LFCA key terms

The core part of an operating system that manages memory, schedules processes, and controls access to hardware. User programs request these services through system calls rather than touching hardware directly.

A command-line program that reads what you type, interprets it, and asks the kernel to run programs. Common examples are bash, zsh, and sh; it also handles variables, pipes, and redirection.

A convention describing where files belong on Linux systems, such as /etc for configuration, /var for changing data, /home for users, and /usr for installed software. It keeps layouts predictable across distributions.

A file location written from the root directory, starting with a slash, for example /etc/ssh/sshd_config. It identifies the same file regardless of your current working directory.

A file location interpreted from the current working directory, such as logs/app.log or ../bin/run. It only makes sense in context, so scripts often prefer absolute paths for reliability.

An operator, written as a vertical bar, that sends the standard output of one command into the standard input of the next. It lets small tools be combined into powerful command pipelines.

The default stream where a program writes normal results, usually the terminal. It can be redirected to a file or piped to another command, and is numbered file descriptor 1.

A separate stream for error and diagnostic messages, numbered file descriptor 2. Keeping it apart from normal output lets you log errors without mixing them into real results.

Changing where a command's input or output streams go, using symbols such as greater-than for files and less-than for input. It is how you save output to files or read from them.

A running instance of a program, with its own memory, open files, and identity. Each has a process ID, a parent, and a state such as running, sleeping, or stopped.

The process identifier, a number the kernel assigns to each running process. Tools like ps, top, and kill use it to display information about or act on a specific process.

A short asynchronous message the kernel delivers to a process, such as SIGTERM asking it to stop or SIGKILL forcing it to end. Programs can catch some signals and ignore others.

The read, write, and execute flags set separately for a file's owner, group, and everyone else. They are shown by ls -l and changed with chmod, and control who may access a file.

A command that changes permission bits on files and directories, either symbolically like u+x or numerically like 640. It affects access rights but not who owns the file.

The user and group assigned to a file, which determine how permission bits apply. Only the owner or a privileged user can change them, typically with chown and chgrp.

A program that lets permitted users run commands as another user, usually root, after authenticating. Its policy is configured in /etc/sudoers, and it is preferred over sharing a root password.

The superuser account with unrestricted access to the system, identified by user ID zero. Routine work should be done as an ordinary user, escalating only when needed.

A tool that installs, upgrades, and removes software along with its dependencies, using signed repositories. Examples include apt, dnf, and zypper, each with its own metadata and cache.

A server or collection that hosts packaged software and its metadata for a package manager. Systems fetch index files from configured repositories before installing or upgrading anything.

Software that another package needs in order to run or build correctly. Package managers resolve these relationships automatically, which is a main reason to use them instead of manual installs.

A configuration file describing something systemd manages, such as a service, mount, or timer. Units declare how to start, stop, and order components during boot and normal operation.

The command used to control systemd, for example to start, stop, enable, or check the status of units. Enabling a unit makes it start automatically at boot.

A long-running background program, such as a web server or database, usually managed by an init system. Administrators start, stop, and monitor services rather than running them by hand.

A scheduler that runs commands at specified times using entries in crontab files. Each entry lists minute, hour, day, month, and weekday fields followed by the command to execute.

A directory where an additional filesystem is attached and made visible in the tree. Tools like mount and the file /etc/fstab define and persist these attachments.

A contiguous region of a storage device treated as a separate block device, often holding one filesystem. Partition tables describe their boundaries and are edited with tools like fdisk or parted.

A record of events written by programs and the system, commonly under /var/log or the systemd journal. Logs are the first place to look when diagnosing failures.

A software-defined computer that runs its own operating system on emulated or virtualized hardware. A hypervisor provides the isolation and resource allocation between guests and the host.

Software that creates and runs virtual machines, allocating CPU, memory, and devices among them. It may run directly on hardware or on top of a host operating system.

An isolated process or group of processes sharing the host kernel, packaged with its own filesystem and settings. Containers start quickly and are lighter than virtual machines but share kernel security boundaries.

A read-only, layered template containing a filesystem and metadata used to start containers. Images are built from instructions, stored in registries, and referenced by name and tag.

A service that stores and distributes container images by name and tag. Clients pull images from it and push new ones, and access is often controlled by authentication.

A cloud service that stores data as discrete objects with keys and metadata inside buckets, rather than in a hierarchical filesystem. It scales well for backups, media, and static assets.

Cloud storage presented as a raw device that you format with a filesystem and mount, similar to a local disk. It suits databases and workloads needing low-latency random access.

A named container for objects in object storage. Names are often globally unique, and access is governed by policies attached to the bucket or to individual objects.

Automatically adding or removing compute capacity in response to demand or a schedule. It improves availability during peaks and reduces cost during quiet periods, within configured limits.

A service that distributes incoming requests across several backends and can detect unhealthy ones. It improves availability and lets capacity change without clients knowing addresses.

The principle of granting only the access needed to perform a task, and no more. It limits the damage from mistakes and compromised accounts, and applies to users, services, and roles.

A document that states which identities may perform which actions on which resources, often with conditions. Policies are evaluated by the cloud provider when a request is made.

A public and private key used to authenticate to remote systems without sending a password. The public half is placed on the server, while the private half stays secret on the client.

A scheme using a key pair, where one key encrypts or verifies and the other decrypts or signs. It underpins secure connections, signatures, and certificate-based trust.

A signed statement binding a public key to a hostname, issued by a certificate authority. Clients use it to verify identity and negotiate encrypted connections, and it expires.

A filter that permits or blocks network traffic according to rules about addresses, ports, and protocols. Host firewalls protect a single machine; cloud security groups act similarly per instance.

A cloud-level set of allow rules controlling traffic to and from resources such as instances. Rules are usually stateful and default to denying everything not explicitly permitted.

A system that records changes to files over time so you can review history, compare versions, and revert. It also enables branching and collaboration among several contributors.

A snapshot of the tracked files plus metadata such as author, message, and parent commit. Commits form a history that can be inspected, compared, and reverted.

A movable pointer to a line of commits in version control, used to develop changes apart from the main line. Branches can later be merged or discarded.

Combining the changes from one branch into another, either by joining histories or by replaying commits. Conflicts arise when both sides changed the same lines and must be resolved manually.

An automated sequence that builds, tests, and delivers or deploys software after changes. Pipelines make releases repeatable and surface failures early, before they reach users.

Managing servers, networks, and other resources through versioned definition files instead of manual steps. It makes environments reproducible, reviewable, and easier to rebuild consistently.

A named value held by a process and inherited by the programs it starts. Applications commonly read configuration and secrets from them, so they differ between environments.

A defined interface through which one program requests data or actions from another, usually over HTTP. It specifies endpoints, request formats, responses, and error behavior.

A style of web API using HTTP methods and resource-oriented URLs, such as GET on a collection. It is stateless, so each request carries everything needed to understand it.

Verifying that a user, service, or client is who it claims to be, for example with a password, key, or token. It is distinct from authorization, which decides what that identity may do.

A text format for structured data built from objects, arrays, strings, numbers, and booleans. It is the common payload format for web APIs and configuration files.

Software that accepts HTTP requests and returns responses, serving static files or forwarding to applications. Examples include nginx and Apache, often placed behind a load balancer.

A server that receives client requests and forwards them to backend applications, optionally caching or terminating encryption. It hides internal topology and centralizes TLS and routing rules.

A distinct deployment target such as development, staging, or production, with its own configuration and data. Keeping them separate prevents test changes from affecting real users.