Glossary Basic

A quick reference for the terms used in the articles. Each entry explains where the term applies and links to an article with detailed examples.

Jump to: A · B · C · D · E · F · G · H · I · J · K · L · M · O · P · Q · R · S · T · V · W

A

ACCESS EXCLUSIVE

The strongest table lock in PostgreSQL. It conflicts with every mode, including a plain SELECT. Most ALTER TABLE, DROP TABLE, TRUNCATE and VACUUM FULL statements take this mode. See Table-level locks.

Adapter

A layer that wraps an external SDK or API behind an interface defined by your own system (a port), so the rest of the code does not depend on vendor details. See Adapter pattern.

ADR (Architecture Decision Record)

A short document recording one architectural decision: context, decision, status and consequences (good and bad). An ADR is not edited after acceptance; a new decision gets a new ADR that supersedes it. See ADRs and technical docs.

Advisory lock

A lock whose meaning is defined by the application: PostgreSQL only grants and queues it on a 64-bit number (or two 32-bit numbers), without tying it to a table or row. It comes in session-level and transaction-level variants. See Advisory locks.

Anti-corruption layer (ACL)

A translation layer on the downstream side that converts an external system’s model into your own, so foreign concepts do not leak inside. It differs from a Published Language, which the upstream side publishes. See Bounded context.

Arbiter index

The unique index or NOT DEFERRABLE constraint that INSERT ... ON CONFLICT uses to detect a conflict, selected through the conflict target. See Upsert with ON CONFLICT.

ArgumentsHost

A NestJS object wrapping a handler’s arguments, used in exception filters. Call switchToHttp(), switchToRpc() or switchToWs() to get the request/response or data for each transport type. See Exception filters.

AsyncLocalStorage

A Node.js API that binds a store to the running async chain, so nested code can read context such as requestId without passing it through every function. The store exists only in the local process; across HTTP or a message broker, metadata must be propagated separately. See AsyncLocalStorage in Node.js.

Authorize / capture

Two steps of a card payment: authorize reserves the amount on the card; capture actually takes it. See Payment system.

Autovacuum

A PostgreSQL background process that runs VACUUM and ANALYZE on each table when the number of dead or changed rows exceeds a threshold (threshold plus scale factor times row count). See VACUUM, autovacuum and bloat.

B

Backward / forward compatibility

Backward: a new reader can read data written with the old schema (deploy consumers first). Forward: an old reader can read data written with the new schema (deploy the producer first). See Event schema evolution.

BFF (Backend for Frontend)

A server-side component that acts as the OAuth client for an SPA, keeps the tokens, and gives the browser only a session cookie. See OAuth 2.0, OIDC and PKCE.

Blue-green deployment

Running the old (blue) and new (green) versions at full size side by side and switching all traffic at once, keeping blue for an instant switch back. See Deployment strategies.

B-tree

A balanced multi-way tree index that keeps keys sorted to support equality lookups, ranges and some ORDER BY orderings. In PostgreSQL it is the default index type. See B-tree indexes in PostgreSQL.

Backpressure

A mechanism that makes the producer slow down when the receiver cannot keep up. With Node streams, write() returning false means the buffer is full and you must wait for the drain event. See Streams and backpressure.

Big key

A key with a very large value: a collection with many elements or a long string. O(N) commands, deleting and migrating such a key block or slow down Redis. Find them with redis-cli --bigkeys. See Redis data structures.

Blameless postmortem

A post-incident analysis that focuses on the systems and processes that allowed the failure, without blaming individuals, so people feel safe telling what actually happened. It ends with action items that have owners and due dates. See Incidents and postmortems.

Bloat

Table or index space taken up by dead tuples or free space not yet reused, making the file larger than the live data. VACUUM usually only marks free space for reuse and does not shrink the file. See VACUUM, autovacuum and bloat.

Bloom filter

A probabilistic structure that tests whether an element belongs to a set: “no” is definitely no, “yes” may be a false positive. Elements cannot be removed. See Cache penetration & avalanche.

Bounded context

A boundary within which one model and one shared language have a consistent meaning; the same word may mean something else in another context. It is not the same thing as a microservice. See Bounded context.

BRIN (Block Range Index)

A PostgreSQL index type that stores a min/max summary for each group of physically adjacent pages instead of one entry per row. It is tiny, but only effective when column values correlate with physical storage order (for example, logs written sequentially by time). See GIN, GiST and BRIN.

Bulkhead

Limiting concurrent calls to each dependency with a semaphore or a dedicated pool with a bounded queue, so one slow dependency cannot take every shared worker or connection pool slot. See Circuit breaker & bulkhead.

Burn rate

How fast the error budget is being spent relative to the allowed average rate, computed as error_ratio / (1 - SLO). A burn rate of 1 means the budget runs out exactly at the end of the window. See SLI, SLO and error budget.

BYPASSRLS

A role attribute that makes the role skip every row-level security policy, even on tables with FORCE ROW LEVEL SECURITY. Superusers always behave this way.

