Skip to main content

Glossary

Every term used across the documentation, in alphabetical order. Each entry links to the page that explains it in full.

A​

Alert​

A notification that something needs attention (node down, disk full, crash loop). Has a severity: Critical, Warning or Info. Read more.

API key​

A secret starting with clk_ that identifies a script or person and always has admin rights. Shown once when created. Read more.

Assignment​

The record saying that an instance runs on a given node, including its image pin. Read more.

Availability​

A node setting: active (can receive containers) or drain (its containers are moved away and none are added). Read more.

B​

Backup destination​

A restic repository (a node path, an SSH server or an S3 bucket) that backups are written to. A backup target ties a drive to a destination on a schedule. Read more.

C​

Cluster key​

The key that seals every secret and signs node-to-node requests. Lose the key file and every secret is lost. Read more.

cluster.yaml​

The file that describes the whole cluster: networks, drives, nodes, web UI, failover timers, proxy, sign-in. Its authoritative copy lives in raft. Read more.

Config (object)​

A named file stored in the cluster and mounted into containers. Not secret. Different from cluster.yaml. Read more.

Consent page​

The dashboard page where you approve or deny an AI client's access request. Read more.

Container​

A running Docker container. In Clouduler every container is an instance of a service. Read more.

Crash loop​

An instance that keeps dying and restarting. After repeated kills the cluster moves it to another node. Read more.

D​

Debounce​

The wait before a warning alert is sent. A warning that clears inside the window is never sent. Default 5 minutes. Read more.

Digest (alerts)​

One daily message that collects Info alerts. Read more.

Digest (image)​

The fingerprint of an exact image build. Pin, running and latest digests are different things. Read more.

Drain​

Set a node's availability to drain so its containers move elsewhere, for example before maintenance. Read more.

Drive​

A named, cluster-wide storage area. Each node maps the name to a local directory. Read more.

E​

Egress network​

A node-local network that forces a service's outbound traffic out one named host interface. Read more.

Emergency mode​

A disaster-recovery state started with clouduler emergency <stack> when the managers' data is gone. One manager becomes the only voter and only the named stack runs. Read more.

F​

Fencing​

A node with no quorum for fence_timeout stops its own containers so the cluster can safely start them elsewhere. Read more.

Focus (MCP)​

The one stack an AI assistant is working on. Writes, exec and file reads only apply to it. Read more.

Folder import​

Bringing an existing host folder into a volume by moving, linking or copying. Read more.

Freeze (volume)​

Pausing a volume's replication so it can be edited on one node. Read more.

G​

Generation​

A counter on a volume that rises when its authoritative copy changes. A replica one generation behind is stale. Read more.

Git backup​

An export of cluster.yaml, stacks, configs and age-encrypted secrets to a git repository. Read more.

Grant (MCP)​

What an AI client may do: read (read-only tools) or admin (all tools). Read more.

H​

Holder​

A node that has a usable copy of a volume. Only holders can run instances that mount it. Read more.

I​

Instance​

One running copy of a service, with an id like notes.web.0. Read more.

Internal network​

The single network that carries raft, drive sync and the container overlay between nodes. Read more.

L​

Leader​

The manager that currently coordinates the cluster. Runs the scheduler, the alert engine and certificate issuance. Elected by raft. Read more.

Log watcher​

The part of the daemon that raises an alert when a line matching your rule appears in a container's output. Read more.

M​

Manager​

A node that votes in raft and holds the cluster database. Also runs containers. Read more.

MCP​

Model Context Protocol: a standard for AI assistants to call tools. Clouduler runs an MCP server at /mcp. Read more.

Migration (move)​

Moving an instance, and its volume primaries, to another node. Read more.

N​

NAT network​

A network kind with no per-node address, for outbound access that needs no per-node address. Read more.

Network kinds​

internal (exactly one, node-to-node), private (extra trusted subnet), public (no subnet, reachable from outside), egress, wireguard. Read more.

Node​

One machine in the cluster running the clouduler daemon. Read more.

O​

OIDC​

OpenID Connect: sign in to the dashboard with an external identity provider such as Authentik or Keycloak. Read more.

Overlay network​

The VXLAN network that lets containers on different nodes reach each other by name. Read more.

P​

Pin (image)​

A digest an instance is locked to. Recreated containers use it. Read more.

Pin (node)​

A stack setting that forces a service to run on a named node. Read more.

Placement​

Choosing which node runs each instance, based on checks and load. Read more.

Primary / replica​

For a replicated volume, the primary is the node whose copy is authoritative and is pushed to the replicas on a timer. Read more.

Probation​

After a self-update restart, the period in which the new binary must rejoin the cluster or the node rolls back. Read more.

Proxy​

The built-in reverse proxy on every node (ports 80 and 443) that sends host names to containers and terminates HTTPS. Read more.

Q​

Quorum​

A majority of the managers. Without it the cluster pauses changes. Read more.

R​

Raft​

The algorithm that keeps the cluster database identical on every manager. Read more.

Rebalance​

Moving already-placed instances to even out load. Read more.

Reconciler​

The loop on each node that makes Docker match what should run there. Read more.

Redaction​

Replacing secret values with [REDACTED secret:NAME] in MCP output. Read more.

Registry login​

Credentials for a private image registry, stored as a sealed secret. Read more.

Rescheduling​

The leader assigning an unreachable node's instances to other nodes. Read more.

Revision​

A stack's version number; it rises on each deploy. Read more.

Route​

A rule that sends a host name (and optional path) to a service port on a network. Read more.

S​

Scheduler​

The leader's logic that places instances. Read more.

Secret​

A value stored sealed with the cluster key and delivered to containers. Never shown after saving. Read more.

Self-update​

Replacing the Clouduler binary on every node from a GitHub release, one node at a time. Read more.

Served drive​

A drive with one active copy on one node, shared with other nodes over NFSv4. Read more.

Service​

One component of a stack, such as web or db. Has an image and one or more instances. Read more.

Stack​

A Compose-style file describing services, networks, volumes and routes. The unit you deploy. Read more.

Sync​

Copying a volume's primary to its replicas. Every 15 minutes by default. Read more.

U​

Unreachable​

A node the leader could not ping for node_timeout. Its instances are rescheduled. Read more.

V​

Volume​

A folder inside a drive, mounted into a container. Written drive/volume. Read more.

VXLAN​

A standard way to tunnel Ethernet frames inside normal packets; the technology behind the overlay network. Read more.

W​

WireGuard network​

A network kind where Clouduler brings up a WireGuard tunnel from a config you import, and can forward ports in through it. Read more.

Worker​

A node that runs containers and receives all changes but never votes in raft. Read more.