Glossary

A separate, recoverable copy of your data kept to protect against loss, corruption or disaster.

Follow the 3-2-1 rule: three copies of your data, on two different media, with one copy offsite. Tools like Restic, BorgBackup and Duplicati automate encrypted, deduplicated backups. Always test your restores — an untested backup is not a backup.

The slow, silent corruption of stored data over time due to hardware imperfections.

Traditional filesystems can't detect bit rot, so a photo may quietly become unreadable. Checksumming filesystems like ZFS and Btrfs detect and repair it when redundancy is present.

A deduplicating backup tool focused on efficient, encrypted incremental archives.

Borg excels at space-efficient backups to another machine or drive. BorgBase offers managed remote repositories.

A modern Linux filesystem with snapshots, checksums and built-in RAID-like features.

Btrfs is an alternative to ZFS that's built into the Linux kernel. It's popular on Synology and openSUSE and great for cheap, instant snapshots.

An ISP setup where many customers share one public IP, making inbound connections impossible without workarounds.

If you're behind CGNAT, port forwarding won't work. Overlay VPNs like Tailscale or a cloud tunnel let you reach your server anyway, without a public IP.

When your ISP puts you behind shared public IP addresses, blocking direct inbound connections.

CGNAT makes traditional port forwarding impossible. Mesh VPNs like Tailscale or a VPS reverse tunnel are common workarounds.

A small fingerprint of data used to detect corruption or verify integrity.

Filesystems like ZFS checksum every block so they can detect and, with redundancy, automatically repair silent corruption (bit rot).

Encoding data to take up less space, often transparently at the filesystem level.

ZFS and Btrfs offer transparent compression (like lz4/zstd) that can actually improve performance while saving space, because less data is read from and written to disk.

An isolated, self-contained package that bundles an application with everything it needs to run.

Containers share the host operating system kernel, making them far lighter than virtual machines. They start almost instantly and are ideal for running many services on a single home server. Docker and Podman are the most common container runtimes.

A read-only, versioned template that a container is created from.

Images are pulled from registries like Docker Hub and identified by tags (e.g. jellyfin:10.9). Pinning a specific tag makes your deployments predictable.

A repository that stores and distributes container images, such as Docker Hub or GHCR.

When you run docker pull, the image comes from a registry. You can also self-host a private registry for your own images.

The classic Unix scheduler that runs commands automatically at set times.

Cron jobs power scheduled backups, cleanups and maintenance on a home server. Modern systems can also use systemd timers for the same purpose.

Storing only one copy of identical data blocks to save space, especially in backups.

Deduplicating backup tools like Restic and Borg store many daily snapshots while using a fraction of the space, because unchanged data is stored only once.

The device (usually your router) that traffic is sent to when leaving the local network.

Every device needs to know its gateway to reach the internet. On a home network it's typically an address like 192.168.1.1.

A service that automatically assigns IP addresses and network settings to devices as they join the network.

Your router usually runs DHCP. For a server, set a DHCP reservation (or a static IP) so its address never changes — every reverse proxy rule and bookmark depends on it.

The system that translates human-readable names like example.com into the IP addresses computers use.

On a home network you often run your own DNS (via Pi-hole or AdGuard Home) to block ads and to give your services friendly local names. DNS is also key to reverse proxies and obtaining TLS certificates.

A platform for packaging applications and their dependencies into lightweight, portable containers.

Docker is the most popular way to run self-hosted apps. Each container is isolated, reproducible and easy to update or remove. With Docker Compose you define your whole stack in a single YAML file. Containers share the host kernel, so they start in seconds and use far less overhead than virtual machines.

A tool that defines and runs multi-container applications from a single declarative YAML file.

Instead of long docker run commands, you describe services, volumes and networks in a compose.yaml file and bring the whole stack up with one command. It is the de facto standard for self-hosting and makes your setup reproducible and easy to back up.

Persistent storage managed by Docker that keeps container data safe across restarts and updates.

Containers are disposable, so anything you want to keep — databases, configs, media — must live in a volume or bind mount. Volumes are a key part of your backups.

A text recipe that describes how to build a custom container image step by step.

Most self-hosters use prebuilt images, but a Dockerfile lets you build your own — installing dependencies and copying in your app — for full control.

A service that keeps a domain name pointed at your home's changing public IP address.

Most home internet connections have a public IP that changes periodically. DDNS clients update a DNS record automatically so you can always reach your server by name.

Memory that detects and corrects common data errors on the fly for greater reliability.

