoDB, Firestore. You still own the schema, queries, indexes, sizing and access.

“Enable Multi-AZ on the RDS instance so failover is automatic.”

CloudData

CNCF

Applications designed to exploit the cloud: containerized, built from services, orchestrated dynamically, scaled elastically, delivered through CI/CD, observable and resilient to failure. The Cloud Native Computing Foundation (CNCF) hosts the core projects: Kubernetes, Prometheus, Envoy, Argo, OpenTelemetry.

“It's cloud-hosted, not cloud-native: a VM running a ten-year-old monolith.”

CloudDevOps

7 Rs, lift and shift

The standard options for moving apps to the cloud: rehost (lift and shift as-is onto VMs), relocate, replatform (small changes such as moving to a managed database), refactor (rebuild cloud-native), repurchase (switch to SaaS), retire, or retain. Lift and shift is fastest but rarely saves money on its own.

“Rehost the legacy apps first, then refactor the three that cost the most.”

CloudLeadership

A secure, pre-built multi-account cloud foundation set up before workloads arrive: account or project structure, identity and SSO, networking, logging, guardrails, security baselines and billing. Built with tools such as AWS Control Tower or Google's Cloud Foundation Toolkit.

“Every new team gets an account from the landing zone with guardrails already on.”

CloudPlatformSecurity

organization, account, project, subscription

How cloud resources are grouped for isolation, permissions and billing: AWS uses an organization, organizational units and accounts; GCP an organization, folders and projects; Azure management groups, subscriptions and resource groups. Separate accounts or projects per environment limit the blast radius.

“Prod and dev are separate projects, so a dev mistake can't touch prod data.”

CloudSecurity

cost allocation tags

Key-value metadata on cloud resources (team=payments, env=prod, cost-center=1234) used for cost allocation, automation, access policies and finding owners. Enforced tagging is the foundation of FinOps.

“Untagged resources are 40% of the bill and nobody knows who owns them.”

CloudLeadership

Caps the provider places on how much you may use: vCPUs per region, IP addresses, API calls per second, GPUs. Hitting one mid-scale-up or mid-incident is a nasty surprise, so request increases ahead of time and monitor usage.

“Autoscaling stopped at 64 vCPUs because we hit the regional quota.”

CloudSRE

The providers' published best-practice frameworks for reviewing architectures across pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. AWS, Azure and Google each publish one.

“Run a Well-Architected review before launch; reliability is the weak pillar.”

CloudLeadership

The control plane manages and configures resources (create a VM, change a route, update a policy); the data plane does the actual work (serving traffic, storing bytes, running containers). Good designs keep the data plane working when the control plane fails, a property called static stability.

“The control plane is degraded; existing instances run fine, but we can't launch new ones.”

CloudSRE

A tenant or workload on shared infrastructure using so much CPU, disk I/O, network or cache that it slows down others on the same host or service. A risk everywhere from cloud VMs to shared databases and Kubernetes nodes.

“Latency spikes every hour when a noisy neighbor's batch job saturates the shared disk.”

CloudSRE

IMDS

An internal endpoint at 169.254.169.254 that VMs and containers query for information about themselves and for their attached role's temporary credentials. SSRF bugs that reach it can steal those credentials, so require IMDSv2 on AWS and block pod access where it isn't needed.

“The SSRF bug let attackers read the metadata service and steal the role's credentials.”

CloudSecurity

Legal and regulatory rules about where data is stored and processed and whose laws apply to it. India's DPDP Act and RBI payment-data localization, and the EU's GDPR, shape region choices and architectures; sovereign-cloud offerings promise local control and operations.

“Payment data must stay in India, so no replication to regions abroad.”

CloudSecurityLeadership

Large provider outages happen: a zone, a region's control plane or a global service can fail, often through configuration or capacity problems. Resilient designs use multiple zones by default and multiple regions where the business case justifies the cost and complexity.

“When us-east-1 had trouble, half the internet went down with it.”

CloudSRE

IaC

Defining and managing infrastructure (networks, VMs, clusters, databases, DNS, IAM) in code kept in version control instead of clicking in consoles. It gives reproducible environments, review, history, automation and a path to disaster recovery. Common tools: Terraform, OpenTofu, Pulumi, CloudFormation, Bicep, CDK.

“If the region dies, we rebuild everything from the IaC repo.”

DevOpsCloud

Declarative means describing the desired end state (three servers with this config) and letting the tool work out how to get there, as Terraform and Kubernetes do. Imperative means writing the exact steps in order, as scripts do. Declarative tools are easier to make idempotent and to diff.

“Terraform is declarative: you say what should exist, not how to create it.”

DevOps

console clicking

Managing infrastructure by hand in web consoles: fast for experiments but unrepeatable, unreviewed and undocumented, which leads to drift and snowflake environments. A gently mocking term.

