Concepts
Mental models and definitions that make the code understandable.
896 published
Page 9 of 9
Distributed Lock
A distributed lock grants mutual exclusion across processes through a shared store, but correctness requires leases, ownership checks, and fencing tokens.
Distributed Tracing
Distributed tracing follows one request across services with a shared trace id and timed spans, revealing where latency and failures originate.
DNS
DNS maps names to addresses and service endpoints. Its caching, TTLs, and record types shape failover speed, latency, and how users reach your system.
Encryption at Rest
Encryption at rest protects stored data, backups, and disks with keys held in a KMS. It defends against media theft but not against a compromised application or SQL injection.
Error Budget
An error budget is the allowed amount of unreliability implied by an SLO, used to balance feature delivery against reliability work.
ETag
An ETag is an HTTP validator that identifies a specific version of a resource. Clients send it back to skip unchanged responses and avoid overwriting concurrent edits.
Event Sourcing
Event sourcing stores state as an ordered append-only sequence of domain events, deriving current state by replay and enabling audit, replay, and projections.
Feature Branching
Feature branching isolates each change on its own branch until complete, giving teams parallel workspaces at the cost of long-lived divergence and harder merges.
Feature Toggle
A feature toggle is a runtime switch that decouples deployment from release, enabling staged rollouts, kill switches, experiments, and permissioned access.
GitOps
GitOps uses Git as the single source of truth for infrastructure and application state, with an automated agent continuously reconciling the cluster to match committed manifests.
Golden Signals
Golden signals are latency, traffic, errors, and saturation — four metrics that give a fast, actionable view of any service's health.
GraphQL
GraphQL exposes a typed schema that clients query for exactly the fields they need through one endpoint, trading simple HTTP caching for flexible data fetching.
gRPC
gRPC is a high-performance RPC framework using HTTP/2 and Protocol Buffers, with generated clients, streaming calls, deadlines, and typed errors across languages.
HSTS
HSTS tells browsers to use HTTPS for a site for a fixed period, blocking protocol downgrade and cookie-hijacking attacks after the first successful response.
HTTP Caching
HTTP caching stores responses and reuses them until freshness expires, then revalidates with ETag or Last-Modified validators to save bandwidth and latency.
Idempotent Consumer
An idempotent consumer records processed message ids so at-least-once delivery produces the same state as a single delivery, even after retries.
Immutable Infrastructure
Immutable infrastructure replaces servers instead of patching them: every change produces a new image, and running instances are never modified in place, removing drift.
Incident Command
Incident command assigns clear roles such as commander, communications lead, and operations lead during an outage so responders act instead of negotiating who decides.
Infrastructure as Code
Infrastructure as code defines servers, networks, and cloud resources in versioned files, so environments are reproducible, reviewable, and provisioned by automation.
Key Rotation
Key rotation replaces cryptographic keys on a schedule or after an incident while keeping old data decryptable. Versioned key IDs and automated re-encryption make rotation safe.
Leader Election
Leader election chooses one node to perform singleton work, using leases or consensus plus fencing tokens so a paused old leader cannot keep writing.
Least Privilege
Least privilege grants identities only the permissions needed for a task, for only as long as needed, reducing the blast radius of mistakes and compromise.
Load Shedding
Load shedding rejects work early when a service is saturated, protecting latency and stability for the requests it accepts instead of failing everything.
Log Levels
Log levels classify messages by severity so operators can filter noise, alert on actionable events, and control storage cost without losing critical signals.
Long Polling
Long polling holds an HTTP request open until an update or timeout arrives, giving near-real-time delivery without WebSockets or dedicated streaming protocols.
Materialized View
A materialized view stores the result of a query physically, trading freshness and write cost for fast reads of expensive aggregations or joins.
Monorepo
A monorepo keeps many projects in one repository, sharing tooling and dependencies while enabling atomic cross-project changes and a single review workflow.
Multi-Tenancy
Multi-tenancy serves many customers from shared infrastructure, requiring a tenant identity in every data path, isolation boundaries, and per-tenant resource limits.
OAuth Scopes
OAuth scopes are space-delimited strings that request and limit delegated access. Resource servers must enforce them; they do not authenticate users or replace authorization logic.
OpenAPI Contract
An OpenAPI contract is a machine-readable description of an HTTP API that drives documentation, SDK generation, validation, and drift checks in CI.
OpenID Connect
OpenID Connect adds authentication to OAuth 2.0 with a signed ID token, discovery metadata, and standard claims, enabling single sign-on across applications and providers.
Outbox Pattern
The transactional outbox pattern writes a business change and its event in one database transaction, then relays the event so other services see it exactly when the change commits.
Partition Pruning
Partition pruning skips partitions that cannot match a query predicate, turning a full-table scan into a scan of only the relevant time or key ranges.