ECC RAM is recommended for ZFS and important data because it prevents memory errors from silently corrupting what's written to disk. It's not mandatory, but it's a nice safety net.

Memory that detects and corrects single-bit errors, improving data integrity on always-on servers.

ECC is common on workstation and server platforms like Intel Xeon and AMD Epyc. Consumer CPUs often lack ECC support.

The default, rock-solid Linux filesystem used by most distributions.

ext4 is fast, mature and reliable, but lacks the checksums and snapshots of ZFS or Btrfs. It's a fine choice for a boot drive or simple storage.

Software or hardware that controls which network traffic is allowed in or out based on rules.

On a Linux server, ufw or nftables lets you allow only the ports you need (e.g. SSH) and deny everything else. A firewall is a core layer of a secure home server.

A card that adds many drive ports, commonly flashed to pass disks straight through to ZFS.

For a ZFS NAS you want an HBA in 'IT mode' rather than a hardware RAID card, so ZFS has direct access to each disk and its SMART data.

A spinning magnetic drive offering large capacity at a low price per terabyte.

HDDs are the workhorses for bulk media and backups in a NAS. Use CMR drives rated for 24/7 NAS use and avoid slower SMR drives for arrays.

A server that runs without a monitor, keyboard or graphical desktop.

Home servers are usually headless: you manage them remotely over SSH or a web interface, which saves power and resources by skipping the desktop.

The package manager for Kubernetes that bundles manifests into reusable charts.

Helm charts simplify installing complex stacks like Prometheus or Nextcloud on Kubernetes with configurable values files.

A computer you run at home to provide services such as file storage, media streaming, backups or self-hosted apps to your devices.

A home server can be anything from a Raspberry Pi to a repurposed desktop or a purpose-built machine. Unlike cloud services, it keeps your data under your control, has no monthly fees beyond electricity, and can be tailored exactly to your needs. Typical uses include a NAS for files, a Plex or Jellyfin media server, Pi-hole for network-wide ad blocking, and Docker for running dozens of self-hosted applications.

A personal lab environment at home used to learn, experiment with and run IT infrastructure.

A homelab can range from a single Raspberry Pi to racks of enterprise gear. Enthusiasts use them to practice skills, host services, and tinker with virtualization, networking and automation. The community is welcoming and shares builds on forums and subreddits.

Software that creates and manages virtual machines by allocating physical resources between them.

Type 1 (bare-metal) hypervisors like Proxmox VE and VMware ESXi run directly on hardware for maximum performance. Type 2 hypervisors like VirtualBox run on top of an existing OS. Proxmox is the most popular choice for homelabs because it combines VMs, containers and ZFS in one free platform.

An operating system image that is replaced atomically on update rather than patched in place.

Projects like Talos Linux and some NAS appliances use immutability for predictable, rollback-friendly upgrades.

A numeric label that identifies a device on a network, such as 192.168.1.10 (IPv4).

Devices get a private IP on your LAN and share one public IP to the internet. Servers should use a fixed private IP so they're always reachable at the same address.

A protocol that presents remote storage over the network as if it were a local block device.

iSCSI is used to give virtualization hosts fast block storage from a NAS. Unlike SMB/NFS file shares, the client formats and manages the volume itself.

A group of drives exposed individually, without hardware RAID combining them.

JBOD is ideal for ZFS or Btrfs, which prefer to manage each disk directly. An HBA or disk shelf presents drives as JBOD to the OS.

A powerful platform for orchestrating containers across many machines, with self-healing and scaling.

Kubernetes is usually overkill for a home server, but lightweight distributions like k3s let advanced homelabbers learn it. For most people, Docker Compose is simpler and enough.

An orchestration platform that automates deploying, scaling and managing containerized applications across a cluster.

Most homelabs start with Docker Compose. Kubernetes shines when you run many services across multiple nodes and need self-healing and rolling updates.

The Linux virtualization technology that runs full virtual machines with near-native performance.

KVM powers the virtual machines in Proxmox and many cloud providers. It's ideal when you need a different OS or strong isolation, at a higher resource cost than containers.

A free, automated certificate authority that issues the TLS certificates used to enable HTTPS.

Reverse proxies like Caddy, Traefik and Nginx Proxy Manager obtain and renew Let's Encrypt certificates automatically, so your services get valid HTTPS with no manual work.

A component that spreads incoming requests across multiple servers or services.

Most home setups don't need one, but a reverse proxy can act as a simple load balancer if you ever run multiple instances of a service for reliability.

Lightweight system containers that behave like a small VM but share the host kernel.

