The Stack, Bottom to Top Glossary · Hosting & Cloud

A and B feeds: paired power circuits to a cabinet on separate feeds so one can fail; redundancy holds only if either feed can carry the whole cabinet and the server uses both (The Data Center & Colocation).
Accrual limit (CPU credits): the cap on banked CPU credits for a burstable instance, a day's earnings, above which new credits are discarded (Virtualization & the VPS).
AI fabric: the second, separate network in a GPU building that connects accelerators for training jobs that stall if one packet is late, built from InfiniBand or from Ethernet tuned to behave like it (Data Center Networking).
AI Zone: Meta's unit of AI cluster, a two-stage Clos of rack switches with shallow buffers and cluster switches with deep buffers, joined across a building by an aggregation layer oversubscribed by design (Data Center Networking).
Alloc: in Borg, a reservation of resources on one machine that one or more tasks share (Schedulers: Borg to Kubernetes).
Amazon ECS: AWS's container scheduler, placing tasks on the customer's own EC2 instances or on Fargate through requirements, constraints and best-effort strategies (binpack, spread, random) (Schedulers: Borg to Kubernetes).
Andromeda: Google's software-defined network under its cloud's firewalls, routing and load balancing, with a host fast path in software so live migration works across different NICs (Data Center Networking).
Applied quota: in AWS Service Quotas, the override that replaces a quota's default value after an increase request is approved (Regions, Zones, Cells & Quotas).
Asynchronous geo-replication: copying storage to a second region after the write is acknowledged, so data not yet replicated is lost in a regional disaster, up to the replication lag (Storage: Block, File & Object).
AWS European Sovereign Cloud: AWS's European partition with its own region, run under a separate parent company with German subsidiaries led by EU citizens (Hybrid & On-Prem Cloud).
AWS Fargate: AWS's serverless container service, where the customer brings images and task definitions and each task gets its own isolation boundary, sharing no kernel with another task (From chroot to Containers).
AWS Lambda: AWS's regional functions product, each environment a Firecracker microVM slot, billed by requests and memory multiplied by duration (Functions, Isolates & Edge Compute).
AWS Outposts: AWS-owned racks or servers installed in the customer's building and maintained by AWS, connected to a parent Region by a service link and priced per configuration for a term (Hybrid & On-Prem Cloud).
Azure Arc: Microsoft's control plane that projects servers, VMs, Kubernetes clusters and SQL Server outside Azure into Azure Resource Manager, governing them without running them (Hybrid & On-Prem Cloud).
Azure Container Instances: Azure's serverless containers, an image and a container group isolated at the hypervisor level, with confidential containers in a hardware trusted execution environment (From chroot to Containers).
Azure Functions Flex Consumption: Azure's current functions plan, billed on executions and GB-seconds while executing, with per-instance concurrency and optional always-ready instances (Functions, Isolates & Edge Compute).
Azure Local: Microsoft's software for customer-owned validated hardware (formerly Azure Stack HCI), with Azure Arc as the control plane and a host fee per physical core (Hybrid & On-Prem Cloud).
Azure Stack Hub: integrated partner systems run by the customer's own operator, who sells plans and offers to tenants, able to run connected or fully disconnected (Hybrid & On-Prem Cloud).
Backblaze B2: an S3-compatible object store priced per TB-month with free egress up to a multiple of stored data and no minimum duration or object size (Storage: Block, File & Object).
Balloon driver: a driver inside a guest that the hypervisor inflates to make the guest's own allocator free memory, so the guest chooses what to page out (Virtualization & the VPS).
Baseboard management controller (BMC): a small computer on the motherboard with its own network port, powered whenever the chassis is, that can power the server on and off, read sensors, set the boot device and give a console; its network is the most sensitive the provider runs (Dedicated Servers & Bare Metal).
Baseline (CPU credits): the utilization at which a burstable instance earns credits as fast as it spends them, its earn rate per vCPU spread over an hour (Virtualization & the VPS).
Bati Courtage v. OVH: a French commercial court ruling against OVH over a backup option described as physically isolated from the VPS infrastructure that was not (Storage: Block, File & Object).
Block volume: a virtual disk the customer's operating system formats and mounts, promised to survive a disk or server failure inside one zone and dying with the zone (Storage: Block, File & Object).
Bluepad v. OVH: a French commercial court ruling that the stated location of servers and backups is contractual, rejecting OVH's force majeure defense (Storage: Block, File & Object).
Borg: Google's internal cluster scheduler, whose published design (cells, jobs, tasks, allocs, priority and quota) is the vocabulary every later scheduler used (Schedulers: Borg to Kubernetes).
Borglet: the Borg agent on every machine that starts and stops tasks and reports state when polled (Schedulers: Borg to Kubernetes).
Borgmaster: Borg's central controller, logically one process but replicated five times with state in a Paxos-based store (Schedulers: Borg to Kubernetes).
Bucket, object and key: the nouns of an object store, a flat namespace of buckets holding objects under keys, read and written whole over HTTP (Storage: Block, File & Object).
Burn-in: tests that new and repaired machines run in the in-memory environment before they enter the available pool (Dedicated Servers & Bare Metal).
Burst window: a CPU-sharing model (Google E2 shared-core) that allows a short burst at full speed periodically, at no extra charge, instead of a credit bank (Virtualization & the VPS).
Cabinet: a lockable rack enclosure in a shared colocation room with power circuits to it, sold whole, by fraction or by single rack unit (The Data Center & Colocation).
Cage: a fenced colocation area of several cabinets built to order for a single customer (The Data Center & Colocation).
CageFS: CloudLinux's per-user filesystem view built from a template, giving each account its own /etc and /tmp and a restricted /proc so it can't see the server or other accounts (Shared Hosting Isolation).
Capabilities (Linux): root's powers split into units such as CAP_NET_ADMIN and CAP_SYS_ADMIN; a provider drops most by default, and a privileged container gets them all and is effectively the host (From chroot to Containers).
Capacity reservation: a product that guarantees capacity of an instance type in a zone without a discount, billed at the on-demand rate whether used or not; capacity is not quota (Regions, Zones, Cells & Quotas).
CDN functions: small functions on a CDN's request path (CloudFront Functions, Lambda@Edge) with tight limits and a per-invocation price (Functions, Isolates & Edge Compute).
Cell (architecture): a complete copy of a service that serves only some customers, so a bad deploy or a poison request reaches a fraction of them (Regions, Zones, Cells & Quotas).
Cell (Borg): a set of machines managed by Borg as one unit (Schedulers: Borg to Kubernetes).
Cell router: the thinnest possible layer in a cell architecture, routing each request to the right cell by its partition key and doing nothing else (Regions, Zones, Cells & Quotas).
Ceph: a self-hosted storage system, a RADOS cluster with CRUSH placement serving a file system and an S3 and Swift gateway, where the operator owns durability (Storage: Block, File & Object).
Cloud Hypervisor: a general-purpose Rust VMM under the Linux Foundation with more devices (including PCI passthrough) and guests than Firecracker, used in Kata deployments (Sandboxes & MicroVMs).
Cloudflare Containers: containers started on demand from a Worker through a Durable Object, each instance in a Firecracker microVM with its own kernel and network (From chroot to Containers).
Cloudflare R2: Cloudflare's S3-compatible object store with free egress, whose documentation lists the S3 features it doesn't implement (Storage: Block, File & Object).
Cloudflare Workers: Cloudflare's edge functions in V8 isolates, many tenants per process, billed by requests and CPU time with no charge for duration (Functions, Isolates & Edge Compute).
CloudFront Functions: AWS's lightweight CDN functions for request-path work such as header rewrites, with tiny memory and code limits and a price per invocation (Functions, Isolates & Edge Compute).
CloudLinux OS: a hosting operating system that gives each account an LVE of kernel resource limits, with CageFS, PHP Selector, mod_lsapi PRO and MySQL Governor, turning noisy neighbors into per-account limits with fault counters (Shared Hosting Isolation).
Cold start: the INIT phase of a function plus the time to get a slot, of which the provider controls only the second half (Functions, Isolates & Edge Compute).
Collisions (ECMP): ECMP's failure mode, where hashing places two large flows on the same uplink so each gets half of it while other links sit idle, the problem AI training traffic exposes (Data Center Networking).
Conditional writes: object storage PUTs that fail if the key exists (If-None-Match) or unless the current ETag matches (If-Match), giving compare-and-swap on a key (Storage: Block, File & Object).
Control groups (cgroups): the Linux kernel's limits on CPU, memory, I/O, process count and cpusets, with v2's single hierarchy; the limit on every container, and so how far a host is oversold (From chroot to Containers).
Control plane: the administrative APIs that create, read, update, delete and list resources, more complex and so more failure-prone than the data plane (Regions, Zones, Cells & Quotas).
Controllable Load Resource: an ERCOT registration for a load that can reduce or increase consumption under ERCOT's dispatch and sell ancillary services, the program large miners used (The Data Center & Colocation).
CPU credit: the unit of burstable instances, one vCPU at 100% for one minute or any equivalent, earned at a fixed hourly rate set by instance size (Virtualization & the VPS).
Cross-connect: a point-to-point fiber or copper run inside a data center from a tenant's cabinet through a meet-me room to another tenant, a carrier, an internet exchange or a cloud on-ramp, billed monthly (The Data Center & Colocation).
Curtailment (power): a large load giving power back to the grid, for a credit when voluntary and as a duty when directed; in ERCOT, Texas SB 6 made it a condition for large loads (The Data Center & Colocation).
Data plane: the part of a service that does its primary function (the running instance, volume reads and writes, bucket GETs and PUTs, DNS answers), kept intentionally simpler than the control plane (Regions, Zones, Cells & Quotas).
DCQCN: end-to-end ECN-based congestion control for RoCE v2 from Microsoft and Mellanox, so senders slow down before PFC has to pause links (Data Center Networking).
Dedicated Local Zones: AWS infrastructure built for one customer's exclusive use in a location it specifies, fully managed by AWS as part of a parent Region (Hybrid & On-Prem Cloud).
Dedicated vCPU: a CPU model with threads pinned to one VM, giving predictable performance at the highest price (Virtualization & the VPS).
Deep-buffer switch: a switch chip with large packet buffers, placed where many flows converge such as the spine, against shallow-buffer chips at the leaf (Data Center Networking).
Delete marker: the placeholder that a DELETE without a version ID inserts as the current version in a versioned bucket, leaving earlier versions in place (Storage: Block, File & Object).
Deployment Stamps: Azure's name for cells, independent copies of a service (stamps or scale units) each serving a set number of tenants and deployed separately (Regions, Zones, Cells & Quotas).