C

Cache avalanche

Many cache keys expire at the same time, or the cache loses all its data, so load floods the database within a short window. Fix it with TTL jitter, spread-out warming and HA. See Cache penetration & avalanche.

Cache busting (fingerprinted assets)

Putting a content hash in a file name so every change gets a new URL; the asset can then be cached for a year with immutable. See HTTP caching.

Cache hit / cache miss

Cache hit: the request finds the data it needs in the cache. Cache miss: the data is not in the cache (never stored, expired or evicted), so it must be fetched from the source.

Cache penetration

Requests for keys that do not exist in the primary data source, so the cache never hits and every request goes to the database. Fix it with validation, caching empty values, a bloom filter and rate limiting. See Cache penetration & avalanche.

Cache stampede

Many requests hit a cache miss on the same key at the same moment, so all of them go to the database even though the value only needs to be computed once. Also called a thundering herd. See Cache stampede.

Cache-aside

A caching pattern in which the application, not the cache, is responsible for keeping cache and database in sync: read the cache first, and on a miss read the database and write the result back to the cache. See Cache-aside pattern.

Canary release

Releasing a new version to a small share of traffic or Pods first and comparing its metrics with the stable version before widening it. See Deployment strategies.

Cardinality (metric)

The number of distinct label value combinations of a metric; Prometheus stores each combination as a separate time series. A label with unbounded values, such as a user ID, can make the series count explode. See High metric cardinality.

Cascading failure

A failure in one component spreading to others through shared resources or retries. Example: a slow provider takes every API worker, so even /health fails. See Circuit breaker & bulkhead.

Checkpoint

The point at which PostgreSQL writes all dirty pages to disk; WAL before it is no longer needed for crash recovery. The first modification of each page after a checkpoint writes a full-page image to WAL. See UUID or bigint keys.

Circuit breaker

Wraps calls to a dependency and measures the error rate and slow-call rate over a sliding window. Past the threshold it stops calling and fails fast for a while, then lets a few trial calls through (half-open). See Circuit breaker & bulkhead.

CLS (Continuation-Local Storage)

Context that follows an async chain. In Node.js it is built on AsyncLocalStorage; the nestjs-cls library uses it to carry a transaction or request ID across services without extra parameters. See Transactions across services.

Compensating transaction

A new business transaction that semantically undoes an earlier committed step of a saga (refund, release a hold). Unlike a rollback it does not restore the old state: a refunded charge is not a charge that never happened. See Saga.

Conditional request / 304 Not Modified

A request carrying If-None-Match or If-Modified-Since. If the stored version is still current, the server answers 304 with no body and the cache reuses its copy.

Connection pool

A set of database connections opened in advance and lent to requests. When it is exhausted, new requests wait. In PgBouncer transaction mode, a server connection belongs to a client only for one transaction, so session state can leak to another client. See Lock timeouts and monitoring.

Consumer-driven contract test

The consumer states what data it needs and the provider runs those tests in its own CI, for example Pact message pacts.

Consumer group

A group of Kafka consumers sharing the work of reading one or more topics, identified by a common groupId. Each partition is read by exactly one consumer in the group at a time. See Kafka consumer groups and rebalancing.

Consumer lag

The gap between the log-end offset and the committed offset of a consumer group, per partition. Also measure it in time (age of the oldest unprocessed record), because the offset count can be small while a record has waited a long time. See Consumer lag in Kafka.

Coordinated omission

A load generator that waits for responses sends fewer requests when the server slows down, so the measured latency hides the real queue. Avoid it with an open model (arrival rate). See Load testing with k6.

Copy-on-write (CoW)

After fork(), the parent and child processes share memory pages; a page is copied only when one side modifies it. Redis relies on this for snapshots, so RAM grows with the write volume during a save. See Persistence: RDB and AOF.

Correlation ID / traceparent

An identifier attached to one request and propagated through every service to tie logs and traces together. The W3C Trace Context standard uses the traceparent header in the form 00-<trace-id>-<parent-id>-<flags>. See Correlation ID.

CORS (Cross-Origin Resource Sharing)

A mechanism that lets the browser allow a page on one origin to read responses from another origin, based on server headers. It relaxes the Same-Origin Policy but does not stop the request from being sent, so it does not replace server-side access control. See CORS and CSRF.

CPU throttling (CFS quota)

When a container has a CPU limit, the kernel pauses all its threads once they use the quota for the current period (100 ms by default) and resumes them in the next period. Average CPU can look low while requests stall. See Requests & limits.

CQRS

Command Query Responsibility Segregation: separate models for changing data and for reading it, optionally in separate stores. See CQRS and event sourcing.

Crypto-shredding

Encrypting personal fields with a per-subject key and deleting the key to make them unreadable. The ciphertext remains; whether this counts as erasure is a legal question.