Password Hashing
Password hashing converts passwords into slow, salted verifiers with Argon2id, bcrypt, or scrypt. Fast hashes and reversible encryption are unsafe for password storage.
Personally Identifiable Information
PII is data that can identify a specific person, alone or combined with other records. Handling direct and quasi-identifiers correctly drives privacy design.
Postmortem
A postmortem is a blameless written analysis after an incident that reconstructs the timeline, identifies contributing causes, and assigns durable follow-up actions.
Quorum
A quorum is the minimum set of replicas that must acknowledge an operation; majority quorums and R + W > N overlap to prevent stale reads in replicated systems.
REST vs RPC
REST models resources with uniform HTTP semantics, while RPC models actions as named procedures. The choice shapes caching, coupling, tooling, and client evolution.
Rolling Deployment
Rolling deployment replaces service instances in batches, keeping the application available while old and new versions overlap, with pause and rollback controls.
RTO and RPO
RTO is the maximum acceptable downtime; RPO is the maximum acceptable data loss. Both turn recovery from an aspiration into a measurable design target.
Runbook
A runbook is a tested, step-by-step operational procedure that lets an on-call engineer diagnose or remediate a known condition without rediscovering the system.
Saga Pattern
A saga coordinates a sequence of local transactions across services, using compensating actions instead of a distributed transaction when a later step fails.
Telemetry Sampling
Sampling keeps a representative subset of traces, logs, or metrics instead of every event, cutting cost and volume while preserving statistically useful visibility.
Schema Evolution
Schema evolution changes data or event schemas over time while old and new producers and consumers continue to interoperate.
Schema Registry
A schema registry stores versioned event or message schemas and enforces compatibility rules so producers can evolve data without breaking consumers.
Secret Management
Secret management stores, distributes, rotates, and audits credentials so they never live in source, images, logs, or long-lived environment files.
Semantic Versioning
Semantic versioning encodes compatibility in a three-part version number, so consumers can tell a breaking change from a feature or a bug fix before upgrading.
Server-Sent Events
Server-Sent Events stream text updates from server to browser over one long-lived HTTP response, with automatic reconnection and last-event replay built in.
Service Mesh
A service mesh moves service-to-service networking concerns into a data plane of proxies controlled by a central control plane, adding mTLS, retries, and telemetry without changing application code.
Session vs Token Authentication
Session authentication stores state server-side behind an opaque cookie, while token authentication carries a signed or opaque credential. The choice affects revocation, scaling, and XSS exposure.
Shadow Traffic
Shadow traffic mirrors real production requests to a new service without returning its responses, validating behavior under real load before users depend on it.
Sharding
Sharding partitions data across independent databases by a shard key, trading cross-shard simplicity for horizontal write capacity and operational complexity.
Sidecar Proxy
A sidecar proxy runs next to each service instance, intercepting network traffic to provide mTLS, retries, routing, and telemetry without application changes.
SLO, SLI, and SLA
SLIs measure service behavior, SLOs set an internal reliability target, and SLAs define the contractual consequences of missing it.
Split Brain
Split brain occurs when two parts of a distributed system both believe they are authoritative, accepting divergent writes that cannot be merged safely.
Strangler Fig
The strangler fig pattern replaces a legacy system incrementally by routing slices of traffic to new implementations until the old system can be retired.
Supply Chain Security
Supply chain security protects the dependencies, build systems, and distribution channels that produce software, from lockfiles and pinned CI actions to SBOMs and provenance.
Telemetry Pipeline
A telemetry pipeline collects, processes, and routes logs, metrics, and traces from services to backends, controlling enrichment, sampling, and cost in one place.
Test Pyramid
The test pyramid favors many fast unit tests, fewer integration tests, and a small number of end-to-end tests to balance feedback speed and confidence.
Threat Modeling
Threat modeling identifies assets, trust boundaries, attackers, and mitigations before code is written, turning security from a checklist into a design activity.
Thundering Herd
A thundering herd is a synchronized surge of retries, reconnects, or cache misses that overwhelms a recovering service and delays recovery further.
Timeout Budget
A timeout budget is a deadline shared across a request chain, so each call gets only the time remaining and retries cannot exceed the caller's patience.
TLS
TLS encrypts and authenticates data in transit, using certificates and a handshake to derive session keys. It protects network hops, not endpoints or data at rest.
Trunk-Based Development
Trunk-based development keeps every engineer committing to one shared mainline at least daily, using short-lived branches, feature flags, and continuous integration to avoid merge hell.
Two-Phase Commit
Two-phase commit coordinates an atomic commit across multiple databases, at the cost of blocking, coordinator failure, and operational complexity.