Distribution specification (OCI): the OCI standard for registries, based on the Docker Registry HTTP API V2, covering pull, push, content discovery and content management (From chroot to Containers).
Docker Engine: a daemon and CLI over containerd and runc that builds and runs containers in one tool, with a root daemon unless run rootless (From chroot to Containers).
Docker Swarm: Docker's clustering, built into Docker Engine as swarm mode (docker swarm init and join), minimal to set up but with a small feature set and little momentum (Schedulers: Borg to Kubernetes).
Durability (object storage): the provider's per-object claim against losing acknowledged data to hardware failure, which depends on fast repair and covers neither the customer's own deletes nor the provider's tooling mistakes (Storage: Block, File & Object).
E2B: a sandbox service that runs untrusted agent code in Firecracker microVMs that resume from a snapshot and pause when the agent stops (Sandboxes & MicroVMs).
eBGP (data center): the RFC 7938 design that runs eBGP on every fabric link with private ASNs (one shared by the spines, one per top-of-rack), making BGP the only routing protocol (Data Center Networking).
EBS snapshot: an incremental backup of a block volume, saving only blocks changed since the previous snapshot, stored in S3 across zones; backups are the customer's job (Storage: Block, File & Object).
ECMP (equal-cost multipath): routing that spreads traffic over many equal-cost paths by hashing each flow's five-tuple, so one flow's packets stay in order on one path (Data Center Networking).
ECN: marking packets at a congested switch instead of dropping them, so the receiver tells the sender to slow down (Data Center Networking).
EFA and SRD: AWS's Elastic Fabric Adapter (ENA plus OS bypass through libfabric) and its Scalable Reliable Datagram transport, reliable but out of order, spraying a flow's packets across many paths from the Nitro card (Data Center Networking).
EFS throughput modes: Amazon EFS's billing choices for file share throughput: Elastic (billed per data read and written), Provisioned (billed for throughput above what storage includes) and Bursting (baseline plus credits) (Storage: Block, File & Object).
Endpoint (private): a network object that exposes a service privately inside the customer's virtual network, such as a PrivateLink endpoint appearing as a network interface (Data Center Networking).
Entry processes (EP): the CloudLinux LVE limit on concurrent entries into an account's container (web requests, SSH sessions, cron), above which Apache returns HTTP 508 (Shared Hosting Isolation).
Equivalence classes (Borg): a scheduling shortcut that scores one task per group of identical tasks (Schedulers: Borg to Kubernetes).
F16: Meta's 2019 data center fabric that connected each rack to 16 planes, each a single switch chip, for four times the capacity of its four-plane design (Data Center Networking).
Fabric: the network that connects every server in a building to every other at a known bandwidth, which went from a tree of ever-larger routers to a mesh of identical small switches (Data Center Networking).
Falcon: Google's hardware transport, first in the Intel IPU E2000, with hardware RTT measurement, per-flow shaping and fast retransmit, opened through OCP (Data Center Networking).
Fastly Compute: Fastly's edge functions in WebAssembly on Wasmtime, starting a new sandbox for each request by default (Functions, Isolates & Edge Compute).
Fault (LVE): CloudLinux's count each time an account hits a limit, recorded by LVE-Stats with a snapshot of its processes and queries and grouped into incidents (Shared Hosting Isolation).
Fault domain: a rack or hardware group inside one building used for anti-affinity, short of a second building; Oracle offers them inside single-availability-domain regions (Regions, Zones, Cells & Quotas).
FCGId: the mod_fcgid PHP handler in cPanel, incompatible with mod_ruid2 and mpm-itk and meant for advanced administrators (Shared Hosting Isolation).
File share: a mounted file system spoken over NFS or SMB to many clients at once, promising POSIX or Windows semantics, locking and throughput (Storage: Block, File & Object).
Firecracker: AWS's minimal KVM VMM, one process per microVM with only five emulated devices, a jailer and snapshots, which became the industry's microVM for Lambda, Fargate, Fly.io, Cloudflare Containers, Vercel Sandbox and E2B (Sandboxes & MicroVMs).
Firecracker snapshot: a guest memory file plus a microVM state file, restored by mapping memory privately and loading pages on demand, which should be resumed once because restores share captured randomness and tokens (Sandboxes & MicroVMs).
Fly.io Machines: Fly.io's images run as Firecracker microVMs through a REST API, billed per second while running (From chroot to Containers).
FPM (PHP handler): PHP-FPM as a panel's PHP handler, served through mod_proxy_fcgi and running as the pool's user, the per-user default the current panels recommend (Shared Hosting Isolation).
Frontend and backend networks: the split in AI clusters between a frontend network for data ingestion, checkpointing and logging and a backend network for training traffic with one RDMA NIC per GPU (Data Center Networking).
Gateways (virtual network): the objects connecting a virtual network to the internet (an internet gateway, or a NAT gateway for outbound-only instances), to on-premises networks and to other networks (Data Center Networking).
GKE Enterprise: Google's Kubernetes software on the customer's own bare metal or VMware, managed as fleets from Google Cloud (Hybrid & On-Prem Cloud).
Google Cloud Run: Google's serverless containers and functions, first generation on gVisor and second generation in a microVM with full Linux compatibility, with many concurrent requests per instance (From chroot to Containers).
Google Distributed Cloud: Google's on-premises offerings: connected (Google-certified hardware the customer maintains, with Google running the software) and air-gapped (Google-engineered racks or appliances completely disconnected from the internet) (Hybrid & On-Prem Cloud).
Google IPU: an infrastructure processing unit co-designed by Google and Intel that offloads networking with line-rate encryption and carries the Falcon transport (Data Center Networking).
gp3: the EBS volume type that decouples throughput and IOPS from size, unlike gp2, where customers bought capacity to get speed (Storage: Block, File & Object).
gVisor: Google's user-space kernel per sandbox, an OCI runtime (runsc) that intercepts system calls so the host kernel sees a small filtered set, needing no hardware virtualization at a CPU cost per syscall (Sandboxes & MicroVMs).
gVisor Gofer: the host process started with each gVisor container that mediates all filesystem access over 9P, so the Sentry never opens host files (Sandboxes & MicroVMs).
gVisor platform: how gVisor's Sentry catches system calls, a provider tuning choice between systrap (seccomp traps, the default and better inside a VM) and KVM (Sandboxes & MicroVMs).
gVisor Sentry: gVisor's largest component, implementing system calls, signals, memory management and threading without passing the application's calls through to the host (Sandboxes & MicroVMs).
Hoverboards: gateways in Google's Andromeda that carry the long tail of idle flows while the control plane programs direct host-to-host rules only for hot ones (Data Center Networking).
HTTP 508: the error Apache returns when a CloudLinux account exceeds its entry processes limit (Shared Hosting Isolation).
Hyperscaler .metal instances: whole bare machines rented by the hour inside a cloud, with its network, storage and IAM, while the provider's card still controls I/O (Dedicated Servers & Bare Metal).
IBM Cloud Satellite: IBM's model of running a location's control plane from an IBM Cloud metro over hosts the customer supplies in its data center, an edge site or another cloud (Hybrid & On-Prem Cloud).
Identity, resources and visibility: the three problems each generation of shared hosting isolation fixed: whose user a script runs as, how much one account can use, and what it can see of the server and other accounts (Shared Hosting Isolation).
Image digest: the content hash that names exactly one set of image bytes, recorded at deploy time so "what was running" has one answer however often a tag moves (From chroot to Containers).
Image index: the OCI document listing manifests for different platforms, so one image name resolves to an amd64 or arm64 image as the host requires (From chroot to Containers).
In-memory operating system: the netbooted environment that runs entirely in RAM to inventory hardware, run burn-in tests, wipe disks and write an image, such as Hetzner's Rescue System (Dedicated Servers & Bare Metal).
INIT, INVOKE and SHUTDOWN: Lambda's execution-environment lifecycle: INIT creates the environment and runs static code, INVOKE runs the handler, and SHUTDOWN ends it; a request landing on a frozen environment is a warm start that skips INIT (Functions, Isolates & Edge Compute).
Inodes (shared hosting): the count of files and directories an account may hold, enforced through /home quotas; at the hard limit the user can't write new files, which is where "unlimited" storage ends (Shared Hosting Isolation).
IPMI: the older BMC management protocol, whose version 2.0 added Serial over LAN and stronger authentication and encryption (Dedicated Servers & Bare Metal).
iPXE: open-source network boot firmware that extends PXE to HTTP, iSCSI and other transports, so a loader can fetch a kernel, initramfs and script with per-machine parameters (Dedicated Servers & Bare Metal).
Isolates and Wasm at the edge: function platforms (Cloudflare Workers, Fastly Compute) that run in hundreds of locations inside a language runtime, start in milliseconds or less, cap memory and bill CPU time or requests (Functions, Isolates & Edge Compute).
Jailer (Firecracker): the wrapper that places Firecracker in a chroot with its own PID and network namespaces, dropped privileges and a restrictive seccomp profile before the guest boots (Sandboxes & MicroVMs).
Job and task (Borg): a Borg job is a set of identical tasks, each with a priority, admitted by quota before scheduling (Schedulers: Borg to Kubernetes).
Kata Containers: a lightweight VM per pod behind an OCI and CRI runtime, a drop-in hardware boundary for multi-tenant Kubernetes with a choice of VMM (Sandboxes & MicroVMs).
kube-scheduler: Kubernetes' scheduler, which filters for feasible nodes and scores them, picking the highest with ties broken at random, and preempts lower-priority pods by PriorityClass (Schedulers: Borg to Kubernetes).
KVM: the Linux kernel module for hardware-assisted virtualization, paired with QEMU or a custom VMM, running any guest OS and used by most clouds and developer clouds (Virtualization & the VPS).
Lambda@Edge: AWS's functions on CloudFront's origin and viewer events, with larger limits than CloudFront Functions and billing by requests and GB-seconds (Functions, Isolates & Edge Compute).
Leaf-spine: the two-layer data center fabric where each leaf (top-of-rack switch) connects to every spine, so any server reaches any other in three switch hops and the fabric grows by adding leaves (Data Center Networking).
Legal hold (Object Lock): an Object Lock protection on an object version with no expiry, lasting until removed (Storage: Block, File & Object).
Letter of authorization and connecting facility assignment (LOA-CFA): the document the owner of a far port issues naming its panel and port, which the other side gives the colocation operator to order a cross-connect (The Data Center & Colocation).
libfabric: the OS-bypass interface through which AWS EFA serves MPI and NCCL, also the base of Ultra Ethernet's software (Data Center Networking).
Lifecycle rule: an object storage rule that transitions objects to colder classes or expires them, applying to existing objects as well as new ones, and a deletion path no bucket policy blocks (Storage: Block, File & Object).
