Linux Server Glossary: 60 Terms Explained in Plain English

Jargon is the real barrier to running a server. This is every term the series leaned on, in one place, each in a sentence or two, with the tutorial number in brackets if you want the long version. Bookmark it next to the cheat sheet (40) and the troubleshooting checklist (80).

• Linux / distribution (distro): the kernel (Linux) plus the tools around it; Ubuntu, Debian and Raspberry Pi OS are distributions that package them differently. (1, 38)
• LTS: long-term support — a release that gets security updates for five years. Install these. (1, 73)
• Kernel: the core of the OS that talks to hardware. Updates to it need a reboot. (5)
• root: the all-powerful admin account. You don't log in as it; you borrow it with sudo. (4)
• sudo: run one command as root, after a password check, with a log entry. (4)
• Shell / terminal / bash: the text interface you type commands into; bash is the program interpreting them. (10, 60)
• Service / daemon: a program that runs in the background all the time; managed with systemctl. (13)
• systemd: the system that starts services at boot and keeps them running; journalctl reads its logs; timers are its cron. (13, 14, 69)
• cron / crontab: the classic scheduler — a line per job with five time fields. (20)
• Package / apt: software comes as packages; apt installs, updates and removes them from repositories. (5, 63)
• Repository (apt): a server full of packages. Ubuntu's are default; projects add their own. (63)
• Snap: Ubuntu's self-contained package format; heavier than apt, last resort on a server. (63)
• Environment variable: a named value a program reads at start (TZ=Europe/London). Containers are configured almost entirely with them. (25, 59)

• Filesystem: how data is organised on a disk — ext4 (default), ZFS (checksums, snapshots), NTFS/exFAT (Windows/camera drives). (22, 97)
• Mount / mount point: attaching a disk so its files appear in a folder; fstab does it at boot. (22)
• UUID: a drive's permanent ID, used in fstab because /dev/sdb changes. (22)
• Partition: a slice of a disk; LVM adds a flexible layer on top that can grow. (64)
• Permissions / chmod / chown: who can read, write and run a file; 644 for files, 755 for folders. (11)
• Swap: disk space used as overflow memory. (21)
• inode: a file's slot in the filesystem; running out looks like a full disk with free space. (15)
• RAID / mirror / parity: combining drives so one can fail — RAID 1 mirrors, SnapRAID keeps parity, ZFS mirror does it with checksums. Not a backup. (97, 98, 99)
• Snapshot: an instant, read-only copy of a filesystem or VM at a moment; free until things change. (81, 97)
• SMART: the health data a drive reports about itself. (56)
• Backup vs sync: a backup keeps old versions somewhere else; sync just mirrors, deletions included. (23, 52, 55)
• Deduplication: storing identical blocks once — why restic's second backup is tiny. (55)

• IP address / subnet: a device's address (192.168.1.50) and the range it belongs to (192.168.1.0/24 = the first three numbers fixed). (8)
• DHCP / reservation: the router handing out addresses; a reservation makes one permanent. (8)
• DNS: turns names into addresses. Pi-hole filters it; Unbound resolves it yourself; dynamic DNS keeps a name pointing at a changing home IP. (34, 48, 83)
• Port: a numbered door on an address; 22 SSH, 80 web, 443 HTTPS. Port forwarding opens one from the internet to a device. (6, 27)
• Firewall / UFW: decides which ports accept connections. (6, 105)
• NAT / CGNAT: your router sharing one public IP among the house; carrier-grade NAT means the ISP shares it among customers and port forwarding won't work. (33, 47)
• SSH: encrypted remote login; keys replace passwords; tunnels carry other ports through it. (2, 3, 62)
• VPN / WireGuard / Tailscale: an encrypted tunnel that makes a remote device part of your home network. (33, 47, 108)
• Reverse proxy: one web server (Nginx, Caddy, NPM) in front of many apps, routing by name and adding HTTPS. (28, 57, 58)
• TLS / HTTPS / certificate / Let's Encrypt: encryption for web traffic, proven by a certificate from a free authority, fetched by Certbot or Caddy. (27)
• Bridge (network): a virtual switch — Docker's private container networks, or the one that puts a VM on your LAN. (81, 101)
• MAC address: a network card's hardware ID; used for reservations and Wake-on-LAN. (8, 79)
• MQTT / broker: a tiny publish/subscribe messaging protocol smart-home devices use; Mosquitto is the broker in the middle. (96)
• SMB / Samba / NFS: file-sharing protocols — Samba for Windows and Mac clients, NFS between Linux machines. (31, 53)
• SFTP / SCP / rsync: copying files over SSH; rsync only sends what changed. (18)
• Tunnel (Cloudflare): an outbound connection that lets Cloudflare forward web visitors to you without any open port. (109)

• Container: an app with everything it needs, running isolated on the shared kernel. Lighter than a VM. (24)
• Image: the template a container starts from, downloaded from a registry (Docker Hub, ghcr.io) or built from a Dockerfile. (24, 102)
• Compose / compose.yaml: a file describing one or more containers and how they connect; docker compose up -d runs it. (25)
• Volume / bind mount: where a container's data lives on the host so it survives the container. (24, 65)
• Published port (ports:): making a container's port reachable from outside Docker. Bypasses UFW unless fixed. (24, 105)
• Tag: an image version (nextcloud:30, latest). Pin for apps with migrations. (50)
• Host networking / macvlan: a container sharing the server's network, or getting its own LAN address. (41, 101)
• Virtual machine (VM) / KVM / hypervisor: a whole emulated computer with its own OS; KVM is Linux's built-in hypervisor. (81)

• 2FA / TOTP: a second factor — the six-digit code from an authenticator app. (70)
• Brute force: guessing passwords by the thousand; Fail2ban and CrowdSec ban the guessers. (7, 107)
• SSO / forward auth: one login in front of many apps, via the reverse proxy; Authelia. (95)
• Append-only: a backup target that accepts new data but lets nothing be deleted — ransomware protection. (116)
• Chroot / jail: confining a user to one folder; SFTP-only accounts. (72)
• Secret / token / API key: a password-like string a program uses; keep them in .env files, not in compose files or scripts. (59)
• Least privilege: give each thing only the access it needs — a user per client, a database user per app, write-only tokens. (29, 93, 116)

• Uptime monitor / dead-man's switch: one tells you something is down (Uptime Kuma); the other tells you something didn't happen (Healthchecks). (35, 104)
• Metrics / Prometheus / Grafana: numbers collected over time and the dashboards that draw them. (90)
• Logs / logrotate: what programs write about themselves; rotation stops them filling the disk. (14, 67)
• Load average: how many processes want the CPU, averaged over 1, 5 and 15 minutes; compare to core count. (16)
• OOM killer: what the kernel does when memory runs out — kills the biggest process. Swap and container limits prevent it. (21, 68)
• Idempotent: a script or command that's safe to run twice. Good backup scripts and compose files are. (23, 25)
• Runbook: written steps for "when X happens, do Y". Tutorial 80 is one; BookStack is where to keep yours. (80, 88)
• UPS / NUT: a battery for power cuts and the software that shuts the server down cleanly on it. (100)
• Wake-on-LAN: switching a machine on with a network packet. (79)

If a word in any tutorial made you pause, it's probably above. Read the definition, follow the number, and come back here next time — fluency in this vocabulary is most of what separates "I run a server" from "I'm scared of the server".