“That VPC was click-opsed, so nobody knows why that route exists.”

DevOpsCloud

HashiCorp's widely used declarative IaC tool: you describe resources in HCL, terraform plan previews changes, terraform apply makes them, and a state file tracks what it manages. Hundreds of providers cover AWS, GCP, Azure, Kubernetes, Cloudflare, GitHub, Datadog and more. Its 2023 license change to BSL prompted the OpenTofu fork.

“Add the bucket to Terraform; don't create it in the console.”

DevOpsCloud

An open-source, community-run fork of Terraform under the Linux Foundation, created after Terraform moved to the Business Source License. Largely drop-in compatible with existing configurations and providers.

“We switched the pipeline to OpenTofu for licensing reasons; the HCL didn't change.”

DevOps

HashiCorp Configuration Language

The declarative language of Terraform, OpenTofu, Packer, Nomad and Vault, made of blocks such as resource "aws_s3_bucket" "logs" { ... }, with variables, expressions, functions, for_each and count loops, and conditionals.

“Use for_each instead of copy-pasting the resource five times.”

DevOps

A plugin that teaches Terraform how to talk to one API (aws, google, azurerm, kubernetes, helm, cloudflare) and defines its resources and data sources. Pin provider versions, because major releases change behavior.

“The new resource type needs Google provider version 6 or later.”

DevOps

In Terraform, a resource is something Terraform creates and manages (a VM, a bucket, a DNS record); a data source only reads existing information (the latest image, a shared VPC, the account ID) without managing it.

“Use a data source to look up the shared VPC; the network team owns it.”

DevOps

A reusable, parameterized package of Terraform configuration (a VPC, a cluster, a standard service) called with input variables and returning outputs. Modules encode standards, are how platform teams offer golden paths for infrastructure, and should be versioned like libraries.

“Use the company vpc module; it already has flow logs and the right CIDRs.”

DevOpsPlatform

terraform.tfstate

Where Terraform records the real resources it manages and their attributes, mapping code to actual infrastructure; plans compare code, state and reality. It often contains secrets in plain text, so keep it encrypted in a remote backend and never in Git.

“Never commit tfstate; it has the database password in plain text.”

DevOpsSecurity

A remote backend stores state in a shared, durable place (S3, GCS, Azure Blob, Terraform Cloud) so the whole team and CI use one copy. State locking stops two applies from running at once and corrupting it.

“The apply failed on a lock because another pipeline is mid-apply.”

DevOps

Shows exactly what Terraform would create, change or destroy to make reality match the code, without doing it. Reading the plan, above all any destroy or forces replacement line, is the main safety step, and teams post plans on pull requests.

“The plan says forces replacement on the database, so stop before you apply.”

DevOps

Executes the changes to create, update or delete real infrastructure. In CI, apply the saved plan file so what runs is exactly what was reviewed.

“Apply the saved plan from the PR, not a fresh one.”

DevOps

prevent_destroy

Deletes every resource a configuration manages: handy for ephemeral environments, catastrophic in the wrong one. Protect critical resources with prevent_destroy and the provider's deletion protection.

“Add prevent_destroy to the production database so a stray destroy can't touch it.”

DevOps

configuration drift

When real infrastructure no longer matches its code, usually after a manual change or another tool's edit, which makes the next apply unpredictable. Detect it with scheduled plans or GitOps controllers, then update the code or revert the change.

“The nightly plan detected drift: someone opened port 22 in the console.”

DevOpsSRE

import block

Bringing an existing, hand-made resource under Terraform management by recording it in state and writing matching code. The standard way to adopt click-opsed infrastructure without recreating it.

“Import the existing bucket instead of recreating it and losing the data.”

DevOps

Separate state files for the same configuration, sometimes used for environments. Many teams prefer a separate root module and backend per environment for clearer isolation and different access controls.

“Don't isolate prod with workspaces; give it its own root module and backend.”

DevOps

tfvars

Input variables parameterize Terraform code (region, instance size, replica count) and are supplied through .tfvars files, environment variables or flags; outputs expose values such as IDs and endpoints to other modules or scripts. Mark secrets as sensitive.

“Pass the instance size in prod.tfvars and output the load balancer's DNS name.”

DevOps

IaC blast radius

How much infrastructure one state file or apply can affect. A single giant state means one mistake, or one slow locked plan, touches everything; splitting by layer (network, cluster, apps) and environment limits the damage.

“Network and apps share one state, so every app change risks the VPC. Split it.”

DevOpsSRE

A thin wrapper around Terraform and OpenTofu that keeps configuration DRY across many environments and accounts by generating backends, passing outputs between stacks and running many stacks together.

“Terragrunt generates the backend config for all 40 stacks.”