Proxmox makes heavy use of LXC for services that don't need a full VM. They start fast and use fewer resources than KVM virtual machines.

A compact slot on a motherboard used mainly for NVMe or SATA SSDs.

M.2 is a form factor, not a protocol — an M.2 slot may carry NVMe (fast) or SATA (slower) SSDs, so check what your board and drive support.

A unique hardware identifier assigned to a device's network interface.

You use the MAC address to create DHCP reservations (a static IP) and to target a device with Wake-on-LAN.

A dedicated storage device connected to your network that lets multiple devices store and access files centrally.

A NAS (Network-Attached Storage) provides shared storage over protocols like SMB and NFS. You can build one yourself with TrueNAS or OpenMediaVault, or buy a turnkey unit from Synology or QNAP. Most NAS setups use RAID or ZFS to protect against drive failure. Remember: a NAS provides availability, not backups — you still need offsite copies.

The router technique that lets many private devices share one public IP address.

NAT is why inbound connections need port forwarding or a VPN to reach a device on your LAN. Understanding it is key to safe remote access.

A Unix-native network file-sharing protocol offering high performance between Linux systems.

NFS is efficient and low-overhead, making it ideal for Linux-to-Linux sharing, virtualization datastores and container volumes. It has less friendly authentication than SMB, so it's usually kept to trusted networks.

A fast storage interface for SSDs that connects over PCIe, far quicker than SATA.

NVMe drives use the M.2 slot and are ideal for the OS, containers and databases. Bulk media can stay on cheaper SATA hard drives.

A fast storage interface designed for SSDs, offering much lower latency than SATA.

Use NVMe for OS, Docker layers and databases. Bulk media libraries still often live on larger, cheaper SATA or hard drives.

The high-speed expansion bus that connects GPUs, NVMe drives and network cards to the CPU.

PCIe lanes are a limited resource on small boards. Adding a 10G NIC, an HBA or extra NVMe drives all compete for the available lanes.

Delivering electrical power to devices over the same Ethernet cable that carries data.

PoE simplifies wiring for access points, cameras and small devices — one cable does both power and network. It requires a PoE switch or injector.

Delivering electrical power to devices like access points and cameras through Ethernet cables.

A PoE switch reduces cable clutter in a rack. Check wattage budgets when powering multiple devices.

A router rule that directs incoming internet traffic on a specific port to a device on your local network.

Port forwarding lets you reach a home service from the internet, but it also exposes that service to attackers. Prefer a VPN like WireGuard or Tailscale, or a reverse proxy with authentication and TLS. If you must forward ports, forward as few as possible and keep the service patched.

A web dashboard for managing Docker containers, images, volumes and networks.

Portainer gives a friendly GUI over Docker, which is handy while you're learning. Many users graduate to managing everything with Compose files in version control.

A method of combining multiple drives so they act as one, improving performance and/or protecting against drive failure.

Common levels include RAID 0 (striping, no redundancy), RAID 1 (mirroring), RAID 5 (single-parity), RAID 6 (double-parity) and RAID 10 (mirrored stripes). RAID protects against hardware failure and improves uptime, but it is not a backup: it won't help against accidental deletion, ransomware or fire. Use our RAID calculator to see usable capacity and fault tolerance.

A modern backup program that creates encrypted, deduplicated, versioned backups.

Restic can back up to local disks, another server, or cloud storage, and its snapshots let you restore any previous version. It's a favourite for the offsite copy in a 3-2-1 strategy.

An open-source backup program that deduplicates, encrypts and verifies snapshots to local or cloud storage.

Restic is popular in homelabs because it is simple, fast and supports S3-compatible backends for offsite copies.

A server that sits in front of your services, routing requests by domain name and handling TLS certificates.

A reverse proxy like Nginx Proxy Manager, Traefik or Caddy gives each app a clean https:// URL on your own domain, automatically obtains Let's Encrypt certificates, and centralizes access control. It's an essential part of a tidy, secure self-hosted setup.

A fast tool that copies and synchronizes files, transferring only what changed.

rsync is a staple of home-server backups and migrations. Combined with cron or a timer it can mirror data to another disk or machine efficiently.

The Linux implementation of the SMB protocol, used to share files with Windows, macOS and Linux.

Samba turns a Linux box into a file server every device can access. It's the engine behind SMB shares on TrueNAS, OpenMediaVault and DIY NAS builds.

The common interface for connecting hard drives and 2.5-inch SSDs to a motherboard.

