Glossary

Words in the chapters with a dashed underline link here, and hovering one shows you the first line of its entry. Definitions are deliberately short and occasionally a little loose, in the service of being useful the first time you meet the word.

Getting onto the machine #

SSH #

A protocol for getting a shell on another machine over an encrypted connection, and the program that speaks it. Also carries file transfers and forwarded network ports over the same connection.

SSH agent #

A small program that holds your decrypted private key in memory so you type its passphrase once per login to your laptop rather than once per connection. ssh-add puts a key into it.

Public key authentication #

Proving who you are by signing a challenge with a private key, rather than by sending a password. The server holds only the public half, in ~/.ssh/authorized_keys.

known_hosts #

The file on your laptop recording the public key each server presented the first time you connected. A mismatch on a later connection is the warning that you may not be talking to the same machine.

sudo #

A command that runs another command as a different user, normally root, if policy permits, and logs that it happened. The reason you do not need to log in as root.

The operating system #

systemd #

The thing that starts, stops and supervises everything else on a modern Linux system. Units describe what should run; systemctl inspects and controls them.

unit #

One thing systemd manages. A .service is a program to run, a .timer runs something on a schedule, a .socket holds a network port and starts a service when something connects.

journalctl #

The reader for systemd's logs. Everything most services print ends up here rather than in a text file, and it can be filtered by unit, by boot and by time.

unattended-upgrades #

The Debian and Ubuntu mechanism for installing package updates on a timer without you being present. Configurable down to which origins it will take updates from.

Storage #

LVM #

Logical Volume Manager. A layer between partitions and filesystems: physical volumes join into a volume group, and logical volumes are carved out of the group. Volumes can be grown and snapshotted without repartitioning, which is why your root filesystem may be smaller than your disk.

snapshot #

A point-in-time view of a volume, often cheap to create and useful for undoing an upgrade. A block snapshot of a running database is normally crash-consistent, not application-consistent, unless the database is quiesced or its own backup mechanism participates. It is not an off-machine backup.

bind mount #

Presenting a directory from the host inside a container at a different path. The files stay on the host, which is what makes container data survive the container.

The firewall #

UFW #

The Uncomplicated Firewall. Ubuntu and Debian's friendly front end for the packet filter built into the Linux kernel. It writes rules; it does not enforce them itself.

netfilter #

The packet filtering machinery inside the Linux kernel. You talk to it through iptables or nftables, and tools like ufw talk to it on your behalf.

chain #

An ordered list of firewall rules a packet walks through. INPUT is for packets addressed to this machine, OUTPUT for packets it sends, and FORWARD for packets it routes onward to somewhere else.

connection tracking #

The kernel remembering which conversations are already in progress, so replies to something you started are let back in without needing a rule of their own.

DOCKER-USER #

A chain Docker creates with nothing in it but a RETURN, so you have somewhere to add rules that are evaluated before Docker's own accept rules.

Repeatability #

idempotent #

Describing an operation where doing it twice has the same effect as doing it once. The property that makes it safe to reapply a configuration without checking first.

drift #

When a machine stops matching what you believe about it, usually because of a change somebody made by hand and did not write down.

playbook #

In Ansible, a YAML file describing the state a machine should be in. Applied over SSH, with no agent installed on the far end.

handler #

A task that runs only when another task reports that it changed something. How you reload a service after editing its configuration, and not otherwise.

Containers #

container #

A process running with a restricted view of the machine: its own filesystem, process table and network, enforced by kernel namespaces. Cgroups can account for and limit its resource use when limits are configured. It is not a virtual machine; it shares the host kernel.

image #

The packaged, read-only filesystem a container is started from. One image, many containers, each with its own thin writable layer.

digest #

A hash of an image's exact content, written like sha256:c4717a…. Unlike a tag, it cannot be moved to point at different software later.

namespace #

The kernel feature that limits what a process can see: which files, which other processes, which network interfaces.

cgroup #

The kernel feature that accounts for and can limit what a process uses: memory, CPU, I/O and number of processes. A cgroup alone does not imply a useful limit was set.

publishing a port #

Making a container's port reachable on the host, with -p. The host address you publish to decides who can reach it, and whether your firewall gets a say.

Networking #

loopback #

The 127.0.0.0/8 range, usually seen as 127.0.0.1, which only the machine itself can reach. A service listening only on loopback is invisible to your network.

subnet #

A range of addresses treated as one local network, written like 192.168.1.0/24. The number after the slash says how many leading bits are fixed, so a /24 is 256 addresses.

port #

A number that says which service on a machine a connection is for. 22 is SSH by convention, 80 and 443 are web traffic.

reverse proxy #

A server that accepts incoming web requests and forwards each one to whichever application should handle it, usually deciding by the hostname asked for. Lets many applications share one port.

DHCP #

The way most home routers hand out addresses automatically. Convenient, and the reason your server's address can change after a reboot unless you reserve it.