Skip to content
Flowchart Learning

VOCABULARY

Production Engineering Vocabulary & Glossary

Section titled “Production Engineering Vocabulary & Glossary”

Comprehensive Glossary of Production Engineering, SRE, Linux Internals, Observability, HA/DR, and Security Concepts

Section titled “Comprehensive Glossary of Production Engineering, SRE, Linux Internals, Observability, HA/DR, and Security Concepts”

A

Section titled “A”
  • ACL (Access Control List): Fine-grained filesystem or network permission mechanism extending traditional UNIX permissions.
  • Alert Fatigue: The exhaustion experienced by engineers overwhelmed by frequent, non-actionable alerts.
  • AppArmor: Mandatory Access Control (MAC) Linux Security Module restricting process capabilities via profile paths.
  • Auditd: The Linux Audit Framework daemon for tracking security-relevant system events, syscalls, and file modifications.

B

Section titled “B”
  • Bastion Host: A hardened jump server providing secure access to isolated internal infrastructure network zones.
  • Benchmarking: The systematic measurement of workload performance, throughput, IOPS, and latency under synthetic load.
  • BPF / eBPF (Extended Berkeley Packet Filter): Kernel execution engine allowing sandboxed programs to run safely in kernel space without loading kernel modules.

C

Section titled “C”
  • Capacity Planning: Predicting future infrastructure resource requirements based on growth metrics, saturation, and trend forecasting.
  • cgroups (Control Groups): Linux kernel feature for limiting, accounting, and isolating CPU, memory, I/O, and network usage of process groups.
  • Chaos Engineering: The discipline of experimenting on a production system to build confidence in its capability to withstand turbulent conditions.
  • Circuit Breaker: A software design pattern that halts execution of requests to failing downstream services to prevent cascade failures.

D

Section titled “D”
  • DAC (Discretionary Access Control): Standard UNIX permission model based on file ownership and permission bits (rwx).
  • DAST (Dynamic Application Security Testing): Testing application security by analyzing running applications in an operational state.
  • DPDK (Data Plane Development Kit): Fast packet-processing libraries bypassing the Linux kernel network stack for high-throughput networking.
  • Disaster Recovery (DR): Practices, policies, and procedures enabling the recovery or continuation of vital infrastructure following a disaster.

E

Section titled “E”
  • Error Budget: The acceptable amount of unreliability allocated to a system before feature development is paused in favor of stability work.
  • etcd: A strongly consistent, distributed key-value store used primarily as Kubernetes’ cluster state storage layer.

F

Section titled “F”
  • Failover: The automatic or manual switching to a redundant or standby system upon failure of the active operational component.
  • Falco: A runtime security threat detection tool using eBPF to monitor Linux system calls and generate security alerts.
  • Flamegraph: A visualization of profiled stack traces allowing intuitive identification of code paths consuming CPU or memory.

G

Section titled “G”
  • Golden Signals: The four primary observability metrics for monitoring user-facing systems: Latency, Traffic, Errors, and Saturation.
  • GRUB (Grand Unified Bootloader): The default bootloader for Linux operating systems, responsible for loading the Linux kernel into memory.

H

Section titled “H”
  • HAProxy: High-performance, open-source TCP/HTTP load balancer and proxy server.
  • High Availability (HA): System architecture designed to ensure a high level of operational uptime without single points of failure.
  • HugePages: Linux memory management feature allowing pages larger than the default 4KB (typically 2MB or 1GB) to reduce TLB misses.

I

Section titled “I”
  • Incident Response: The structured methodology for detecting, containing, mitigating, and resolving production outages or security incidents.
  • initramfs: Initial RAM filesystem loaded into memory during boot to provide early drivers and mount the real root filesystem.
  • IOPS (Input/Output Operations Per Second): Standard metric measuring storage performance for read and write operations.

K

Section titled “K”
  • KASLR (Kernel Address Space Layout Randomization): Security technique randomizing kernel address memory space layout to mitigate exploit attempts.
  • kdump: Linux kernel crash dumping mechanism using kexec to capture kernel memory dumps (vmcore) upon kernel panic.
  • Keepalived: Routing software providing high availability via Virtual Router Redundancy Protocol (VRRP) and load balancer health checks.
  • Kubernetes (K8s): Open-source container orchestration platform automating deployment, scaling, and management of containerized workloads.