CSRF (Cross-Site Request Forgery)

An attack that makes the victim’s browser send a request with the login cookie to the target site without the user intending it. Defend with a CSRF token, the SameSite attribute, or checks on Origin or Sec-Fetch-Site. See CORS and CSRF.

D

Dead letter exchange (DLX)

The RabbitMQ exchange that receives dead-lettered messages: rejected without requeue, TTL expired, queue full or delivery limit exceeded. See Dead-lettering and TTL.

Dead-letter queue (DLQ)

Where messages go when they cannot be processed after exhausting retries or hitting a permanent error, for investigation and replay. Kafka’s consumer API has no built-in DLQ; RabbitMQ uses a dead letter exchange. See Retry topics and DLQ in Kafka.

Deadlock

Two (or more) transactions lock each other in a closed wait cycle: each holds what the other needs, and none can proceed. PostgreSQL detects it and aborts one transaction to break the cycle. See Deadlocks in PostgreSQL.

Decorator

A wrapper with the same interface as the object it wraps, adding one behaviour per layer (cache, retry, metrics). The order of the layers changes the behaviour. See Decorator pattern.

Dependency injection (DI) container

The component that creates objects (providers) and injects them where needed, based on declarations instead of code calling new itself. In NestJS, the container also manages provider lifecycle and scope. See The DI container in NestJS.

Dependency rule

The central rule of Clean Architecture: source code dependencies point only inward; outbound calls go through dependency inversion. See Hexagonal & clean architecture.

DNS rebinding

A technique that returns a public IP on the first resolution and an internal IP on the next (with a very low TTL), to bypass check-then-fetch logic. The defense is to resolve once and connect to exactly the IP that was checked. See SSRF.

Domain event / integration event

A domain event is an in-process notification of a business fact inside one bounded context. An integration event carries that fact to other services, asynchronously and only after commit, usually through an outbox. See Observer and domain events.

Double-entry ledger

An append-only record where each money event is a journal of debit and credit entries whose totals are equal; balances are sums of entries. See Payment system.

DTO (Data Transfer Object)

A class describing the shape of an endpoint’s input or output. In NestJS, DTOs carry class-validator decorators so ValidationPipe checks them at runtime. See DTO validation.

Dual write

Writing to the database and sending a message or calling another system as two separate, non-atomic operations. A crash between the two steps leaves them inconsistent. The common fix is an outbox. See Transactional outbox.

Dynamic module (NestJS)

A module that takes configuration at import time: a static method (forRoot, register…) returns a DynamicModule object with module, providers, exports, imports, global. See Dynamic modules.

E

Error budget

The allowed amount of failure within the SLO window, equal to 1 - SLO. An SLO of 99.9% over 30 days allows about 43.2 minutes of full outage. See SLI, SLO and error budget.

ETag / If-Match

ETag identifies the version of an HTTP resource. The client sends it back in If-Match; if the resource has changed, the server does not apply the change and may return 412. See Optimistic or pessimistic locking.

Event loop (Node.js)

The libuv loop that runs callbacks in phases (timers, pending, poll, check, close…). After each callback, the process.nextTick queue and then the microtask queue are drained. See The Node.js event loop.

Event sourcing

Storing every change as an immutable event in an append-only stream per aggregate; current state is derived by replaying (folding) the events. See CQRS and event sourcing.

Exception filter

A NestJS component that turns unhandled exceptions into error responses. A filter applies only within the scope it is registered in; an exception already handled by an interceptor does not reach the filter. See Request lifecycle in NestJS.

Expand–contract migration

A multi-phase way to change a schema without downtime: add (expand) the new column or table, backfill and move the application onto it, then remove the old one (contract) in a separate release. See Expand–contract migrations.

Expected version

The stream version a command loaded; the append fails if the stream has moved on (optimistic concurrency per stream).

Exponential backoff and jitter

Increasing the wait between retries (doubling each time, with a cap) and adding randomness (jitter) so clients do not retry in lockstep. Full jitter picks a random value between 0 and the backoff level. See Retry, backoff and jitter.

Extended statistics

Statistics PostgreSQL collects for a specified group of columns (via CREATE STATISTICS), helping the planner see correlation between columns instead of assuming they are independent. See Statistics, ANALYZE and how PostgreSQL estimates queries.

F

Fan-out on write / fan-out on read

Delivering a post by copying its id into every follower’s precomputed timeline when it is written (push), versus gathering posts from every followed account when the feed is read (pull). See News feed.

Feature flag

A runtime switch that turns a feature on or off without redeploying. There are several kinds (release, experiment, ops, permission); release flags must be removed once the feature is stable so they do not become technical debt. See Config and 12-factor.

Fencing token

A number that increases each time a lock or lease is granted. The resource rejects writes carrying an older token, so a holder that lost the lock cannot overwrite newer data. PostgreSQL advisory locks have no fencing token. See Advisory locks.