DevOps

An IaC tool where you write infrastructure in general-purpose languages (TypeScript, Python, Go, C#, Java) with their loops, functions and tests, instead of a dedicated configuration language. Its state model resembles Terraform's.

“The team picked Pulumi so they can write infrastructure in TypeScript.”

DevOpsCloud

AWS CDK

AWS CloudFormation is AWS's native declarative IaC, with YAML or JSON templates deployed as stacks whose state AWS manages. The AWS CDK lets you write infrastructure in TypeScript, Python and other languages and compiles it to CloudFormation.

“The stack rolled back automatically when the CloudFormation update failed.”

DevOpsCloud

Azure's native IaC. ARM templates are verbose JSON; Bicep is a cleaner language that compiles to ARM, with deployment state tracked by Azure itself.

“Write it in Bicep; nobody wants to maintain 2,000 lines of ARM JSON.”

DevOpsCloud

A CNCF project that extends Kubernetes to provision and manage cloud infrastructure as custom resources, letting platform teams publish their own higher-level APIs (composite resources) that are reconciled continuously like any Kubernetes object.

“Developers request a database with a Crossplane claim in their app's YAML.”

DevOpsPlatform

Automating the setup and ongoing configuration of servers (packages, files, users, services) so they stay in a known, consistent state, with tools like Ansible, Chef, Puppet and Salt. Less central in container-heavy shops, still common for VMs, bare metal and network devices.

“Patch all 300 VMs with config management, not a for loop over SSH.”

DevOps

A popular agentless automation and configuration tool from Red Hat. It connects over SSH (or WinRM) and runs tasks described in YAML playbooks, using modules for packages, files, services and cloud APIs. Easy to start with and designed for idempotent runs.

“Run the Ansible playbook to roll the new nginx config out to every web server.”

DevOps

Ansible playbook

An Ansible YAML file of plays: which hosts to target and which tasks and roles to run on them, in order. A good playbook is idempotent, so a second run reports changed=0 when nothing needs doing.

“The second run should show zero changes; if not, the playbook isn't idempotent.”

DevOps

The list of hosts Ansible manages, organized into groups (web, db, prod) with variables, kept as a static file or generated dynamically from cloud APIs.

“Use the dynamic inventory so new instances are picked up by their tags.”

DevOps

A reusable, structured bundle of tasks, templates, files, handlers and defaults for one purpose (install Docker, harden SSH, configure nginx), shared through Ansible Galaxy or internal repositories.

“Pull the hardening role from our internal Galaxy instead of rewriting it.”

DevOps

Agent-based tools (Chef, Puppet, Salt) run a daemon on every managed machine that pulls and enforces configuration; agentless tools such as Ansible push changes over SSH. Agents enforce continuously at scale; agentless needs nothing installed.

“Puppet's agent re-applies the config every 30 minutes, so manual edits get reverted.”

DevOps

Never modifying servers after deployment: any change means building a new image and replacing the old instances. It eliminates drift and snowflakes and makes rollback simple, but needs solid automation and state kept outside the servers.

“Under immutable infrastructure, a security patch means a new image and a rolling replacement.”

DevOpsCloud

Servers updated in place over their lifetime (patches, config changes, deploys onto the same machine). Familiar and flexible, but machines slowly drift apart and become hard to reproduce.

“Ten years of in-place updates left every server slightly different.”

DevOps

A server configured by hand over time until it's unique, undocumented and impossible to reproduce, so everyone is afraid to touch or reboot it. The opposite of servers built from code.

“That box is a snowflake; if it dies, nobody knows how to rebuild it.”

DevOps

A metaphor: pets are named servers you nurse back to health when they're ill; cattle are numbered, identical instances you replace without a second thought. Cloud-native operations treat servers as cattle.

“Treat nodes as cattle: if one misbehaves, terminate it and let the autoscaler replace it.”

DevOpsCloud

Packer, AMI

A pre-built, hardened and patched machine image (or base container image) used as the standard starting point for every instance. HashiCorp Packer builds VM images from code, and rebuilding golden images regularly is how immutable infrastructure stays patched.

“Bake the monitoring agent into the golden image instead of installing it at boot.”

DevOpsSecurity

cloud-init is the standard tool that configures a cloud VM on first boot from the user data supplied at launch: users, packages, files and scripts. Keep it short; heavy setup belongs in a golden image.

“The user-data script installs the agent and registers the node on first boot.”

DevOpsCloud

OPA, Kyverno, Sentinel

Writing organizational rules (no public buckets, encryption required, approved regions only, mandatory tags, resource limits on every pod) as code that is evaluated automatically in CI, at plan time and at Kubernetes admission. Tools include Open Policy Agent (Rego), Kyverno, Sentinel and Checkov.

“Policy as code blocked the plan because the bucket isn't encrypted.”

DevOpsSecurityPlatform

Checkov, tfsec, Trivy