Reference · 63 terms
Glossary
Every short form used across the series. Inside a lesson, hover or tap any dotted term to see the same entry in place.
Containers
- cgroupControl group (cgroup)
- A kernel feature that limits and counts the CPU, memory and processes a group of processes may use.Lesson 0 →
- containerContainer
- A normal process that the Linux kernel isolates with namespaces and limits with cgroups, running from an image.Lesson 0 →
- imageContainer image
- A read-only stack of file layers plus a little config that a container starts from.Lesson 0 →
- image digestImage digest
- The SHA-256 fingerprint of an exact image, which never changes for the same content (unlike a tag).Lesson 0 →
- namespace (Linux)Linux namespace
- A kernel feature that gives a process its own private view of one thing, such as process IDs, network or hostname.Lesson 0 →
- PID 1PID 1 (the first process)
- The first process in a container, which does not get the default kill-on-SIGTERM action, so apps must handle the signal.Lesson 0 →
- registryImage registry
- A server that stores and serves container images, such as Docker Hub.Lesson 0 →
Dockerfile
- .dockerignore.dockerignore file
- A file listing paths to leave out of the build context so secrets and junk do not enter the image.Lesson 1 →
- build cacheDocker build cache
- Docker reuses a saved layer when a step and its inputs are unchanged, but reruns every step after the first change.Lesson 1 →
- DockerfileDockerfile
- A text file of instructions that tells Docker how to build an image, layer by layer.Lesson 1 →
- ENTRYPOINTENTRYPOINT and CMD
- ENTRYPOINT is the fixed program a container runs, and CMD is the default, replaceable arguments or command.Lesson 1 →
- exec formExec form vs shell form
- The JSON-array way to write CMD runs your program directly as PID 1, while shell form runs it through /bin/sh.Lesson 1 →
- hadolinthadolint
- A linter that reads a Dockerfile and warns about bad habits such as using the latest tag or running as root.Lesson 1 →
- multi-stage buildMulti-stage build
- A Dockerfile with several FROM lines where early stages build things and only the last stage becomes the final image.Lesson 1 →
Docker runtime
- bind mountBind mount
- A host folder mounted into a container at a chosen path, handy for development.Lesson 2 →
- Docker socketDocker socket
- The file that is the door to the Docker daemon, so mounting it into a container gives that container root on the host.Lesson 2 →
- Linux capabilitiesLinux capabilities
- Small slices of root's power; containers get a reduced default set and you can drop them all with --cap-drop ALL.Lesson 2 →
- published portPublished port
- A host port that Docker forwards to a container port, bound to all interfaces unless you give 127.0.0.1.Lesson 2 →
- user-defined networkUser-defined bridge network
- A private virtual network you create so containers can find each other by name through Docker's built-in DNS.Lesson 2 →
- volumeDocker volume
- Storage managed by Docker that lives outside any one container and survives its removal.Lesson 2 →
Docker Compose
- depends_ondepends_on
- Compose setting for start order, which only waits for readiness when you add condition: service_healthy.Lesson 3 →
- Docker ComposeDocker Compose
- A tool that runs a whole multi-container app on one machine from a single YAML file.Lesson 3 →
- healthcheckContainer health check
- A command Docker runs on a timer inside a container to learn whether the program is ready.Lesson 3 →
Kubernetes
- control planeKubernetes control plane
- The API server, etcd, scheduler and controller manager that decide what should run, without running your app.Lesson 4 →
- DeploymentDeployment
- An object that manages ReplicaSets to give scaling, rolling updates and rollbacks.Lesson 4 →
- kubeletkubelet
- The agent on each node that starts and watches the containers of the Pods assigned to that node.Lesson 4 →
- KubernetesKubernetes
- A system that runs and manages containers across many machines and keeps them matching the state you declared.Lesson 4 →
- label selectorLabels and selectors
- Labels are key and value tags on objects, and a selector picks every object whose labels match.Lesson 4 →
- manifestKubernetes manifest
- A YAML file describing Kubernetes objects with apiVersion, kind, metadata and spec.Lesson 4 →
- PodPod
- The smallest thing Kubernetes runs: one or more containers that share a network, volumes and a node.Lesson 4 →
- reconcile loopReconcile loop
- A controller loop that compares desired state with current state and acts to close the gap, over and over.Lesson 4 →
- ReplicaSetReplicaSet