SATA is slower than NVMe but plentiful and cheap, making it ideal for bulk hard drives in a NAS. Most boards have several SATA ports.

Running software on hardware you control instead of relying on third-party cloud services.

Self-hosting gives you privacy, control and independence from subscription services. Popular self-hosted replacements include Nextcloud (Google Drive), Immich (Google Photos), Vaultwarden (Bitwarden), Jellyfin (Netflix) and Home Assistant (smart-home clouds).

A network file-sharing protocol used by Windows, macOS and Linux to access shared folders.

SMB (also called CIFS or Samba on Linux) is the most widely compatible way to share files on a home network. Every major OS can mount SMB shares natively, making it the default choice for a general-purpose NAS.

A point-in-time, read-only copy of a filesystem or volume that lets you roll back changes instantly.

Snapshots on ZFS or Btrfs are near-instant and space-efficient because they only track changes. They're perfect for recovering from mistakes or ransomware, but because they live on the same pool they are not a substitute for offsite backups.

Flash-based storage with no moving parts, far faster and quieter than a hard drive.

Use an SSD for your OS, containers and databases to make everything feel snappy, and keep large media on cheaper hard drives.

An encrypted protocol for securely logging into and managing servers over a network.

SSH is how you remotely control a headless server via the command line. Always disable password login and use SSH keys, change the default port, and consider tools like fail2ban. SSH also powers secure file transfer (SCP/SFTP) and port tunneling.

A fixed IP address that never changes, either set on the device or reserved on the router.

A server should always have a static IP (a DHCP reservation is the easiest way) so port forwards, reverse-proxy rules and bookmarks keep working after a reboot.

A logical subdivision of an IP network, defined by a mask that separates the network and host portions of an address.

Home networks typically use a /24 subnet like 192.168.1.0/24, giving 254 usable addresses. Our subnet calculator works out the network, broadcast and host range for any prefix.

Disk space used as overflow when a system runs low on RAM.

A little swap prevents crashes under memory pressure, but relying on it is slow. If a server swaps constantly, it needs more RAM.

The init system on most Linux distributions that starts, stops and supervises services.

systemd ensures your services start on boot and restart on failure. systemd timers are a modern alternative to cron for scheduled tasks.

A rough measure of how much heat (and roughly power) a CPU produces under load.

For an always-on server, a low-TDP CPU (like Intel's N-series at ~6–15 W) keeps your electricity bill and cooling needs down.

The encryption that secures connections, shown as the padlock and https:// in your browser.

Self-hosted services should be served over HTTPS using TLS certificates, usually obtained automatically and for free from Let's Encrypt via a reverse proxy.

A battery backup that keeps your server running briefly during a power cut and enables a safe shutdown.

A UPS protects against data corruption and hardware damage from sudden power loss and surges. With software like NUT (Network UPS Tools), your server can automatically shut down cleanly when the battery runs low. Essential for any NAS holding important data.

A software-based computer that runs its own operating system on top of physical hardware via a hypervisor.

A virtual machine emulates a complete computer, including its own kernel, so you can run different operating systems side by side on one host. VMs offer strong isolation and are ideal for testing, running Windows, or separating untrusted workloads. They use more resources than containers.

A way to split one physical network into isolated logical networks for security and organization.

Enthusiasts use VLANs to keep untrusted IoT devices or guests away from their server and personal devices. They require a managed switch and a router that supports VLAN tagging.

A logical network segment that isolates traffic on shared physical switches.

Separate IoT devices, guest Wi-Fi and your server LAN with VLANs to limit blast radius if something is compromised.

An encrypted tunnel that lets you securely access your home network from anywhere as if you were local.

A VPN is the safest way to access home services remotely without exposing them to the public internet. WireGuard is fast and modern; Tailscale and NetBird build on it to make setup effortless, even behind CGNAT. This avoids risky port forwarding entirely.

A feature that powers on a computer remotely by sending it a special network packet.

Wake-on-LAN lets you keep a power-hungry server asleep and wake it only when needed, cutting energy use without giving up remote access.

A tool that automatically updates running Docker containers to their latest images.

Automatic updates are convenient but can break things unexpectedly. Many people prefer to pin versions and update deliberately, keeping backups first.

An advanced filesystem and volume manager offering data integrity, snapshots, compression and software RAID.

ZFS checksums every block to detect and repair silent data corruption (bit rot). It supports instant snapshots, transparent compression, and pooled storage. It powers TrueNAS and is popular on Proxmox. ZFS benefits from ECC RAM and plenty of memory for its cache (ARC).