Live migration: moving a running VM to another host without a reboot, which lets a provider drain a host before maintenance (Virtualization & the VPS).
Lossless Ethernet: a RoCE fabric configured so switches don't drop packets, with PFC, ECN and congestion control, because RDMA's recovery from loss is expensive (Data Center Networking).
LSAPI: the LiteSpeed API PHP handler, included by default in cPanel, whose full functionality requires CloudLinux (Shared Hosting Isolation).
LSMs (AppArmor, SELinux): Linux Security Modules giving mandatory access control over files and operations, applied as one profile for every tenant or per workload (From chroot to Containers).
LVE: CloudLinux's kernel-level container per account that limits CPU, memory, I/O and processes without separating the filesystem (Shared Hosting Isolation).
MAAS: Canonical's open-source bare-metal provisioning stack covering a machine's lifecycle from enlistment to release (Dedicated Servers & Bare Metal).
Manifest (OCI): the document describing the components of a container image: a config and a list of layers, each named by a descriptor with media type, size and content digest (From chroot to Containers).
Marathon: Mesosphere's container orchestration framework on Apache Mesos, now archived (Schedulers: Borg to Kubernetes).
Mesos: Apache's two-level scheduler, where the master offers resources and frameworks accept or reject them, retired by the Apache board (Schedulers: Borg to Kubernetes).
Minimum object size: a storage class's smallest billable object, so small objects bill as if they were that size, in effect a small-object fee (Storage: Block, File & Object).
Minimum storage duration: an object storage class's minimum billing period, so an object deleted or transitioned early is billed for the rest, in effect a deletion fee (Storage: Block, File & Object).
mod_lsapi PRO: CloudLinux's Apache module based on the LiteSpeed API that runs PHP like suPHP or PHP-FPM, optionally keeping lsphp running for opcode caching (Shared Hosting Isolation).
mod_php (DSO): PHP loaded into Apache, running every site as the web server's user, so one compromised site reaches all; legacy only (Shared Hosting Isolation).
mod_ruid2 and mpm-itk: Apache modules that switch to the owner's user inside the web server, which keeps performance but makes the web server root-equivalent (Shared Hosting Isolation).
Monolithic scheduler: a scheduler with a single, centralized algorithm for all jobs, as Borg's was at the time Omega's paper named the architectures (Schedulers: Borg to Kubernetes).
MRC (Multipath Reliable Connection): an extension of RoCE v2 with per-packet multipath and sender-based congestion control over best-effort Ethernet (Data Center Networking).
Multipart upload: the S3 method for large objects, sending up to thousands of parts that the store assembles, required above the single-PUT size limit (Storage: Block, File & Object).
MySQL Governor: CloudLinux's limiter for the shared database server, monitoring CPU and read and write bytes per MySQL user and restricting abusers (Shared Hosting Isolation).
Namespaces (Linux): kernel views (mount, PID, network, UTS, IPC, user, cgroup, time) that a container unshares; a user namespace makes root inside the container unprivileged outside (From chroot to Containers).
Network (VPC): a customer's private address space in a region (VPC, VNet, VCN), divided into subnets with route tables, gateways and endpoints on top of the shared fabric (Data Center Networking).
Network boot (PXE): firmware asking DHCP for an address and boot file, then fetching a small loader over TFTP and running it, the first step of automated provisioning (Dedicated Servers & Bare Metal).
Nitro Cards: AWS's dedicated hardware that implements every outward interface of an EC2 server (VPC network, EBS and local NVMe, encryption and the control-plane API) apart from the main CPUs (Sandboxes & MicroVMs).
Nitro Controller: the primary Nitro card, the hardware root of trust and the exclusive gateway between the server and the EC2, EBS and VPC control planes (Sandboxes & MicroVMs).
Nitro Hypervisor: the minimal hypervisor left once I/O moves to Nitro Cards, partitioning CPU and memory and assigning SR-IOV functions of the cards' devices directly to VMs (Sandboxes & MicroVMs).
Nitro Security Chip: the chip on the main board that moderates firmware access and holds the CPUs in reset until the Nitro Controller verifies everything, which makes bare metal instances safe to rent (Sandboxes & MicroVMs).
Nomad: HashiCorp's scheduler for service, batch and system jobs, ranking feasible nodes mainly by bin packing and applying plans with optimistic concurrency (Schedulers: Borg to Kubernetes).
NPROC: the CloudLinux LVE limit on all processes and threads in an account, which should exceed entry processes by a margin (Shared Hosting Isolation).
Nutanix: a cloud platform software stack sold for customer hardware and for cloud bare metal with portable licenses, a common VMware alternative (Hybrid & On-Prem Cloud).
NVIDIA BlueField: NVIDIA's DPU line that offloads SDN, storage and security from the host, programmed with the DOCA SDK (Data Center Networking).
Object Lock (WORM): write-once protection on a specific object version in a versioned bucket; compliance mode can't be overridden even by the root user, and governance mode can by a principal with a bypass permission (Storage: Block, File & Object).
Object store: an HTTP API of buckets and keys that promises an acknowledged object stays readable for years across a whole region, priced per gigabyte-month (Storage: Block, File & Object).
OCI Dedicated Region: a complete Oracle cloud region with the public cloud's services installed in the customer's data center, with a large minimum footprint (Hybrid & On-Prem Cloud).
OpenStack: open-source cloud software with no license fee and every layer replaceable, where the customer operates every service (Hybrid & On-Prem Cloud).
OpenStack Ironic: bare metal provisioning as an OpenStack compute driver or standalone, with broad drivers (IPMI, Redfish, iDRAC) and cleaning steps (Dedicated Servers & Bare Metal).
Oracle Compute Cloud@Customer: an Oracle rack installed in the customer's data center and fully managed by Oracle, connected to the customer's OCI tenancy (Hybrid & On-Prem Cloud).
Overcommit: selling more vCPUs or memory than a host physically has, a product decision that steal time and swapping reveal to customers (Virtualization & the VPS).
Oversubscription: the ratio of a leaf's downlink bandwidth to its uplink bandwidth; 1:1 is non-blocking, and general-purpose fabrics run oversubscribed as a priced design choice (Data Center Networking).
Oxide cloud computer: a rack-scale computer sold to the customer with hardware and open-source system software designed together, no separate licensing and an API and console from day one (Hybrid & On-Prem Cloud).
Pack and spread (scheduling): the two scoring strategies: packing ("best fit") fills machines tightly and leaves whole machines free but penalizes misestimates, while spreading ("worst fit") leaves headroom at the cost of fragmentation (Schedulers: Borg to Kubernetes).
Packet spraying: sending the packets of one flow across many paths instead of pinning it to one, used by AWS SRD, Spectrum-X and Ultra Ethernet's transport, with reordering at the receiver (Data Center Networking).
Page sharing: merging identical memory pages across VMs copy-on-write, one of the techniques that made VM density pay (Virtualization & the VPS).
Partition key (cells): the value (customer ID, resource ID or another present in most calls) that a cell architecture partitions work by, aligned with the grain of the service (Regions, Zones, Cells & Quotas).
Partitions (InfiniBand): groups of ports identified by a partition key (P_Key) that isolate tenants on a shared InfiniBand fabric (Data Center Networking).
PFC (Priority Flow Control): a switch telling its upstream neighbor to pause one traffic class when a buffer fills, preventing drops at the cost of head-of-line blocking, congestion spreading and rare deadlocks (Data Center Networking).
PFC watchdog: a switch mechanism that breaks pause storms when a PFC pause lasts too long (Data Center Networking).
PHP Selector: CloudLinux's per-user choice of PHP version, modules and settings from its alt-php builds, which requires CageFS (Shared Hosting Isolation).
PHP-FPM pool: a set of persistent PHP worker processes with its own Unix user and group, socket, optional chroot and locked settings, the per-account identity default on cPanel, Plesk and DirectAdmin (Shared Hosting Isolation).
Placement groups: the customer-facing control over where instances land on the network, such as a cluster group in one high-bisection-bandwidth segment or partition groups spread across hardware (Data Center Networking).
Plan queue (Nomad): the leader's queue of placement plans from parallel schedulers that rejects colliding plans at commit (Schedulers: Borg to Kubernetes).
Platform functions: functions sold by a PaaS such as Vercel or Netlify on a hyperscaler underlay, adding framework integration while inheriting the underlay's limits (Functions, Isolates & Edge Compute).
PMEM: the CloudLinux LVE limit on physical memory (RSS, shared memory and page cache), at which cache is reclaimed and then processes are killed (Shared Hosting Isolation).
Pod (fabric): in Facebook's data center fabric, a group of racks served by fabric switches, with pods connected through spine planes (Data Center Networking).
Podman: a daemonless container engine that runs containers as root or a non-privileged user, with no root daemon (From chroot to Containers).
Power billing model: how colocation charges for power: an all-in rate per committed kilowatt bundling cooling and overhead, or metered energy plus a space or circuit charge (The Data Center & Colocation).
Power Usage Effectiveness (PUE): total facility power divided by IT equipment power, the operator's measure of overhead (1.0 would mean every watt reaches a server), which a tenant should ask for per building as operated (The Data Center & Colocation).
Powered shell: a building with power to it that a wholesale tenant fits out itself (The Data Center & Colocation).
Preemption: evicting lower-priority work to place higher-priority work; spot and low-priority products are the scheduler's eviction order with a price on it (Schedulers: Borg to Kubernetes).
Presigned URL: an object storage URL carrying the signing principal's credentials that works for anyone holding it, as often as they like, until it expires (Storage: Block, File & Object).
Private suite: a walled colocation room with its own access control, sometimes with its own cooling units (The Data Center & Colocation).
Privileged container: a container holding every capability, which is effectively the host, so it belongs only on capacity the customer owns or inside a VM (From chroot to Containers).
proxyexec: CloudLinux's path for commands that must run outside a user's CageFS, filtered by a list (Shared Hosting Isolation).
QP scaling: spreading RoCE traffic over more queue pairs in the collective library so ECMP hashing on the destination queue pair finds more paths, as in Meta's training clusters (Data Center Networking).
Quota: a limit on what one account or project may hold or do, per region, which protects the fleet, other tenants and the customer's own bill, and decides admission before the scheduler decides placement (Regions, Zones, Cells & Quotas).
Rack unit (U): the standard height of rack-mounted equipment, 1.75 inches, in which cabinets and single-server colocation are sold (The Data Center & Colocation).
Rail-optimized: an AI backend design where GPU n in every node connects to leaf switch n, its rail, so same-rank traffic is one switch hop and only cross-rail traffic climbs to the spine (Data Center Networking).