- An object that keeps a set number of identical Pods running.Lesson 4 →
Kubernetes networking
- EndpointSliceEndpointSlice
- The list of Pod addresses, and whether each is ready, that sit behind a Service.Lesson 5 →
- Gateway APIGateway API
- The newer, richer set of add-on resources for routing traffic into a cluster, recommended over the frozen Ingress API.Lesson 5 →
- IngressIngress
- An object holding HTTP and HTTPS routing rules from outside the cluster to Services, which needs an Ingress controller to act.Lesson 5 →
- NetworkPolicyNetworkPolicy
- An object that restricts which Pods may talk to which, enforced only if the network plugin supports it.Lesson 5 →
- ServiceKubernetes Service
- A stable name and virtual address in front of a changing set of Pods chosen by a label selector.Lesson 5 →
Kubernetes config & storage
- base64Base64
- A way to write bytes as plain letters and digits; it is an encoding that anyone can reverse, not encryption.Lesson 6 →
- configmapConfigMap
- A Kubernetes object that stores non-secret settings as key and value pairs, used by pods as environment variables or files.Lesson 6 →
- encryption at restEncryption at rest
- Encrypting data on disk so a stolen disk or backup cannot be read; in Kubernetes it is switched on for Secrets in the API server.Lesson 6 →
- etcdetcd
- The database where Kubernetes stores every object, including Secrets.Lesson 6 →
- persistentvolumePersistentVolume (PV)
- A real piece of storage in the cluster, such as a cloud disk, that a claim can bind to.Lesson 6 →
- persistentvolumeclaimPersistentVolumeClaim (PVC)
- A pod's request for storage with a size and access mode; Kubernetes binds it to a matching volume.Lesson 6 →
- secretKubernetes Secret
- An object for sensitive values like passwords; by default it is only base64 encoded, not encrypted.Lesson 6 →
- statefulsetStatefulSet
- Like a Deployment, but each pod gets a stable name, stable DNS and its own disk, used for databases.Lesson 6 →
- storageclassStorageClass
- A recipe that tells Kubernetes how to create storage on demand, with a provisioner, binding mode and reclaim policy.Lesson 6 →
Kubernetes reliability
- cpu throttlingCPU throttling
- Slowing a container down because it used up its CPU limit for the current time period.Lesson 7 →
- horizontal pod autoscalerHorizontalPodAutoscaler (HPA)
- A controller that changes the number of pod replicas based on a metric such as CPU use.Lesson 7 →
- liveness probeLiveness probe
- A check that decides whether a container is stuck and must be restarted.Lesson 7 →
- poddisruptionbudgetPodDisruptionBudget (PDB)
- A rule that keeps a minimum number of pods available during voluntary disruptions like node drains.Lesson 7 →
- qos classQoS class
- Guaranteed, Burstable or BestEffort: a label worked out from requests and limits that sets which pods are evicted first.Lesson 7 →
- readiness probeReadiness probe
- A check that decides whether a pod receives traffic; failing it removes the pod from the Service without restarting it.Lesson 7 →
- resource requests and limitsResource requests and limits
- A request is the CPU or memory the scheduler reserves; a limit is the most the container may use.Lesson 7 →
- rolling updateRolling update
- Replacing pods a few at a time so the app stays up, paced by maxSurge and maxUnavailable.Lesson 7 →
- startup probeStartup probe
- A check that gives a slow-starting app time to start before the liveness and readiness probes begin.Lesson 7 →
Debugging containers
- crashloopbackoffCrashLoopBackOff
- A pod status meaning the container keeps crashing and Kubernetes waits longer between each restart.Lesson 8 →
- ephemeral containerEphemeral container
- A temporary extra container added to a running pod with kubectl debug, used to inspect images that have no shell.Lesson 8 →
- exit code 137Exit code 137
- The process was killed by SIGKILL (128 plus 9), often an out-of-memory kill or a stop that timed out.Lesson 8 →
- imagepullbackoffImagePullBackOff
- A pod status meaning the node cannot download the image and keeps retrying with a growing delay.Lesson 8 →
- oomkilledOOMKilled
- The kernel stopped the container because it used more memory than its limit; the exit code is 137.Lesson 8 →
- pid 1PID 1
- The first process in a container; Linux ignores signals for it unless it installs a handler, which is why stops can hang.Lesson 8 →
Docker & Kubernetes interviews
- digestImage digest
- The SHA-256 fingerprint of an image's exact content; unlike a tag, it never points to something else.Lesson 9 →
- reconcile loopReconcile loop
- A controller's endless job of comparing desired state with actual state and fixing the difference.Lesson 9 →