Vector Clock
A vector clock tracks causal relationships between events across nodes, detecting concurrency that a single timestamp or counter cannot express.
Webhooks
Webhooks push events to subscriber HTTP endpoints in near real time, replacing constant polling with signed, retried deliveries that consumers must verify and deduplicate.
Write-Ahead Logging
Write-ahead logging persists changes to a sequential log before applying them to data files, enabling atomic commit and crash recovery.
Write Amplification
Write amplification is the ratio of bytes physically written to bytes logically changed, driven by indexes, replication, logging, and storage compaction.
Zero Trust
Zero trust treats every request as untrusted until authenticated and authorized, replacing implicit network trust with identity, policy, and continuous verification.
Backpressure
Backpressure is a flow-control signal that tells a fast producer to slow down when a downstream consumer cannot keep up, preventing unbounded queues and memory growth.
Cache Invalidation
Cache invalidation is the policy that decides when cached data stops being trustworthy, using TTLs, versioned keys, or explicit purge events to avoid stale reads.
CAP Theorem
During a network partition a distributed system must choose between consistency and availability. CAP is a narrow guarantee, not a general ranking of databases.
Circuit Breaker
A circuit breaker stops sending requests to a failing dependency after a threshold, failing fast while the dependency recovers instead of exhausting callers with timeouts.
Cross-Site Request Forgery (CSRF)
CSRF tricks a victim's browser into sending an authenticated state-changing request to another site. Defenses use SameSite cookies, CSRF tokens, and origin checks.
Debounce and Throttle
Debounce delays work until input stops; throttle caps how often work runs. They solve different burst patterns and are not interchangeable.
Event Loop Starvation
Event loop starvation happens when long synchronous work or unbounded microtasks prevent timers, I/O, and rendering from running, making a JavaScript process unresponsive.
Eventual Consistency
Eventual consistency guarantees that replicas converge if updates stop, without promising when a read sees the latest write. Applications must handle stale reads and conflicts explicitly.
Graceful Shutdown
Graceful shutdown stops accepting new work, drains in-flight requests, and closes resources before the process exits, avoiding dropped responses and corrupted state.
Idempotency
An operation is idempotent when repeating it produces the same observable result as performing it once. It is the foundation of safe retries in distributed systems.
Index Selectivity
Selectivity measures how many rows an index condition filters out. High-cardinality predicates and well-ordered composite indexes make lookups efficient; low-selectivity indexes often lose to scans.
JSON Web Token (JWT)
A JWT is a signed, URL-safe token with header, payload, and signature. It carries claims but is not encrypted by default, and verification must pin algorithms and validate claims.
N+1 Query Problem
The N+1 problem runs one query for a list and one more per row. Eager loading, joins, or batched lookups reduce it to a constant number of queries.
OAuth 2.0 Authorization Code Flow with PKCE
The authorization code flow delegates access without sharing passwords. PKCE binds the code exchange to the client, and state protects the redirect from CSRF.
Optimistic Concurrency
Optimistic concurrency detects conflicting writes with a version or timestamp instead of locking rows up front, allowing parallel work and retrying the loser.
Rate Limiting
Rate limiting controls how many requests a client may make in a time window, protecting shared capacity and enforcing fair use with explicit rejection signals.
Replication Lag
Replication lag is the delay between a primary write and its visibility on replicas, causing stale reads and missing read-after-write guarantees unless reads are routed deliberately.
Retry Budget
A retry budget caps retries as a fraction of successful traffic so that retry storms cannot amplify load during an outage.
SameSite Cookies
SameSite controls whether cookies are sent on cross-site requests. Lax, Strict, and None have different CSRF and usability trade-offs, and None requires Secure.
Single Flight
Single flight deduplicates concurrent calls for the same key so only one expensive operation runs while all callers share its result.
SQL Injection
SQL injection occurs when untrusted input changes query structure. Parameterized queries separate code from data and are the primary defense across languages and databases.
Transaction Isolation Levels
Isolation levels trade concurrency for protection against dirty reads, non-repeatable reads, phantom reads, and serialization anomalies. Match the level to the invariant.
Cross-Site Scripting (XSS)
XSS injects attacker-controlled script into a page viewed by others. Output encoding, safe DOM APIs, and CSP limit execution, while input validation alone is insufficient.
Closures and Lexical Scope
A closure is a function that captures variables from its surrounding lexical scope, preserving access to those variables after the outer function has returned.
Prototypal Inheritance
JavaScript's prototype-based object model where objects delegate behavior to other objects through an internal [[Prototype]] chain, forming the basis of property lookup and code reuse.
JavaScript Event Loop
The mechanism enabling JavaScript's single-threaded concurrency. It checks whether the call stack is empty and dequeues the next task or microtask.