L

Section titled “L”
  • Load Balancing: Distributing incoming network traffic across multiple servers to optimize resource use, throughput, and reliability.
  • LSM (Linux Security Module): Framework providing hook architecture allowing security modules (SELinux, AppArmor) to enforce MAC policies.

M

Section titled “M”
  • MAC (Mandatory Access Control): Security model restricting subject access to objects based on centralized administrative policies (e.g., SELinux).
  • MTLS (Mutual TLS): Two-way authentication protocol where both client and server verify each other’s X.509 digital certificates.
  • Metrics: Aggregated numerical measurements collected over time intervals to analyze system state and performance trends.

N

Section titled “N”
  • Namespaces: Linux kernel feature isolating system resources (PID, NET, MNT, IPC, UTS, USER, cgroup) for containerization.
  • NUMA (Non-Uniform Memory Access): Multiprocessing memory architecture where memory access time depends on memory location relative to the processor.

O

Section titled “O”
  • Observability: The degree to which internal states of a production system can be inferred from its external telemetry output (metrics, logs, traces).
  • OOM Killer (Out-Of-Memory Killer): Linux kernel process that terminates processes when available system memory drops dangerously low.
  • OpenTelemetry (OTel): Vendor-neutral framework and standard for collecting, generating, and exporting telemetry data.

P

Section titled “P”
  • PAM (Pluggable Authentication Modules): Modular architecture for managing authentication services on Linux systems.
  • Page Cache: Linux kernel memory allocation mechanism caching disk reads/writes in RAM to accelerate filesystem I/O.
  • PKI (Public Key Infrastructure): System of digital certificates, certificate authorities, and cryptographic keys used for authentication and encryption.
  • Postmortem: Blameless analysis conducted after an incident to uncover root causes and generate preventive action items.

Q

Section titled “Q”
  • QoS (Quality of Service): Mechanisms managing network bandwidth, latency, jitter, and error rate for critical traffic.

R

Section titled “R”
  • RED Method: Observability monitoring framework measuring Rate, Errors, and Duration (Latency) for request-driven services.
  • Root Cause Analysis (RCA): Structured problem-solving technique for discovering the fundamental causes of system failures.
  • RPO (Recovery Point Objective): Maximum acceptable duration of data loss measured in time prior to a failure event.
  • RTO (Recovery Time Objective): Target duration of time within which a business process or system must be restored after a service outage.

S

Section titled “S”
  • SAST (Static Application Security Testing): Source code analysis methodology identifying security vulnerabilities without executing code.
  • SELinux (Security-Enhanced Linux): NSA-developed Linux Security Module enforcing Mandatory Access Control via domain transition rules.
  • SLI (Service Level Indicator): Quantifiable metric measuring service performance (e.g., percentage of successful HTTP requests).
  • SLO (Service Level Objective): Target goal for service reliability defined as a threshold of an SLI over a specified time window.
  • SLA (Service Level Agreement): Contractual commitment defining service expectations between a provider and customer, including penalties for violation.
  • SRE (Site Reliability Engineering): Discipline applying software engineering principles to infrastructure and operations problems.
  • sysctl: Subsystem and command used to read and modify Linux kernel configuration parameters at runtime (/proc/sys).

T

Section titled “T”
  • TLB (Translation Lookaside Buffer): CPU hardware cache storing recent virtual-to-physical address memory translations.
  • Toil: Manual, repetitive, operational work that can be automated, scales linearly with service growth, and lacks enduring value.
  • Traces: Telemetry data tracking the end-to-end execution path of a single request across multiple microservice boundaries.

U

Section titled “U”
  • USE Method: Systems performance methodology evaluating Utilization, Saturation, and Errors for all hardware resources.

V

Section titled “V”
  • VFS (Virtual File System): Kernel abstraction layer allowing user-space software to interact with diverse filesystems via a uniform API.
  • VRRP (Virtual Router Redundancy Protocol): Network protocol automatically assigning virtual routers to participating IP hosts for gateway redundancy.

X

Section titled “X”
  • XDP (eXpress Data Path): eBPF-based high-performance packet processing framework executing at the network driver level.

Z

Section titled “Z”
  • Zero Trust Architecture: Cybersecurity framework requiring continuous verification of all users, devices, and requests regardless of location.
  • ZFS: Advanced copy-on-write combined file system and logical volume manager providing checksum integrity and snapshot capabilities.