Flaky test

A test that, with the same code and conditions, sometimes passes and sometimes fails, usually because of time, execution order, shared state or async waits. See Flaky tests.

fsync

A system call that forces the kernel to write data from the page cache to the storage device. Data that was write()n but not fsynced survives a process crash but is lost if the machine goes down. See Persistence: RDB and AOF.

Full-page image (FPI)

A copy of a whole 8 kB page written to WAL on the first modification after a checkpoint when full_page_writes = on (the default). Randomly scattered inserts such as UUID v4 generate a lot of FPIs. See UUID or bigint keys.

G

GIN (Generalized Inverted Index)

A PostgreSQL index type that creates an entry for each component inside a composite value (each array element, each JSON key) rather than one entry for the whole value. Suited to containment searches on arrays, jsonb and full-text search. See GIN, GiST and BRIN.

GiST (Generalized Search Tree)

PostgreSQL’s general index framework; an operator class defines how to compare and narrow the search space for a specific data type or relation (range overlap, geometric data…). See GIN, GiST and BRIN.

Graceful shutdown

An orderly stop: stop accepting new work, wait for in-flight work to finish within a deadline, close resources, then exit. On Kubernetes, preStop, draining and cleanup share one grace period. See SIGTERM during deploys.

Guard

A NestJS component that decides whether a request may proceed, through its canActivate() method. It runs after middleware and before interceptors and pipes. See Request lifecycle in NestJS.

H

Hash slot / hash tag

Redis Cluster divides keys into 16,384 hash slots. The {...} part of a key name (a hash tag) makes Redis hash only that part, so several keys land in the same slot and can be used together in MULTI or a script. See Pipelining, MULTI and Lua.

Heap

PostgreSQL’s default table access method. A heap relation stores tuple versions on pages; their physical order is not guaranteed to match insert order or primary key values.

Hosted fields (tokenization)

Card inputs served by the payment gateway (iframe or redirect) so card numbers bypass the merchant’s servers, which receive only a token.

Hot key

A single cache key that receives a disproportionate share of traffic and overloads the one shard that owns it. Usually mitigated with a short in-process cache or read replicas.

Hot standby

A PostgreSQL server in recovery mode that continuously replays WAL from the primary and still serves read-only queries. Data becomes visible only after the commit record is replayed. See Replication and read replicas.

HyperLogLog

A probabilistic structure that estimates the number of distinct elements in fixed memory: at most 12 KB in Redis, with a 0.81% standard error. It cannot list elements. See Redis data structures.

Hysteresis (threshold)

Using different thresholds to switch into and out of a mode (for example 10,000 and 8,000 followers) so values near the boundary do not flip back and forth.

I

Idempotency

The ability to perform the same operation again without adding business effects beyond performing it once. For consumers or jobs with retries, identify the same operation with a stable key and protect the recording of its result. See Idempotent consumer.

Idempotency-Key (header)

An HTTP request header with a client-generated unique value, letting a server recognise retries of a non-idempotent request (POST) and return the original result instead of repeating the effect. Still an IETF Internet-Draft, not an RFC. See Idempotency-Key.

Idle in transaction

A state in pg_stat_activity: the session has opened a transaction but is not running any statement. It still holds every lock and its snapshot, so it blocks other sessions and holds back VACUUM. See Lock timeouts and monitoring.

IDOR / BOLA

Broken Object Level Authorization (OWASP API1:2023): an API accepts an object ID but does not check that the caller has access to that specific object. See BOLA and IDOR.

ID token

A JWT the OIDC provider issues to the client (aud = client_id) to prove authentication. It is not an API credential.

IMDS (Instance Metadata Service)

A cloud VM’s metadata service, for example AWS at 169.254.169.254, which can return IAM role credentials. It is the classic SSRF target; IMDSv2 requires a token obtained with PUT and a default hop limit of 1. See SSRF.

In-sync replicas (ISR)

The set of replicas of a Kafka partition (including the leader) that are keeping up with the leader within replica.lag.time.max.ms. With acks=all, a write is acknowledged only when every replica in the ISR has the record. See Replication, ISR and acks.

Inbox pattern

A table recording the IDs of processed messages; the consumer runs INSERT ... ON CONFLICT DO NOTHING in the same transaction as the business effect to deduplicate. See Idempotent consumer.

Interceptor

A NestJS component that runs code before and after the handler processes a request, commonly used for logging, timing or transforming the response. See Request lifecycle in NestJS.

J

Join algorithms (Nested Loop, Hash Join, Merge Join)

The three ways PostgreSQL executes a join: Nested Loop looks up each outer row, Hash Join hashes the smaller side and scans the larger one, Merge Join walks two sorted inputs in parallel. See Join algorithms.

JWKS (JSON Web Key Set)

The set of public keys an issuer publishes at jwks_uri, each with a kid; verifiers use it to pick the key for a token’s signature, which allows key rotation.

JWT (JSON Web Token)

A signed token containing claims (sub, exp, aud…) that can be verified locally without calling the server. The payload is just base64url, not encrypted, and it cannot be revoked before exp without adding state. See Session cookie or JWT.