Read-after-write consistency: the guarantee that a GET or LIST after a successful PUT sees the new data, which S3 gives strongly (Storage: Block, File & Object).
Redfish: the REST API for BMCs on current servers, with serial console over SSH among its functions, preferred over IPMI (Dedicated Servers & Bare Metal).
Region: a metro area with its own control plane, its own prices and usually its own legal home, the customer-facing footprint of a provider (Regions, Zones, Cells & Quotas).
Regional functions: function platforms (AWS Lambda, Cloud Run functions, Azure Functions) that run in a cloud region in a microVM or container and bill memory multiplied by duration (Functions, Isolates & Edge Compute).
Relaxed randomization: a Borg scheduling shortcut that examines machines in random order until enough feasible ones are found (Schedulers: Borg to Kubernetes).
Remote hands: the colocation operator's staff doing physical work on a tenant's equipment (rack and stack, cross-connect termination, power cycling, swaps), run as a billable work order in fixed increments (The Data Center & Colocation).
Reservation (Borg): a task's reserved resources, starting at its limit and decaying toward actual usage plus a margin, with the gap lent to batch work (Schedulers: Borg to Kubernetes).
Resource offer: Mesos's mechanism, in which Mesos decides how many resources to offer each framework and the framework decides which to accept and what to run (Schedulers: Borg to Kubernetes).
Resource versus asset: the split between a customer's server resource, which keeps its ID, addresses and bill, and the physical asset backing it, recorded over time in server_assignments (Dedicated Servers & Bare Metal).
Retail colocation: cabinets, cages and suites sold to many tenants with power, cooling, security and remote hands bundled, fast to start but higher per kilowatt than wholesale (The Data Center & Colocation).
RoCE v2: RDMA over Converged Ethernet with routing through UDP headers, the Ethernet alternative to InfiniBand for AI fabrics (Data Center Networking).
Route tables: the virtual network objects that say where traffic for each prefix goes (Data Center Networking).
runc: the reference OCI runtime (with crun as an alternative) under containerd or CRI-O, running containers with namespaces and cgroups on the host kernel at native speed (From chroot to Containers).
runsc: gVisor's OCI runtime, called by Docker, containerd and Kubernetes in place of runc (Sandboxes & MicroVMs).
Runtime specification (OCI): the OCI standard for the bundle a runtime receives (a root filesystem plus config.json), its execution environment and its lifecycle (From chroot to Containers).
S3-compatible challengers: object stores (R2, B2, Wasabi, Hetzner, Spaces, OVHcloud, Akamai) that speak the S3 API with low or zero egress, where compatibility is a matrix of implemented features rather than a checkbox (Storage: Block, File & Object).
Scale-out: connecting GPU nodes or racks across a building over InfiniBand or Ethernet with one NIC per GPU (Data Center Networking).
Scale-up: connecting GPUs inside a node or rack with dedicated GPU-to-GPU links such as NVLink (Data Center Networking).
Score caching: a Borg scheduling shortcut that keeps machine scores until the machine or task changes (Schedulers: Borg to Kubernetes).
seccomp: the Linux filter on which system calls a process may make; the provider chooses the default filter and whether customers may relax it (From chroot to Containers).
Segment ID: the VNI, VLAN ID or InfiniBand P-Key that maps exactly one tenant network, never shared and never shown to the customer (Data Center Networking).
Serverless containers: a billing model (Fargate, Cloud Run, Container Instances, Fly.io) charging a container's declared size for the time it runs, with the provider owning bin packing (From chroot to Containers).
Service link (Outposts): the encrypted set of VPN connections from an Outpost to its parent Region, carrying customer VPC traffic and management traffic, whose loss the provider-operated racks treat as a fault (Hybrid & On-Prem Cloud).
Shallow-buffer switch: a switch chip with small shared buffers, used at the leaf, against deep-buffer chips where flows converge (Data Center Networking).
Shared vCPU: an overcommitted, best-effort CPU model with no meter, cheap and simple but subject to steal under contention (Virtualization & the VPS).
Shared-kernel containers (OpenVZ, Virtuozzo, LXC): one kernel with many isolated user spaces, the highest-density VPS model, where a kernel bug reaches every tenant and the customer can't choose the kernel (Virtualization & the VPS).
Shared-state scheduler: Omega's architecture, where several schedulers each see the whole cluster and commit placements as optimistic transactions, retrying on conflict (Schedulers: Borg to Kubernetes).
SHARP: the Scalable Hierarchical Aggregation and Reduction Protocol, which moves reductions into InfiniBand switches so they add partial sums in transit (Data Center Networking).
Shuffle sharding: giving each customer its own random combination of workers instead of a fixed group, so one customer's load or attack reaches few others (Regions, Zones, Cells & Quotas).
Slot (Lambda): a Firecracker microVM holding a single sandbox for a single customer function with a minimized kernel and userland, used for one concurrent invocation and recycled within hours (Sandboxes & MicroVMs).
SONiC: Microsoft's open-source switch operating system, built on OCP's Switch Abstraction Interface and now at the Linux Foundation, running on many switch models (Data Center Networking).
Sovereign partition: a separate control plane, identity system and operations staff for a jurisdiction (AWS European Sovereign Cloud, Azure Government, OVHcloud SecNumCloud), not just another region (Regions, Zones, Cells & Quotas).
Spectrum-X: NVIDIA's AI Ethernet, Spectrum-4 switches coupled with BlueField-3 SuperNICs, with adaptive routing that sprays packets and reorders them in host memory (Data Center Networking).
SPEED: the CloudLinux LVE limit on CPU as a percentage of one core, above which the account's processes are throttled (Shared Hosting Isolation).
Standard and Unlimited modes: AWS burstable modes: Standard spends banked credits and drops to baseline at zero, while Unlimited spends surplus credits and bills the excess above a rolling 24-hour baseline (Virtualization & the VPS).
Static stability: the design rule that systems keep operating normally without making changes while a dependency, such as a control plane, is failed or unavailable (Regions, Zones, Cells & Quotas).
Steal time: the gap a Linux guest reports in /proc/stat while the hypervisor runs another guest, the customer's only direct view of a noisy neighbor (Virtualization & the VPS).
Subnet manager: the InfiniBand service (OpenSM is the open one) that must run per subnet to scan, initialize and sweep the fabric and compute forwarding (Data Center Networking).
Subnets: the divisions of a virtual network, usually one or more per zone (Data Center Networking).
suEXEC and suPHP: the per-request models that run PHP as the site owner, isolating identity at the cost of a process per request; suPHP is unmaintained (Shared Hosting Isolation).
Surplus credits: credits an Unlimited burstable instance spends beyond its bank, paid down by later earnings or billed per vCPU-hour above baseline (Virtualization & the VPS).
System limits: fixed provider limits that, unlike adjustable quotas, can't be raised (Regions, Zones, Cells & Quotas).
TIA-942: a data center rating standard from Rated-1 (basic site infrastructure) through Rated-3 (concurrently maintainable) to Rated-4 (fault tolerant) (The Data Center & Colocation).
Tinkerbell: a CNCF sandbox bare-metal provisioner running workflows of containerized actions over iPXE, small and Kubernetes-native (Dedicated Servers & Bare Metal).
Two-level scheduler: a scheduler where one resource manager offers resources to independent frameworks that pick what to run, as Mesos did (Schedulers: Borg to Kubernetes).
UALink: the open specification for scale-up links among accelerators within an AI computing pod, an alternative to NVLink (Data Center Networking).
Ultra Ethernet Consortium: the Linux Foundation project defining Ultra Ethernet and its transport (UET), with packet spraying, receiver-granted credits, Link Level Retry and ephemeral connections; it has no compliance program, so hardware is "UEC-ready," not compliant (Data Center Networking).
Undersubscription: building more uplink capacity than downlink (Meta's AI backend started at 1:2) to work around routing collisions (Data Center Networking).
Uptime Institute Tier Standard: the four-level data center rating by power and cooling topology, from Tier I to Tier IV, where Tier III is concurrently maintainable and Tier IV survives an unplanned failure of one component (The Data Center & Colocation).
User Beancounters: OpenVZ's per-container counters with limits, guarantees and a fail counter that recorded each time a container hit one (Virtualization & the VPS).
V8 isolates: many tenants in one V8 process, starting in milliseconds with tiny memory each, limited to JavaScript and Wasm, where a V8 bug is a cross-tenant bug (Sandboxes & MicroVMs).
Variable retention: an Object Lock setting that sets the retain-until date when an event hold is released, for retention starting at a business event such as account closure (Storage: Block, File & Object).
vCPU: a hardware thread of a physical core, not a core, so two vCPUs can be one physical core (Virtualization & the VPS).
Vercel Functions: Vercel's functions on an AWS underlay, billed on active CPU time plus provisioned memory, with Fluid compute letting each instance handle multiple requests (Functions, Isolates & Edge Compute).
Vercel Sandbox: Vercel's product for running code in a Firecracker microVM with its own filesystem and network (Sandboxes & MicroVMs).
Versioning (object storage): a bucket setting under which overwrites create new whole-object versions and deletes add delete markers; once enabled it can only be suspended, never removed (Storage: Block, File & Object).
Virtual network: the private address space, subnets, routes and firewall rules each customer gets on the shared fabric, which moved from switches into host software and then into a card in each server (Data Center Networking).
VMware Cloud Foundation: the incumbent enterprise private cloud stack, subscription-only and per-core since Broadcom ended perpetual licenses (Hybrid & On-Prem Cloud).
VMware ESXi (vSphere): Broadcom's proprietary type 1 hypervisor with mature management, sold by subscription only (Virtualization & the VPS).
VXLAN: the RFC 7348 overlay that carries a 24-bit segment ID over UDP, escaping the VLAN limit for tenant networks (Data Center Networking).
Wasabi: an S3-compatible object store with one flat price per TB and a minimum storage duration on pay-as-you-go (Storage: Block, File & Object).
Wasm runtimes: WebAssembly sandboxes such as Wasmtime that start an instance per request or session in microseconds with capability-based imports, limited by language support and WASI (Sandboxes & MicroVMs).
Wholesale colocation: megawatts of space or a powered shell leased to one tenant on long terms, who fits it out and operates it while the operator handles the building (The Data Center & Colocation).
Zone (availability zone): a set of buildings inside a region with separate power, cooling and networking, close enough for synchronous replication and far enough apart that one disaster shouldn't take two (Regions, Zones, Cells & Quotas).
Zone name mapping: the practice of mapping physical zones to names differently per customer to spread load, so "zone a" in two accounts can be different buildings, with stable physical IDs available (Regions, Zones, Cells & Quotas).

