8. Glossary

AppImage — Portable application format; self-contained executable, no installation required.

AppArmor — MAC system (default on Ubuntu/Debian) using path-based profiles; simpler than SELinux.

auditd — Kernel audit daemon that writes tamper-evident records to /var/log/audit/audit.log.

btrfs — Copy-on-write filesystem with built-in snapshot and RAID capabilities.

cgroup — Control group; kernel mechanism for limiting and accounting resource usage per process group. Foundation of container resource limits.

chroot — Changes the apparent root directory for a process; used in recovery and sandboxing.

cloud-init — Standard cloud VM initialization system; runs user data scripts on first boot.

containerd — Industry-standard container runtime; used by Kubernetes.

cron — Time-based job scheduler; runs commands based on scheduled times in crontab.

DAC (Discretionary Access Control) — Standard Unix permissions; controlled by the file owner.

DNAT (Destination NAT) — Rewrites destination IP/port of incoming packets; used for port forwarding.

Docker — Container platform using a centralized daemon (dockerd); produces OCI-compliant images.

dracut — Initramfs creation tool used on RHEL/Fedora systems.

ECC memory — Error-Correcting Code memory; detects and corrects single-bit memory errors. Used in servers.

ext4 — Fourth extended filesystem; journaling, mature, default on many Debian-based systems.

firewalld — Zone-based firewall management daemon; front-end for nftables/iptables.

FQDN (Fully Qualified Domain Name) — Complete domain name with all labels: mail.example.com.

GPG (GNU Privacy Guard) — OpenPGP implementation for file encryption and signing.

GPT (GUID Partition Table) — Modern partition table format supporting disks > 2TB and up to 128 partitions.

inode — Data structure storing file metadata (permissions, owner, timestamps, block pointers); every file has one.

IaC (Infrastructure as Code) — Managing infrastructure through version-controlled declarative configuration files.

initramfs — Temporary root filesystem loaded by the kernel early in boot to load drivers before mounting real root.

iptables — Legacy Linux packet filtering tool; now typically a front-end for nftables.

KVM (Kernel-based Virtual Machine) — Type 1 hypervisor built into the Linux kernel; used with QEMU.

libvirt — Abstraction API for managing hypervisors (KVM, Xen, VMware); virsh is its CLI.

LUKS2 — Linux Unified Key Setup version 2; standard Linux full-disk encryption with Argon2id key derivation.

LVM (Logical Volume Manager) — Flexible storage layer between partitions and filesystems; enables online resize.

MAC (Mandatory Access Control) — System-enforced access policy that overrides DAC; SELinux and AppArmor implement this.

MBR (Master Boot Record) — Legacy partition table format; limited to 2TB disks and 4 primary partitions.

MTBF — Mean Time Between Failures; average operational time between failures.

MTTR — Mean Time To Recover; average time to restore service after an outage.

namespace — Kernel mechanism for isolating process views of resources (network, PID, filesystem, users); foundation of containers.

nftables — Modern Linux packet filtering framework replacing iptables; cleaner syntax, better performance.

nohup — Runs a command immune to SIGHUP (terminal hangup); used with & to background persistent jobs.

OOM killer — Kernel mechanism that terminates processes when memory is exhausted; selects based on oom_score.

PAM (Pluggable Authentication Modules) — Authentication abstraction layer; all Linux authentication goes through PAM.

Podman — Daemonless, rootless container runtime; Docker-compatible CLI.

POSIX — Portable Operating System Interface; standards ensuring compatibility across Unix-like systems.

qcow2 — QEMU Copy-On-Write 2; standard KVM disk image format supporting snapshots and sparse allocation.

RAID — Redundant Array of Independent Disks; combines multiple disks for redundancy and/or performance.

RPO (Recovery Point Objective) — Maximum acceptable data loss (time since last backup).

RTO (Recovery Time Objective) — Maximum acceptable downtime before recovery must be complete.

SELinux — Security-Enhanced Linux; NSA-developed MAC system enforcing type-enforcement and RBAC policies.

SMART — Self-Monitoring, Analysis and Reporting Technology; hard drive health monitoring.

SNAT (Source NAT) — Rewrites source IP of outgoing packets; masquerade is dynamic SNAT.

SSSD — System Security Services Daemon; provides caching layer for LDAP/AD authentication.

systemd — PID 1 init system managing units (services, timers, mounts, targets) on most modern Linux distros.

tmpfs — RAM-backed temporary filesystem; contents lost on reboot. Used for /tmp and /run.

umask — Permission mask subtracted from default permissions (666 for files, 777 for dirs) for new files.

VirtIO — Paravirtualized I/O driver interface for KVM guests; provides near-native disk and network performance.

virsh — CLI client for libvirt; manages KVM/QEMU VMs through the libvirt API.

WireGuard — Modern, minimal VPN built into the Linux kernel; uses ChaCha20/Poly1305 cryptography.

xfs — High-performance journaling filesystem; default on RHEL; online grow only (no shrink).

CompTIA Linux+ XK0-006 Study Guide — Mindmesh Academy First-Principles Approach to Linux Systems Administration