K

Keyset pagination

Pagination that continues from the last key value of the previous page (WHERE id > $last_id) instead of counting and skipping rows with OFFSET. Cost does not grow with page depth. See Pagination in PostgreSQL: OFFSET and keyset.

KRaft

Kafka’s mode of managing metadata with Raft inside the brokers, replacing ZooKeeper. Kafka 4.0 removed ZooKeeper entirely. See Kafka distributed log.

L

Lamport clock / vector clock

Logical clocks: a Lamport clock increments on each event and takes max plus 1 on receiving a message, so a → b implies L(a) < L(b) but not the reverse. A vector clock can tell two concurrent events apart. See Lamport logical clocks.

Last stable offset (LSO)

The highest offset a Kafka read_committed consumer may read: every record before it belongs to a completed transaction. A long-open transaction holds the LSO back and delays reads. See Kafka transactions and exactly-once.

Layer cache (Docker)

Docker reuses a layer when the instruction and its inputs are unchanged. One layer miss rebuilds every layer after it, so instruction order in the Dockerfile determines rebuild speed. See Docker multi-stage & non-root.

Leakproof function

A function or operator guaranteed not to reveal its arguments, for example through error messages. Only leakproof ones may run before row-level security checks, which lets them use indexes.

Lease

The right to use a resource or process work for a bounded period. Expiry does not prove the old holder has stopped; you need to check update rights and design side effects accordingly when the right is granted to a new holder.

Listpack

Redis’s compact encoding for small hashes, sorted sets, sets and lists: one contiguous byte array, memory-efficient but searched linearly. Past a threshold, Redis switches to a larger encoding. See Redis data structures.

Lock ordering

A convention of acquiring locks in the same order to avoid wait cycles among the resources that follow it. It must be applied consistently across every related access path. See Deadlocks in PostgreSQL.

Lock queue

The queue of requests waiting for a lock on the same object. A new request must wait if it conflicts with a held lock or with a request waiting ahead of it (soft block), so a waiting DDL statement can block even SELECTs that arrive later. See Lock queue.

Lost update

An error that occurs when two transactions read the same data and then both overwrite it based on what they read. One of the writes is “lost” because it was based on data that was already stale at write time.

LSN (Log Sequence Number)

A position in the WAL, in the form 0/3033518, monotonically increasing and comparable. Used to measure replication lag and to check whether a replica has replayed up to a given commit. See Replication and read replicas.

M

Mass assignment

The client sends extra fields such as role or isVerified, and the app copies the whole body into the model, so the client can write fields it is not allowed to change. Block it with an allowlist, for example ValidationPipe’s whitelist. See DTO validation.

Memory-hard function

A hash function that needs a lot of RAM per run (Argon2, scrypt), reducing the parallelism advantage of GPUs and ASICs when guessing passwords. See Password hashing.

Middleware

The NestJS request-processing layer that runs before guards, commonly used to attach a request ID or write access logs. Middleware can be bound per route but has no guard-style ExecutionContext. Integration details depend on the HTTP adapter. See Request lifecycle in NestJS.

Minor unit

The smallest unit of a currency per ISO 4217 (USD has 2 decimals, VND 0); store amounts as integers in it.

Modular monolith

A single deployable split into modules with clear boundaries and public interfaces, usually enforced by tooling. See Modular monolith and microservices.

Multi-stage build

A Dockerfile with several FROM stages; only the final stage becomes the image, and the others only pass files along via COPY --from. Keeps build tools out of the runtime image. See Docker multi-stage & non-root.

Multi-tenancy

One system serving many customers (tenants) whose data must stay isolated: separate databases, separate schemas, or a shared schema with a tenant_id column. See Row-level security.

MVCC (Multi-Version Concurrency Control)

A mechanism that keeps multiple row versions so reads use a snapshot without waiting for writers’ row locks. Under Read Committed, a snapshot is taken per statement; under Repeatable Read, the snapshot is stable for the transaction. Conflicts between writes can still cause waits. See Row-level locks in PostgreSQL.

N

Negative caching

Caching a “does not exist” result with a short TTL to avoid querying the source again. It only helps when the same key is requested repeatedly; it must be deleted when the row is created. See Cache penetration & avalanche.

Node-pressure eviction

When a node runs low on a resource such as memory, the kubelet proactively terminates Pods, starting with those using more than their request. Different from OOMKilled, which is a container hitting its own limit.

O

Observer

A subject notifies registered listeners when something happens, so the publisher does not depend on its reactions. See Observer and domain events.

Offset (Kafka)

The sequence number of a record within a partition. A consumer group stores its committed offset to know where to continue reading. See Offset commit.

OIDC (OpenID Connect)

An identity layer on top of OAuth 2.0: besides the access token, the client receives an ID token (a JWT) saying who logged in and when. See OAuth 2.0, OIDC and PKCE.