A and B feeds: paired power circuits to a cabinet on separate feeds so one can fail; redundancy holds only if either feed can carry the whole cabinet and the server uses both (The Data Center & Colocation).
Accrual limit (CPU credits): the cap on banked CPU credits for a burstable instance, a day's earnings, above which new credits are discarded (Virtualization & the VPS).
AI fabric: the second, separate network in a GPU building that connects accelerators for training jobs that stall if one packet is late, built from InfiniBand or from Ethernet tuned to behave like it (Data Center Networking).
AI Zone: Meta's unit of AI cluster, a two-stage Clos of rack switches with shallow buffers and cluster switches with deep buffers, joined across a building by an aggregation layer oversubscribed by design (Data Center Networking).
Alloc: in Borg, a reservation of resources on one machine that one or more tasks share (Schedulers: Borg to Kubernetes).
Amazon ECS: AWS's container scheduler, placing tasks on the customer's own EC2 instances or on Fargate through requirements, constraints and best-effort strategies (binpack, spread, random) (Schedulers: Borg to Kubernetes).
Andromeda: Google's software-defined network under its cloud's firewalls, routing and load balancing, with a host fast path in software so live migration works across different NICs (Data Center Networking).
Applied quota: in AWS Service Quotas, the override that replaces a quota's default value after an increase request is approved (Regions, Zones, Cells & Quotas).
Asynchronous geo-replication: copying storage to a second region after the write is acknowledged, so data not yet replicated is lost in a regional disaster, up to the replication lag (Storage: Block, File & Object).
AWS European Sovereign Cloud: AWS's European partition with its own region, run under a separate parent company with German subsidiaries led by EU citizens (Hybrid & On-Prem Cloud).
AWS Fargate: AWS's serverless container service, where the customer brings images and task definitions and each task gets its own isolation boundary, sharing no kernel with another task (From chroot to Containers).
AWS Lambda: AWS's regional functions product, each environment a Firecracker microVM slot, billed by requests and memory multiplied by duration (Functions, Isolates & Edge Compute).
AWS Outposts: AWS-owned racks or servers installed in the customer's building and maintained by AWS, connected to a parent Region by a service link and priced per configuration for a term (Hybrid & On-Prem Cloud).
Azure Arc: Microsoft's control plane that projects servers, VMs, Kubernetes clusters and SQL Server outside Azure into Azure Resource Manager, governing them without running them (Hybrid & On-Prem Cloud).
Azure Container Instances: Azure's serverless containers, an image and a container group isolated at the hypervisor level, with confidential containers in a hardware trusted execution environment (From chroot to Containers).
Azure Functions Flex Consumption: Azure's current functions plan, billed on executions and GB-seconds while executing, with per-instance concurrency and optional always-ready instances (Functions, Isolates & Edge Compute).
Azure Local: Microsoft's software for customer-owned validated hardware (formerly Azure Stack HCI), with Azure Arc as the control plane and a host fee per physical core (Hybrid & On-Prem Cloud).
Azure Stack Hub: integrated partner systems run by the customer's own operator, who sells plans and offers to tenants, able to run connected or fully disconnected (Hybrid & On-Prem Cloud).
Backblaze B2: an S3-compatible object store priced per TB-month with free egress up to a multiple of stored data and no minimum duration or object size (Storage: Block, File & Object).
Balloon driver: a driver inside a guest that the hypervisor inflates to make the guest's own allocator free memory, so the guest chooses what to page out (Virtualization & the VPS).
Baseboard management controller (BMC): a small computer on the motherboard with its own network port, powered whenever the chassis is, that can power the server on and off, read sensors, set the boot device and give a console; its network is the most sensitive the provider runs (Dedicated Servers & Bare Metal).
Baseline (CPU credits): the utilization at which a burstable instance earns credits as fast as it spends them, its earn rate per vCPU spread over an hour (Virtualization & the VPS).
Bati Courtage v. OVH: a French commercial court ruling against OVH over a backup option described as physically isolated from the VPS infrastructure that was not (Storage: Block, File & Object).
Block volume: a virtual disk the customer's operating system formats and mounts, promised to survive a disk or server failure inside one zone and dying with the zone (Storage: Block, File & Object).
Bluepad v. OVH: a French commercial court ruling that the stated location of servers and backups is contractual, rejecting OVH's force majeure defense (Storage: Block, File & Object).
Borg: Google's internal cluster scheduler, whose published design (cells, jobs, tasks, allocs, priority and quota) is the vocabulary every later scheduler used (Schedulers: Borg to Kubernetes).
Borglet: the Borg agent on every machine that starts and stops tasks and reports state when polled (Schedulers: Borg to Kubernetes).
Borgmaster: Borg's central controller, logically one process but replicated five times with state in a Paxos-based store (Schedulers: Borg to Kubernetes).
Bucket, object and key: the nouns of an object store, a flat namespace of buckets holding objects under keys, read and written whole over HTTP (Storage: Block, File & Object).
Burn-in: tests that new and repaired machines run in the in-memory environment before they enter the available pool (Dedicated Servers & Bare Metal).
Burst window: a CPU-sharing model (Google E2 shared-core) that allows a short burst at full speed periodically, at no extra charge, instead of a credit bank (Virtualization & the VPS).
Cabinet: a lockable rack enclosure in a shared colocation room with power circuits to it, sold whole, by fraction or by single rack unit (The Data Center & Colocation).
Cage: a fenced colocation area of several cabinets built to order for a single customer (The Data Center & Colocation).
CageFS: CloudLinux's per-user filesystem view built from a template, giving each account its own /etc and /tmp and a restricted /proc so it can't see the server or other accounts (Shared Hosting Isolation).
Capabilities (Linux): root's powers split into units such as CAP_NET_ADMIN and CAP_SYS_ADMIN; a provider drops most by default, and a privileged container gets them all and is effectively the host (From chroot to Containers).
Capacity reservation: a product that guarantees capacity of an instance type in a zone without a discount, billed at the on-demand rate whether used or not; capacity is not quota (Regions, Zones, Cells & Quotas).
CDN functions: small functions on a CDN's request path (CloudFront Functions, Lambda@Edge) with tight limits and a per-invocation price (Functions, Isolates & Edge Compute).
Cell (architecture): a complete copy of a service that serves only some customers, so a bad deploy or a poison request reaches a fraction of them (Regions, Zones, Cells & Quotas).
Cell (Borg): a set of machines managed by Borg as one unit (Schedulers: Borg to Kubernetes).
Cell router: the thinnest possible layer in a cell architecture, routing each request to the right cell by its partition key and doing nothing else (Regions, Zones, Cells & Quotas).
Ceph: a self-hosted storage system, a RADOS cluster with CRUSH placement serving a file system and an S3 and Swift gateway, where the operator owns durability (Storage: Block, File & Object).
Cloud Hypervisor: a general-purpose Rust VMM under the Linux Foundation with more devices (including PCI passthrough) and guests than Firecracker, used in Kata deployments (Sandboxes & MicroVMs).
Cloudflare Containers: containers started on demand from a Worker through a Durable Object, each instance in a Firecracker microVM with its own kernel and network (From chroot to Containers).
Cloudflare R2: Cloudflare's S3-compatible object store with free egress, whose documentation lists the S3 features it doesn't implement (Storage: Block, File & Object).
Cloudflare Workers: Cloudflare's edge functions in V8 isolates, many tenants per process, billed by requests and CPU time with no charge for duration (Functions, Isolates & Edge Compute).
CloudFront Functions: AWS's lightweight CDN functions for request-path work such as header rewrites, with tiny memory and code limits and a price per invocation (Functions, Isolates & Edge Compute).
CloudLinux OS: a hosting operating system that gives each account an LVE of kernel resource limits, with CageFS, PHP Selector, mod_lsapi PRO and MySQL Governor, turning noisy neighbors into per-account limits with fault counters (Shared Hosting Isolation).
Cold start: the INIT phase of a function plus the time to get a slot, of which the provider controls only the second half (Functions, Isolates & Edge Compute).
Collisions (ECMP): ECMP's failure mode, where hashing places two large flows on the same uplink so each gets half of it while other links sit idle, the problem AI training traffic exposes (Data Center Networking).
Conditional writes: object storage PUTs that fail if the key exists (If-None-Match) or unless the current ETag matches (If-Match), giving compare-and-swap on a key (Storage: Block, File & Object).
Control groups (cgroups): the Linux kernel's limits on CPU, memory, I/O, process count and cpusets, with v2's single hierarchy; the limit on every container, and so how far a host is oversold (From chroot to Containers).
Control plane: the administrative APIs that create, read, update, delete and list resources, more complex and so more failure-prone than the data plane (Regions, Zones, Cells & Quotas).
Controllable Load Resource: an ERCOT registration for a load that can reduce or increase consumption under ERCOT's dispatch and sell ancillary services, the program large miners used (The Data Center & Colocation).
CPU credit: the unit of burstable instances, one vCPU at 100% for one minute or any equivalent, earned at a fixed hourly rate set by instance size (Virtualization & the VPS).
Cross-connect: a point-to-point fiber or copper run inside a data center from a tenant's cabinet through a meet-me room to another tenant, a carrier, an internet exchange or a cloud on-ramp, billed monthly (The Data Center & Colocation).
Curtailment (power): a large load giving power back to the grid, for a credit when voluntary and as a duty when directed; in ERCOT, Texas SB 6 made it a condition for large loads (The Data Center & Colocation).
Data plane: the part of a service that does its primary function (the running instance, volume reads and writes, bucket GETs and PUTs, DNS answers), kept intentionally simpler than the control plane (Regions, Zones, Cells & Quotas).
DCQCN: end-to-end ECN-based congestion control for RoCE v2 from Microsoft and Mellanox, so senders slow down before PFC has to pause links (Data Center Networking).
Dedicated Local Zones: AWS infrastructure built for one customer's exclusive use in a location it specifies, fully managed by AWS as part of a parent Region (Hybrid & On-Prem Cloud).
Dedicated vCPU: a CPU model with threads pinned to one VM, giving predictable performance at the highest price (Virtualization & the VPS).
Deep-buffer switch: a switch chip with large packet buffers, placed where many flows converge such as the spine, against shallow-buffer chips at the leaf (Data Center Networking).
Delete marker: the placeholder that a DELETE without a version ID inserts as the current version in a versioned bucket, leaving earlier versions in place (Storage: Block, File & Object).
Deployment Stamps: Azure's name for cells, independent copies of a service (stamps or scale units) each serving a set number of tenants and deployed separately (Regions, Zones, Cells & Quotas).