OOMKilled

A container went over its memory limit and the kernel killed it with SIGKILL (exit code 137). The container restarts in the same Pod. See Requests & limits.

Open / closed workload model

Open model: requests arrive on a fixed schedule without waiting for responses (k6 arrival-rate). Closed model: each virtual user sends the next request only after the previous one finishes (constant-vus). See Load testing with k6.

Optimistic locking

Detecting conflicts at write time: add the version you read to the UPDATE’s WHERE; UPDATE 0 means someone else wrote first. No lock is held between read and write. See Optimistic or pessimistic locking.

P

Page

The fixed-size block PostgreSQL uses as the storage unit for tables and indexes; usually 8 kB, but it depends on the build. A page contains a header, line pointers, free space and items.

Partition

In Kafka: an ordered log within a topic. The producer picks a partition based on the partitioner configuration, the key, or an explicitly specified partition; how it picks without a key depends on the client. Kafka preserves record order within each partition. See Kafka consumer groups and rebalancing.

In PostgreSQL: a physical child table holding part of the data of a logical table declared with PARTITION BY (RANGE, LIST or HASH). See Partitioning in PostgreSQL.

Partition pruning

The PostgreSQL planner excluding partitions that cannot contain rows matching the WHERE condition, by comparing the condition with each partition’s bounds, before scanning any data. It only works when WHERE constrains the exact column used as the partition key. See Partitioning in PostgreSQL.

Pepper

A secret shared by all passwords and stored outside the database (KMS, secret manager), protecting the hashes when only the database leaks. See Password hashing.

Pessimistic locking

Locking at read time (SELECT ... FOR UPDATE) so other writers wait until commit. Suited to short transactions with high contention; never hold it across user interaction. See Optimistic or pessimistic locking.

PgBouncer

A lightweight connection pooler between the app and PostgreSQL, letting many client connections share a few server connections. It has three modes: session, transaction, statement. See Connection pooling and PgBouncer.

PHC string

The $id$v=..$params$salt$hash format that stores the algorithm, parameters, salt and hash in one column, allowing parameters to be raised gradually. See Password hashing.

Pipe

A NestJS component that validates and transforms input parameters (@Param, @Body, @Query) right before they are passed to the handler. See Request lifecycle in NestJS.

Pipelining (Redis)

The client sends several commands back to back without waiting for replies and reads the replies later, cutting round trips. Not atomic: other clients’ commands can still interleave. See Pipelining, MULTI and Lua.

Pivot transaction

The point-of-no-return step in a saga. After it succeeds, the remaining steps must be retried until they complete instead of being compensated.

PKCE (Proof Key for Code Exchange)

An extension to the OAuth authorization code flow: the client sends a hash of a random secret (code_challenge) at the start and must present the secret (code_verifier) to redeem the code, so a stolen code is useless.

Port (hexagonal)

An interface the application defines for one conversation with the outside world. A driving port is a use case the application offers; a driven port is something the application needs, such as a repository or payment gateway. See Hexagonal & clean architecture.

Prefetch (RabbitMQ)

The maximum number of unacked messages the broker delivers to one consumer. It regulates throughput and confirms nothing about processing. See Ack, prefetch and confirms.

Preflight

The OPTIONS request the browser sends on its own before non-simple cross-origin requests (for example Content-Type: application/json) to ask whether the server allows them. See CORS and CSRF.

Probe (liveness, readiness, startup)

Kubernetes’ three checks: liveness asks whether the container needs a restart, readiness asks whether the Pod can receive traffic, startup asks whether initialization has finished. See Kubernetes health probes.

Problem Details (RFC 9457)

The standard application/problem+json format for HTTP errors with the fields type, title, status, detail, instance. RFC 9457 obsoletes RFC 7807. See Problem Details.

Progressive delivery

A canary or blue-green release where a controller (Argo Rollouts, Flagger) moves traffic step by step and aborts automatically when metric analysis fails.

Projection / read model

A query-optimised view built by applying events in order and tracking a checkpoint; it can be rebuilt from the event log.

Provider scope (NestJS)

Rules for the lifetime of a provider instance. DEFAULT is reused across the application context; REQUEST follows the request context; TRANSIENT creates an instance per consumer that injects it. See Provider scopes in NestJS.

Q

QoS class

Guaranteed, Burstable or BestEffort. Kubernetes derives it from the requests and limits of every container in a Pod; it affects eviction order and oom_score_adj.

Quorum queue

A RabbitMQ queue type replicated with Raft, the recommended replicated option for durable queues. It has a default x-delivery-limit of 20 since RabbitMQ 4.0. See RabbitMQ queue types.

R

RDB / AOF (Redis)

Redis’s two persistence mechanisms. RDB is a binary snapshot of the dataset at a point in time; AOF is a log of write commands replayed at startup, made up of base, incr and manifest files since Redis 7. See Persistence: RDB and AOF.