Distribution specification (OCI): the OCI standard for registries, based on the Docker Registry HTTP API V2, covering pull, push, content discovery and content management (From chroot to Containers).
Docker Engine: a daemon and CLI over containerd and runc that builds and runs containers in one tool, with a root daemon unless run rootless (From chroot to Containers).
Docker Swarm: Docker's clustering, built into Docker Engine as swarm mode (docker swarm init and join), minimal to set up but with a small feature set and little momentum (Schedulers: Borg to Kubernetes).
Durability (object storage): the provider's per-object claim against losing acknowledged data to hardware failure, which depends on fast repair and covers neither the customer's own deletes nor the provider's tooling mistakes (Storage: Block, File & Object).
E2B: a sandbox service that runs untrusted agent code in Firecracker microVMs that resume from a snapshot and pause when the agent stops (Sandboxes & MicroVMs).
eBGP (data center): the RFC 7938 design that runs eBGP on every fabric link with private ASNs (one shared by the spines, one per top-of-rack), making BGP the only routing protocol (Data Center Networking).
EBS snapshot: an incremental backup of a block volume, saving only blocks changed since the previous snapshot, stored in S3 across zones; backups are the customer's job (Storage: Block, File & Object).
ECMP (equal-cost multipath): routing that spreads traffic over many equal-cost paths by hashing each flow's five-tuple, so one flow's packets stay in order on one path (Data Center Networking).
ECN: marking packets at a congested switch instead of dropping them, so the receiver tells the sender to slow down (Data Center Networking).
EFA and SRD: AWS's Elastic Fabric Adapter (ENA plus OS bypass through libfabric) and its Scalable Reliable Datagram transport, reliable but out of order, spraying a flow's packets across many paths from the Nitro card (Data Center Networking).
EFS throughput modes: Amazon EFS's billing choices for file share throughput: Elastic (billed per data read and written), Provisioned (billed for throughput above what storage includes) and Bursting (baseline plus credits) (Storage: Block, File & Object).
Endpoint (private): a network object that exposes a service privately inside the customer's virtual network, such as a PrivateLink endpoint appearing as a network interface (Data Center Networking).
Entry processes (EP): the CloudLinux LVE limit on concurrent entries into an account's container (web requests, SSH sessions, cron), above which Apache returns HTTP 508 (Shared Hosting Isolation).
Equivalence classes (Borg): a scheduling shortcut that scores one task per group of identical tasks (Schedulers: Borg to Kubernetes).
F16: Meta's 2019 data center fabric that connected each rack to 16 planes, each a single switch chip, for four times the capacity of its four-plane design (Data Center Networking).
Fabric: the network that connects every server in a building to every other at a known bandwidth, which went from a tree of ever-larger routers to a mesh of identical small switches (Data Center Networking).
Falcon: Google's hardware transport, first in the Intel IPU E2000, with hardware RTT measurement, per-flow shaping and fast retransmit, opened through OCP (Data Center Networking).
Fastly Compute: Fastly's edge functions in WebAssembly on Wasmtime, starting a new sandbox for each request by default (Functions, Isolates & Edge Compute).
Fault (LVE): CloudLinux's count each time an account hits a limit, recorded by LVE-Stats with a snapshot of its processes and queries and grouped into incidents (Shared Hosting Isolation).
Fault domain: a rack or hardware group inside one building used for anti-affinity, short of a second building; Oracle offers them inside single-availability-domain regions (Regions, Zones, Cells & Quotas).
FCGId: the mod_fcgid PHP handler in cPanel, incompatible with mod_ruid2 and mpm-itk and meant for advanced administrators (Shared Hosting Isolation).
File share: a mounted file system spoken over NFS or SMB to many clients at once, promising POSIX or Windows semantics, locking and throughput (Storage: Block, File & Object).
Firecracker: AWS's minimal KVM VMM, one process per microVM with only five emulated devices, a jailer and snapshots, which became the industry's microVM for Lambda, Fargate, Fly.io, Cloudflare Containers, Vercel Sandbox and E2B (Sandboxes & MicroVMs).
Firecracker snapshot: a guest memory file plus a microVM state file, restored by mapping memory privately and loading pages on demand, which should be resumed once because restores share captured randomness and tokens (Sandboxes & MicroVMs).
Fly.io Machines: Fly.io's images run as Firecracker microVMs through a REST API, billed per second while running (From chroot to Containers).
FPM (PHP handler): PHP-FPM as a panel's PHP handler, served through mod_proxy_fcgi and running as the pool's user, the per-user default the current panels recommend (Shared Hosting Isolation).
Frontend and backend networks: the split in AI clusters between a frontend network for data ingestion, checkpointing and logging and a backend network for training traffic with one RDMA NIC per GPU (Data Center Networking).
Gateways (virtual network): the objects connecting a virtual network to the internet (an internet gateway, or a NAT gateway for outbound-only instances), to on-premises networks and to other networks (Data Center Networking).
GKE Enterprise: Google's Kubernetes software on the customer's own bare metal or VMware, managed as fleets from Google Cloud (Hybrid & On-Prem Cloud).
Google Cloud Run: Google's serverless containers and functions, first generation on gVisor and second generation in a microVM with full Linux compatibility, with many concurrent requests per instance (From chroot to Containers).
Google Distributed Cloud: Google's on-premises offerings: connected (Google-certified hardware the customer maintains, with Google running the software) and air-gapped (Google-engineered racks or appliances completely disconnected from the internet) (Hybrid & On-Prem Cloud).
Google IPU: an infrastructure processing unit co-designed by Google and Intel that offloads networking with line-rate encryption and carries the Falcon transport (Data Center Networking).
gp3: the EBS volume type that decouples throughput and IOPS from size, unlike gp2, where customers bought capacity to get speed (Storage: Block, File & Object).
gVisor: Google's user-space kernel per sandbox, an OCI runtime (runsc) that intercepts system calls so the host kernel sees a small filtered set, needing no hardware virtualization at a CPU cost per syscall (Sandboxes & MicroVMs).
gVisor Gofer: the host process started with each gVisor container that mediates all filesystem access over 9P, so the Sentry never opens host files (Sandboxes & MicroVMs).
gVisor platform: how gVisor's Sentry catches system calls, a provider tuning choice between systrap (seccomp traps, the default and better inside a VM) and KVM (Sandboxes & MicroVMs).
gVisor Sentry: gVisor's largest component, implementing system calls, signals, memory management and threading without passing the application's calls through to the host (Sandboxes & MicroVMs).
Hoverboards: gateways in Google's Andromeda that carry the long tail of idle flows while the control plane programs direct host-to-host rules only for hot ones (Data Center Networking).
HTTP 508: the error Apache returns when a CloudLinux account exceeds its entry processes limit (Shared Hosting Isolation).
Hyperscaler .metal instances: whole bare machines rented by the hour inside a cloud, with its network, storage and IAM, while the provider's card still controls I/O (Dedicated Servers & Bare Metal).
IBM Cloud Satellite: IBM's model of running a location's control plane from an IBM Cloud metro over hosts the customer supplies in its data center, an edge site or another cloud (Hybrid & On-Prem Cloud).
Identity, resources and visibility: the three problems each generation of shared hosting isolation fixed: whose user a script runs as, how much one account can use, and what it can see of the server and other accounts (Shared Hosting Isolation).
Image digest: the content hash that names exactly one set of image bytes, recorded at deploy time so "what was running" has one answer however often a tag moves (From chroot to Containers).
Image index: the OCI document listing manifests for different platforms, so one image name resolves to an amd64 or arm64 image as the host requires (From chroot to Containers).
In-memory operating system: the netbooted environment that runs entirely in RAM to inventory hardware, run burn-in tests, wipe disks and write an image, such as Hetzner's Rescue System (Dedicated Servers & Bare Metal).
INIT, INVOKE and SHUTDOWN: Lambda's execution-environment lifecycle: INIT creates the environment and runs static code, INVOKE runs the handler, and SHUTDOWN ends it; a request landing on a frozen environment is a warm start that skips INIT (Functions, Isolates & Edge Compute).
Inodes (shared hosting): the count of files and directories an account may hold, enforced through /home quotas; at the hard limit the user can't write new files, which is where "unlimited" storage ends (Shared Hosting Isolation).
IPMI: the older BMC management protocol, whose version 2.0 added Serial over LAN and stronger authentication and encryption (Dedicated Servers & Bare Metal).
iPXE: open-source network boot firmware that extends PXE to HTTP, iSCSI and other transports, so a loader can fetch a kernel, initramfs and script with per-machine parameters (Dedicated Servers & Bare Metal).
Isolates and Wasm at the edge: function platforms (Cloudflare Workers, Fastly Compute) that run in hundreds of locations inside a language runtime, start in milliseconds or less, cap memory and bill CPU time or requests (Functions, Isolates & Edge Compute).
Jailer (Firecracker): the wrapper that places Firecracker in a chroot with its own PID and network namespaces, dropped privileges and a restrictive seccomp profile before the guest boots (Sandboxes & MicroVMs).
Job and task (Borg): a Borg job is a set of identical tasks, each with a priority, admitted by quota before scheduling (Schedulers: Borg to Kubernetes).
Kata Containers: a lightweight VM per pod behind an OCI and CRI runtime, a drop-in hardware boundary for multi-tenant Kubernetes with a choice of VMM (Sandboxes & MicroVMs).
kube-scheduler: Kubernetes' scheduler, which filters for feasible nodes and scores them, picking the highest with ties broken at random, and preempts lower-priority pods by PriorityClass (Schedulers: Borg to Kubernetes).
KVM: the Linux kernel module for hardware-assisted virtualization, paired with QEMU or a custom VMM, running any guest OS and used by most clouds and developer clouds (Virtualization & the VPS).
Lambda@Edge: AWS's functions on CloudFront's origin and viewer events, with larger limits than CloudFront Functions and billing by requests and GB-seconds (Functions, Isolates & Edge Compute).
Leaf-spine: the two-layer data center fabric where each leaf (top-of-rack switch) connects to every spine, so any server reaches any other in three switch hops and the fabric grows by adding leaves (Data Center Networking).
Legal hold (Object Lock): an Object Lock protection on an object version with no expiry, lasting until removed (Storage: Block, File & Object).
Letter of authorization and connecting facility assignment (LOA-CFA): the document the owner of a far port issues naming its panel and port, which the other side gives the colocation operator to order a cross-connect (The Data Center & Colocation).
libfabric: the OS-bypass interface through which AWS EFA serves MPI and NCCL, also the base of Ultra Ethernet's software (Data Center Networking).
Lifecycle rule: an object storage rule that transitions objects to colder classes or expires them, applying to existing objects as well as new ones, and a deletion path no bucket policy blocks (Storage: Block, File & Object).
Live migration: moving a running VM to another host without a reboot, which lets a provider drain a host before maintenance (Virtualization & the VPS).
Lossless Ethernet: a RoCE fabric configured so switches don't drop packets, with PFC, ECN and congestion control, because RDMA's recovery from loss is expensive (Data Center Networking).
LSAPI: the LiteSpeed API PHP handler, included by default in cPanel, whose full functionality requires CloudLinux (Shared Hosting Isolation).
LSMs (AppArmor, SELinux): Linux Security Modules giving mandatory access control over files and operations, applied as one profile for every tenant or per workload (From chroot to Containers).
LVE: CloudLinux's kernel-level container per account that limits CPU, memory, I/O and processes without separating the filesystem (Shared Hosting Isolation).
MAAS: Canonical's open-source bare-metal provisioning stack covering a machine's lifecycle from enlistment to release (Dedicated Servers & Bare Metal).
Manifest (OCI): the document describing the components of a container image: a config and a list of layers, each named by a descriptor with media type, size and content digest (From chroot to Containers).
Marathon: Mesosphere's container orchestration framework on Apache Mesos, now archived (Schedulers: Borg to Kubernetes).
Mesos: Apache's two-level scheduler, where the master offers resources and frameworks accept or reject them, retired by the Apache board (Schedulers: Borg to Kubernetes).
Minimum object size: a storage class's smallest billable object, so small objects bill as if they were that size, in effect a small-object fee (Storage: Block, File & Object).
Minimum storage duration: an object storage class's minimum billing period, so an object deleted or transitioned early is billed for the rest, in effect a deletion fee (Storage: Block, File & Object).
mod_lsapi PRO: CloudLinux's Apache module based on the LiteSpeed API that runs PHP like suPHP or PHP-FPM, optionally keeping lsphp running for opcode caching (Shared Hosting Isolation).
mod_php (DSO): PHP loaded into Apache, running every site as the web server's user, so one compromised site reaches all; legacy only (Shared Hosting Isolation).
mod_ruid2 and mpm-itk: Apache modules that switch to the owner's user inside the web server, which keeps performance but makes the web server root-equivalent (Shared Hosting Isolation).
Monolithic scheduler: a scheduler with a single, centralized algorithm for all jobs, as Borg's was at the time Omega's paper named the architectures (Schedulers: Borg to Kubernetes).
MRC (Multipath Reliable Connection): an extension of RoCE v2 with per-packet multipath and sender-based congestion control over best-effort Ethernet (Data Center Networking).
Multipart upload: the S3 method for large objects, sending up to thousands of parts that the store assembles, required above the single-PUT size limit (Storage: Block, File & Object).
MySQL Governor: CloudLinux's limiter for the shared database server, monitoring CPU and read and write bytes per MySQL user and restricting abusers (Shared Hosting Isolation).
Namespaces (Linux): kernel views (mount, PID, network, UTS, IPC, user, cgroup, time) that a container unshares; a user namespace makes root inside the container unprivileged outside (From chroot to Containers).
Network (VPC): a customer's private address space in a region (VPC, VNet, VCN), divided into subnets with route tables, gateways and endpoints on top of the shared fabric (Data Center Networking).
Network boot (PXE): firmware asking DHCP for an address and boot file, then fetching a small loader over TFTP and running it, the first step of automated provisioning (Dedicated Servers & Bare Metal).
Nitro Cards: AWS's dedicated hardware that implements every outward interface of an EC2 server (VPC network, EBS and local NVMe, encryption and the control-plane API) apart from the main CPUs (Sandboxes & MicroVMs).
Nitro Controller: the primary Nitro card, the hardware root of trust and the exclusive gateway between the server and the EC2, EBS and VPC control planes (Sandboxes & MicroVMs).
Nitro Hypervisor: the minimal hypervisor left once I/O moves to Nitro Cards, partitioning CPU and memory and assigning SR-IOV functions of the cards' devices directly to VMs (Sandboxes & MicroVMs).
Nitro Security Chip: the chip on the main board that moderates firmware access and holds the CPUs in reset until the Nitro Controller verifies everything, which makes bare metal instances safe to rent (Sandboxes & MicroVMs).
Nomad: HashiCorp's scheduler for service, batch and system jobs, ranking feasible nodes mainly by bin packing and applying plans with optimistic concurrency (Schedulers: Borg to Kubernetes).
NPROC: the CloudLinux LVE limit on all processes and threads in an account, which should exceed entry processes by a margin (Shared Hosting Isolation).
Nutanix: a cloud platform software stack sold for customer hardware and for cloud bare metal with portable licenses, a common VMware alternative (Hybrid & On-Prem Cloud).
NVIDIA BlueField: NVIDIA's DPU line that offloads SDN, storage and security from the host, programmed with the DOCA SDK (Data Center Networking).
Object Lock (WORM): write-once protection on a specific object version in a versioned bucket; compliance mode can't be overridden even by the root user, and governance mode can by a principal with a bypass permission (Storage: Block, File & Object).
Object store: an HTTP API of buckets and keys that promises an acknowledged object stays readable for years across a whole region, priced per gigabyte-month (Storage: Block, File & Object).
OCI Dedicated Region: a complete Oracle cloud region with the public cloud's services installed in the customer's data center, with a large minimum footprint (Hybrid & On-Prem Cloud).
OpenStack: open-source cloud software with no license fee and every layer replaceable, where the customer operates every service (Hybrid & On-Prem Cloud).
OpenStack Ironic: bare metal provisioning as an OpenStack compute driver or standalone, with broad drivers (IPMI, Redfish, iDRAC) and cleaning steps (Dedicated Servers & Bare Metal).
Oracle Compute Cloud@Customer: an Oracle rack installed in the customer's data center and fully managed by Oracle, connected to the customer's OCI tenancy (Hybrid & On-Prem Cloud).
Overcommit: selling more vCPUs or memory than a host physically has, a product decision that steal time and swapping reveal to customers (Virtualization & the VPS).
Oversubscription: the ratio of a leaf's downlink bandwidth to its uplink bandwidth; 1:1 is non-blocking, and general-purpose fabrics run oversubscribed as a priced design choice (Data Center Networking).
Oxide cloud computer: a rack-scale computer sold to the customer with hardware and open-source system software designed together, no separate licensing and an API and console from day one (Hybrid & On-Prem Cloud).
Pack and spread (scheduling): the two scoring strategies: packing ("best fit") fills machines tightly and leaves whole machines free but penalizes misestimates, while spreading ("worst fit") leaves headroom at the cost of fragmentation (Schedulers: Borg to Kubernetes).
Packet spraying: sending the packets of one flow across many paths instead of pinning it to one, used by AWS SRD, Spectrum-X and Ultra Ethernet's transport, with reordering at the receiver (Data Center Networking).
Page sharing: merging identical memory pages across VMs copy-on-write, one of the techniques that made VM density pay (Virtualization & the VPS).
Partition key (cells): the value (customer ID, resource ID or another present in most calls) that a cell architecture partitions work by, aligned with the grain of the service (Regions, Zones, Cells & Quotas).
Partitions (InfiniBand): groups of ports identified by a partition key (P_Key) that isolate tenants on a shared InfiniBand fabric (Data Center Networking).
PFC (Priority Flow Control): a switch telling its upstream neighbor to pause one traffic class when a buffer fills, preventing drops at the cost of head-of-line blocking, congestion spreading and rare deadlocks (Data Center Networking).
PFC watchdog: a switch mechanism that breaks pause storms when a PFC pause lasts too long (Data Center Networking).
PHP Selector: CloudLinux's per-user choice of PHP version, modules and settings from its alt-php builds, which requires CageFS (Shared Hosting Isolation).
PHP-FPM pool: a set of persistent PHP worker processes with its own Unix user and group, socket, optional chroot and locked settings, the per-account identity default on cPanel, Plesk and DirectAdmin (Shared Hosting Isolation).
Placement groups: the customer-facing control over where instances land on the network, such as a cluster group in one high-bisection-bandwidth segment or partition groups spread across hardware (Data Center Networking).
Plan queue (Nomad): the leader's queue of placement plans from parallel schedulers that rejects colliding plans at commit (Schedulers: Borg to Kubernetes).
Platform functions: functions sold by a PaaS such as Vercel or Netlify on a hyperscaler underlay, adding framework integration while inheriting the underlay's limits (Functions, Isolates & Edge Compute).
PMEM: the CloudLinux LVE limit on physical memory (RSS, shared memory and page cache), at which cache is reclaimed and then processes are killed (Shared Hosting Isolation).
Pod (fabric): in Facebook's data center fabric, a group of racks served by fabric switches, with pods connected through spine planes (Data Center Networking).
Podman: a daemonless container engine that runs containers as root or a non-privileged user, with no root daemon (From chroot to Containers).
Power billing model: how colocation charges for power: an all-in rate per committed kilowatt bundling cooling and overhead, or metered energy plus a space or circuit charge (The Data Center & Colocation).
Power Usage Effectiveness (PUE): total facility power divided by IT equipment power, the operator's measure of overhead (1.0 would mean every watt reaches a server), which a tenant should ask for per building as operated (The Data Center & Colocation).
Powered shell: a building with power to it that a wholesale tenant fits out itself (The Data Center & Colocation).
Preemption: evicting lower-priority work to place higher-priority work; spot and low-priority products are the scheduler's eviction order with a price on it (Schedulers: Borg to Kubernetes).
Presigned URL: an object storage URL carrying the signing principal's credentials that works for anyone holding it, as often as they like, until it expires (Storage: Block, File & Object).
Private suite: a walled colocation room with its own access control, sometimes with its own cooling units (The Data Center & Colocation).
Privileged container: a container holding every capability, which is effectively the host, so it belongs only on capacity the customer owns or inside a VM (From chroot to Containers).
proxyexec: CloudLinux's path for commands that must run outside a user's CageFS, filtered by a list (Shared Hosting Isolation).
QP scaling: spreading RoCE traffic over more queue pairs in the collective library so ECMP hashing on the destination queue pair finds more paths, as in Meta's training clusters (Data Center Networking).
Quota: a limit on what one account or project may hold or do, per region, which protects the fleet, other tenants and the customer's own bill, and decides admission before the scheduler decides placement (Regions, Zones, Cells & Quotas).
Rack unit (U): the standard height of rack-mounted equipment, 1.75 inches, in which cabinets and single-server colocation are sold (The Data Center & Colocation).
Rail-optimized: an AI backend design where GPU n in every node connects to leaf switch n, its rail, so same-rank traffic is one switch hop and only cross-rail traffic climbs to the spine (Data Center Networking).