Read Committed

PostgreSQL’s default isolation level. Each plain read statement uses a snapshot taken when the statement starts; two statements in the same transaction can see different committed changes. See Isolation levels in PostgreSQL.

Read-your-writes

A guarantee that a client always sees the data it just wrote. With async read replicas this is the application’s responsibility: read from the primary or wait for the replica to replay up to the write’s LSN. See Replication and read replicas.

Rebalance

The process by which Kafka reassigns partitions among the consumers in a group when group membership changes (join, leave, crash) or the topic’s partition count changes. See Kafka consumer groups and rebalancing.

Reconciliation

Matching your own records (payments, ledger) against an external source such as a gateway’s settlement file, and resolving every mismatch.

Redlock

A Redis locking algorithm over N independent masters: a client considers itself holding the lock only if it acquires a majority in less time than the TTL. Its safety without a fencing token is debated. See Distributed lock.

Reflector (NestJS)

A @nestjs/core provider that reads metadata decorators have written on a handler or class (get, getAllAndOverride, getAllAndMerge). Commonly used in guards and interceptors. See Custom decorators & Reflector.

Replication lag

The delay between a commit on the primary and the replica replaying that change. Measured with replay_lag in pg_stat_replication or the LSN difference. See Replication and read replicas.

Request fingerprint

A hash of the method, path and canonical body stored with an idempotency key, used to detect the same key reused for a different request (answered with 422).

Resource request / limit

A request is what the scheduler reserves for a container and what the HPA measures utilization against. A limit is the ceiling the kernel enforces through cgroups.

Retry budget

A cap on the ratio of retries to total requests so retries do not amplify an incident; Google’s SRE book cites about 10%, Envoy defaults to 20%. See Retry, backoff and jitter.

Rolling update (maxSurge / maxUnavailable)

The default Deployment strategy: replace Pods in batches limited by extra Pods allowed (maxSurge) and Pods allowed to be unavailable (maxUnavailable), both 25% by default.

Row-level lock

A PostgreSQL mechanism that locks a specific row (not the whole table), using the FOR UPDATE, FOR NO KEY UPDATE, FOR SHARE or FOR KEY SHARE clauses. See Row-level locks in PostgreSQL.

Row-level security (RLS)

A PostgreSQL feature where per-table policies filter which rows a role can read or write. The database enforces it, so a query that forgets its filter is still restricted. See Row-level security.

Ryuk (resource reaper)

A Testcontainers sidecar that removes every container, network and volume carrying the session label about 10 s after the test process disconnects. See Testcontainers.

S

Saga

A sequence of local transactions across services where each step has a compensating transaction; if a step fails, completed steps are compensated in reverse order. See Saga.

Salt

A random value generated per password and stored next to the hash. It defeats rainbow tables and gives two users with the same password different hashes; it does not make each guess slower. See Password hashing.

SameSite

A cookie attribute (Strict, Lax, None) that decides when the cookie is sent with cross-site requests. Lax sends the cookie with top-level navigations using safe methods; some browsers default to Lax. See CORS and CSRF.

Schema Registry

A service that stores versioned schemas per subject and rejects new versions that break the configured compatibility mode; records carry only a schema ID.

Semantic lock

An application-level marker (for example status PENDING) showing that a record is being changed by an unfinished saga, so other requests can wait, reject or show it as pending.

Serializable Snapshot Isolation (SSI)

How PostgreSQL implements Serializable: it still reads from a snapshot but tracks read–write dependencies and aborts a transaction (40001) when it detects a risk of violating serializability. See Isolation levels.

Settlement file

The payment provider’s periodic report of captures, refunds, fees and payouts, used for reconciliation.

Shared cache / private cache

A shared cache (CDN, proxy, gateway) stores responses for many users; a private cache (the browser) for one. private and s-maxage target this split. See HTTP caching.

Share group (Kafka)

A consumer group type with queue semantics (KIP-932): several consumers read the same partition and ack each record individually. According to the release announcement, Kafka 4.2 marks this feature production-ready. See Share groups.

SLI / SLO

An SLI is a quality measurement (ratio of good events to valid events); an SLO is the target for that SLI over a window, for example 99.9% over 30 days. See SLI, SLO and error budget.

Snapshot

The set of transactions a statement or transaction treats as committed; it decides which row versions are visible. See MVCC and Isolation levels.

Snapshot (event sourcing)

Cached folded state of a stream at version N, so loading replays only later events; disposable and regenerable. Not the MVCC snapshot.

Sorted set

A Redis type where each member is unique and has a score, always kept ordered by score; adds and updates cost O(log N). Suited to leaderboards. See Redis data structures.

SSRF (Server-Side Request Forgery)

A flaw where an attacker controls the destination of a server-issued request, making the server use its own network access to reach unintended resources. See SSRF when an API fetches a URL.

stale-while-revalidate

A Cache-Control extension (RFC 5861) letting a cache serve a stale response for N seconds while it refreshes it in the background.