Read-after-write consistency: the guarantee that a GET or LIST after a successful PUT sees the new data, which S3 gives strongly (Storage: Block, File & Object).
Redfish: the REST API for BMCs on current servers, with serial console over SSH among its functions, preferred over IPMI (Dedicated Servers & Bare Metal).
Region: a metro area with its own control plane, its own prices and usually its own legal home, the customer-facing footprint of a provider (Regions, Zones, Cells & Quotas).
Regional functions: function platforms (AWS Lambda, Cloud Run functions, Azure Functions) that run in a cloud region in a microVM or container and bill memory multiplied by duration (Functions, Isolates & Edge Compute).
Relaxed randomization: a Borg scheduling shortcut that examines machines in random order until enough feasible ones are found (Schedulers: Borg to Kubernetes).
Remote hands: the colocation operator's staff doing physical work on a tenant's equipment (rack and stack, cross-connect termination, power cycling, swaps), run as a billable work order in fixed increments (The Data Center & Colocation).
Reservation (Borg): a task's reserved resources, starting at its limit and decaying toward actual usage plus a margin, with the gap lent to batch work (Schedulers: Borg to Kubernetes).
Resource offer: Mesos's mechanism, in which Mesos decides how many resources to offer each framework and the framework decides which to accept and what to run (Schedulers: Borg to Kubernetes).
Resource versus asset: the split between a customer's server resource, which keeps its ID, addresses and bill, and the physical asset backing it, recorded over time in server_assignments (Dedicated Servers & Bare Metal).
Retail colocation: cabinets, cages and suites sold to many tenants with power, cooling, security and remote hands bundled, fast to start but higher per kilowatt than wholesale (The Data Center & Colocation).
RoCE v2: RDMA over Converged Ethernet with routing through UDP headers, the Ethernet alternative to InfiniBand for AI fabrics (Data Center Networking).
Route tables: the virtual network objects that say where traffic for each prefix goes (Data Center Networking).
runc: the reference OCI runtime (with crun as an alternative) under containerd or CRI-O, running containers with namespaces and cgroups on the host kernel at native speed (From chroot to Containers).
runsc: gVisor's OCI runtime, called by Docker, containerd and Kubernetes in place of runc (Sandboxes & MicroVMs).
Runtime specification (OCI): the OCI standard for the bundle a runtime receives (a root filesystem plus config.json), its execution environment and its lifecycle (From chroot to Containers).
S3-compatible challengers: object stores (R2, B2, Wasabi, Hetzner, Spaces, OVHcloud, Akamai) that speak the S3 API with low or zero egress, where compatibility is a matrix of implemented features rather than a checkbox (Storage: Block, File & Object).
Scale-out: connecting GPU nodes or racks across a building over InfiniBand or Ethernet with one NIC per GPU (Data Center Networking).
Scale-up: connecting GPUs inside a node or rack with dedicated GPU-to-GPU links such as NVLink (Data Center Networking).
Score caching: a Borg scheduling shortcut that keeps machine scores until the machine or task changes (Schedulers: Borg to Kubernetes).
seccomp: the Linux filter on which system calls a process may make; the provider chooses the default filter and whether customers may relax it (From chroot to Containers).
Segment ID: the VNI, VLAN ID or InfiniBand P-Key that maps exactly one tenant network, never shared and never shown to the customer (Data Center Networking).
Serverless containers: a billing model (Fargate, Cloud Run, Container Instances, Fly.io) charging a container's declared size for the time it runs, with the provider owning bin packing (From chroot to Containers).
Service link (Outposts): the encrypted set of VPN connections from an Outpost to its parent Region, carrying customer VPC traffic and management traffic, whose loss the provider-operated racks treat as a fault (Hybrid & On-Prem Cloud).
Shallow-buffer switch: a switch chip with small shared buffers, used at the leaf, against deep-buffer chips where flows converge (Data Center Networking).
Shared vCPU: an overcommitted, best-effort CPU model with no meter, cheap and simple but subject to steal under contention (Virtualization & the VPS).
Shared-kernel containers (OpenVZ, Virtuozzo, LXC): one kernel with many isolated user spaces, the highest-density VPS model, where a kernel bug reaches every tenant and the customer can't choose the kernel (Virtualization & the VPS).
Shared-state scheduler: Omega's architecture, where several schedulers each see the whole cluster and commit placements as optimistic transactions, retrying on conflict (Schedulers: Borg to Kubernetes).
SHARP: the Scalable Hierarchical Aggregation and Reduction Protocol, which moves reductions into InfiniBand switches so they add partial sums in transit (Data Center Networking).
Shuffle sharding: giving each customer its own random combination of workers instead of a fixed group, so one customer's load or attack reaches few others (Regions, Zones, Cells & Quotas).
Slot (Lambda): a Firecracker microVM holding a single sandbox for a single customer function with a minimized kernel and userland, used for one concurrent invocation and recycled within hours (Sandboxes & MicroVMs).
SONiC: Microsoft's open-source switch operating system, built on OCP's Switch Abstraction Interface and now at the Linux Foundation, running on many switch models (Data Center Networking).
Sovereign partition: a separate control plane, identity system and operations staff for a jurisdiction (AWS European Sovereign Cloud, Azure Government, OVHcloud SecNumCloud), not just another region (Regions, Zones, Cells & Quotas).
Spectrum-X: NVIDIA's AI Ethernet, Spectrum-4 switches coupled with BlueField-3 SuperNICs, with adaptive routing that sprays packets and reorders them in host memory (Data Center Networking).
SPEED: the CloudLinux LVE limit on CPU as a percentage of one core, above which the account's processes are throttled (Shared Hosting Isolation).
Standard and Unlimited modes: AWS burstable modes: Standard spends banked credits and drops to baseline at zero, while Unlimited spends surplus credits and bills the excess above a rolling 24-hour baseline (Virtualization & the VPS).
Static stability: the design rule that systems keep operating normally without making changes while a dependency, such as a control plane, is failed or unavailable (Regions, Zones, Cells & Quotas).
Steal time: the gap a Linux guest reports in /proc/stat while the hypervisor runs another guest, the customer's only direct view of a noisy neighbor (Virtualization & the VPS).
Subnet manager: the InfiniBand service (OpenSM is the open one) that must run per subnet to scan, initialize and sweep the fabric and compute forwarding (Data Center Networking).
Subnets: the divisions of a virtual network, usually one or more per zone (Data Center Networking).
suEXEC and suPHP: the per-request models that run PHP as the site owner, isolating identity at the cost of a process per request; suPHP is unmaintained (Shared Hosting Isolation).
Surplus credits: credits an Unlimited burstable instance spends beyond its bank, paid down by later earnings or billed per vCPU-hour above baseline (Virtualization & the VPS).
System limits: fixed provider limits that, unlike adjustable quotas, can't be raised (Regions, Zones, Cells & Quotas).
TIA-942: a data center rating standard from Rated-1 (basic site infrastructure) through Rated-3 (concurrently maintainable) to Rated-4 (fault tolerant) (The Data Center & Colocation).
Tinkerbell: a CNCF sandbox bare-metal provisioner running workflows of containerized actions over iPXE, small and Kubernetes-native (Dedicated Servers & Bare Metal).
Two-level scheduler: a scheduler where one resource manager offers resources to independent frameworks that pick what to run, as Mesos did (Schedulers: Borg to Kubernetes).
UALink: the open specification for scale-up links among accelerators within an AI computing pod, an alternative to NVLink (Data Center Networking).
Ultra Ethernet Consortium: the Linux Foundation project defining Ultra Ethernet and its transport (UET), with packet spraying, receiver-granted credits, Link Level Retry and ephemeral connections; it has no compliance program, so hardware is "UEC-ready," not compliant (Data Center Networking).
Undersubscription: building more uplink capacity than downlink (Meta's AI backend started at 1:2) to work around routing collisions (Data Center Networking).
Uptime Institute Tier Standard: the four-level data center rating by power and cooling topology, from Tier I to Tier IV, where Tier III is concurrently maintainable and Tier IV survives an unplanned failure of one component (The Data Center & Colocation).
User Beancounters: OpenVZ's per-container counters with limits, guarantees and a fail counter that recorded each time a container hit one (Virtualization & the VPS).
V8 isolates: many tenants in one V8 process, starting in milliseconds with tiny memory each, limited to JavaScript and Wasm, where a V8 bug is a cross-tenant bug (Sandboxes & MicroVMs).
Variable retention: an Object Lock setting that sets the retain-until date when an event hold is released, for retention starting at a business event such as account closure (Storage: Block, File & Object).
vCPU: a hardware thread of a physical core, not a core, so two vCPUs can be one physical core (Virtualization & the VPS).
Vercel Functions: Vercel's functions on an AWS underlay, billed on active CPU time plus provisioned memory, with Fluid compute letting each instance handle multiple requests (Functions, Isolates & Edge Compute).
Vercel Sandbox: Vercel's product for running code in a Firecracker microVM with its own filesystem and network (Sandboxes & MicroVMs).
Versioning (object storage): a bucket setting under which overwrites create new whole-object versions and deletes add delete markers; once enabled it can only be suspended, never removed (Storage: Block, File & Object).
Virtual network: the private address space, subnets, routes and firewall rules each customer gets on the shared fabric, which moved from switches into host software and then into a card in each server (Data Center Networking).
VMware Cloud Foundation: the incumbent enterprise private cloud stack, subscription-only and per-core since Broadcom ended perpetual licenses (Hybrid & On-Prem Cloud).
VMware ESXi (vSphere): Broadcom's proprietary type 1 hypervisor with mature management, sold by subscription only (Virtualization & the VPS).
VXLAN: the RFC 7348 overlay that carries a 24-bit segment ID over UDP, escaping the VLAN limit for tenant networks (Data Center Networking).
Wasabi: an S3-compatible object store with one flat price per TB and a minimum storage duration on pay-as-you-go (Storage: Block, File & Object).
Wasm runtimes: WebAssembly sandboxes such as Wasmtime that start an instance per request or session in microseconds with capability-based imports, limited by language support and WASI (Sandboxes & MicroVMs).
Wholesale colocation: megawatts of space or a powered shell leased to one tenant on long terms, who fits it out and operates it while the operator handles the building (The Data Center & Colocation).
Zone (availability zone): a set of buildings inside a region with separate power, cooling and networking, close enough for synchronous replication and far enough apart that one disaster shouldn't take two (Regions, Zones, Cells & Quotas).
Zone name mapping: the practice of mapping physical zones to names differently per customer to spread load, so "zone a" in two accounts can be different buildings, with stable physical IDs available (Regions, Zones, Cells & Quotas).