Starvation

A piece of work keeps getting delayed while other work makes progress. In a queue using SKIP LOCKED, a job held under a lock for a long time can be skipped by workers many times.

Strategy

A pattern that encapsulates interchangeable algorithms behind a common interface, so the algorithm is chosen at runtime instead of through an if chain. See Strategy pattern.

T

Table-level lock

A lock on a whole relation (table, index), with 8 modes from ACCESS SHARE to ACCESS EXCLUSIVE, held until the end of the transaction. In pg_locks it is a row with locktype = 'relation'. See Table-level locks.

Template database

A PostgreSQL database cloned with CREATE DATABASE ... TEMPLATE. Nobody may be connected to it while it is copied. Useful to give each test file a fresh, migrated database.

Testcontainers

A library that starts throwaway Docker containers from test code, waits until they are ready, and returns a host and a random mapped port. See Testcontainers.

Test double

An object that stands in for a real dependency in a test. Mocks check the calls made to them; fakes reimplement simplified behaviour, such as SQLite in place of PostgreSQL.

Think time

The gap between read and write during which the application waits for something outside the database, usually a user editing a form. With long think time, do not hold locks or transactions. See Optimistic or pessimistic locking.

Thundering herd

See Cache stampede.

timestamptz

A PostgreSQL type that stores an absolute point in time (UTC internally) and displays it in the session’s TimeZone. It does not store the original time zone. See Data types that are easy to misuse.

TOAST

Short for The Oversized-Attribute Storage Technique. PostgreSQL uses it to compress or store out of line the large values of TOAST-capable data types.

Token bucket

A rate limiting algorithm: the bucket holds at most capacity tokens and is refilled steadily at rate; each request takes a token, and requests are rejected when none are left. It allows bursts up to capacity while keeping the long-run rate at rate. See Rate limiting for APIs.

Tolerant reader

A consumer that reads only the fields it needs and ignores unknown ones, so a producer can add fields safely.

Transaction ID wraparound

PostgreSQL uses 32-bit XIDs, so it must freeze old tuples before the counter wraps around; otherwise the server warns and then refuses to assign new XIDs to protect the data. See Transaction ID wraparound.

Transaction pooling

A PgBouncer pooling mode: a server connection is assigned to a client only for one transaction and then returned to the pool. Session state such as SET, LISTEN and session advisory locks cannot be used. See Connection pooling and PgBouncer.

Transaction propagation

Rules for what a transactional function does when a transaction is already open: reuse it (Required), open an independent transaction (RequiresNew), create a savepoint (Nested) or raise an error. See Transactions across services.

Transactional outbox

Writing the event to an outbox table in the same transaction as the business data; a relay later reads the table and publishes to the broker. Avoids dual writes. See Transactional outbox.

TTL (Time To Live)

How long a key lives in the cache before it automatically expires and is removed.

Tuple

The physical version of a row in the heap. A tuple contains a header PostgreSQL uses for version management, plus the column data; an update can create a new tuple version.

Twelve-factor app

A set of 12 principles for cloud applications, in which config (everything that varies between deploys) lives in the environment rather than in code, so the same artifact runs in many environments. See Config and 12-factor.

Two-phase commit (2PC)

A protocol where a coordinator asks participants to prepare (holding locks) and then commit. If the coordinator fails after prepare, participants stay blocked.

U

unhandledRejection

The Node.js event emitted when a promise is rejected with no handler. Since Node 15, the process exits by default. These errors do not go through NestJS exception filters. See Exception filters.

Upcasting

Converting an old stored event or message shape to the current one in one place at read time, without rewriting what is stored.

Upsert

An “INSERT if missing, UPDATE if present” operation in a single statement. In PostgreSQL it is INSERT ... ON CONFLICT DO UPDATE, which guarantees either an INSERT or an UPDATE under Read Committed. See Upsert with ON CONFLICT.

UUID v4 / UUID v7

v4 has 122 random bits; v7 (RFC 9562) starts with a 48-bit millisecond timestamp, so it is nearly monotonic. v7 keeps the B-tree insert path close to bigint but reveals the creation time. See UUID or bigint keys.

V

Varlena

PostgreSQL’s representation format for variable-length values. text and bytea are examples; for TOAST-capable types, the header can indicate whether the value is stored inline, compressed or as a reference to out-of-line data. See TOAST in PostgreSQL 17.

W

WAL (Write-Ahead Log)

A sequential log: every change is written to the WAL before it is written to the data files. Used for crash recovery, replication and PITR backups. See Replication and read replicas.

Worker

A background process or component that takes work from a queue and processes it. Multiple workers need a way to divide ownership so they do not pick up the same job.

Write amplification

One logical write turning into many physical writes, for example one post becoming one timeline insert per follower.

Write skew

Two transactions read the same condition and then write to two different rows, violating an invariant that neither transaction breaks on its own. Repeatable Read still allows it; Serializable prevents it. See Transaction anomalies.