The Stack Underflow

How It Actually Works: Real Systems as State Machines

Real backend systems as state machines: Spring Boot, Tomcat, NGINX, WebSocket, Spring AI, Spring Security, Microsoft Entra ID, AKS secrets and Redis caching. Each deep dive has a short terminology primer with memory pegs, and every claim is checked against the official docs.

18 tutorials · start at part 1 or jump anywhere

Start the series → All series
  1. 1 Port, Socket, Reverse Proxy, JVM, Pod, SIGTERM: Backend Words Before the Deep Dives Every word between a browser and a Java app in Kubernetes, from port and socket to backlog, JVM, pod, probes and SIGTERM, with one memory peg each. Oct 1, 2026
  2. 2 Spring Boot Words Explained: Bean, ApplicationContext, Auto-Configuration, DispatcherServlet Bean, ApplicationContext, auto-configuration, DispatcherServlet, filters vs interceptors, the @Transactional proxy, Started vs Ready: Spring words with memory pegs. Oct 1, 2026
  3. 3 What Spring Boot Actually Does After java -jar (Startup to Graceful Shutdown) The whole life of a Spring Boot app as one statechart: JarLauncher, run(), refresh(), when Tomcat binds, Started vs Ready, liveness/readiness, SIGTERM and drain. Oct 1, 2026
  4. 4 Tomcat Words Explained: Catalina, Coyote, Connector, Context, Valve, Poller The Apache Tomcat 11 vocabulary in one map: Catalina vs Coyote, Server to Wrapper, Acceptor and Poller, Valves vs filters, and the twelve lifecycle states. Oct 1, 2026
  5. 5 What Apache Tomcat Actually Does With Your Request (Startup, Request, Shutdown) Standalone Tomcat 11 as one state machine: class loaders, server.xml, init and bindOnInit, children-first start, one request from socket to servlet, graceful stop. Oct 1, 2026
  6. 6 NGINX Words Explained: Worker, Server Block, Location, Upstream, proxy_pass, 502 vs 504 The NGINX vocabulary in one map: master and workers, server blocks and locations, upstream and proxy_pass, proxy timeouts, 502 vs 504, and safe reloads. Oct 1, 2026
  7. 7 What NGINX Does Before Your App Sees a Request (and Where 502 vs 504 Come From) Open-source nginx 1.30 as one state machine: master and workers, reload, server block and location, the 11 phases, proxying, retries, and where 502 vs 504 come from. Oct 1, 2026
  8. 8 Spring AI Words Explained: ChatClient, Advisors, Chat Memory, RAG, Tools, MCP About twenty Spring AI 2 words, each with a memory peg: ChatModel vs ChatClient, advisors, chat memory vs RAG, embeddings, tools and MCP, checked against the docs. Oct 1, 2026
  9. 9 What Spring AI Does Between chatClient.prompt() and the Answer (Memory, RAG, Tool Loop) One Spring AI 2.0.1 request as a state machine: startup beans, lazy call(), the advisor stack, memory, the tool loop with RAG inside it, and MCP tools. Oct 1, 2026
  10. 10 401 vs 403, JWT, OAuth, PKCE: Security and Sign-In Words Explained (Spring + Entra ID) About forty security words with memory pegs: authentication vs authorization, 401 vs 403, CSRF, CORS, JWT, OAuth 2.0, OIDC, PKCE and the three tokens. Oct 1, 2026
  11. 11 Why Spring Security Returns 401 or 403: One Request Through the Filter Chain Follow one request through Spring Security 7.1 on Boot 4.1: chain selection, CORS, CSRF, JWT checks, and the exact step that answers 401 or 403. Oct 1, 2026
  12. 12 Sign In with Microsoft Entra ID in Spring Boot: OIDC, OAuth 2.0, PKCE, Client Credentials, SAML What happens when you click Sign in with Microsoft: the auth code flow with PKCE, three tokens, what the API checks, client credentials, and which protocol when. Oct 1, 2026
  13. 13 Base64 Is Not Encryption: Kubernetes Secrets, Key Vault and Redis Cache Words Explained About twenty-five secrets and cache words for a Spring Boot app on AKS: Kubernetes Secret, etcd, workload identity, CSI driver, cache hit, TTL, eviction. Oct 1, 2026
  14. 14 Pod Stuck in ContainerCreating? How Secrets Reach a Pod in AKS (Key Vault CSI Driver) One database password from Azure Key Vault into an AKS pod: workload identity, the Secrets Store CSI driver, FailedMount errors, rotation and restarts. Oct 1, 2026
  15. 15 Why Your Spring Boot Redis Cache Never Expires: Hits, Misses, TTL and Eviction as a State Machine What @Cacheable does with Redis in Spring Boot 4.1: keys, hits and misses, stampedes, evict-after-write, Redis failures, TTL expiry and volatile-lru eviction. Oct 1, 2026
  16. 16 Tomcat vs NGINX: What Each Does and Why Spring Boot May Need Both NGINX and Tomcat do different jobs. One request through both, and the three failures that tell you which layer broke: 413 on upload, a chunked AI stream, and 60 seconds of silence. Oct 4, 2026
  17. 17 WebSocket 1006, 101 and Ping/Pong Explained: The Words Before the Deep Dive The WebSocket vocabulary in one map: ws vs wss, TLS termination, Upgrade and 101, Sec-WebSocket-Accept, frames and masking, ping/pong, heartbeats, close codes, 1006 and STOMP. Oct 7, 2026
  18. 18 Why Your WebSocket Disconnects After 60 Seconds: Spring Boot Behind NGINX One WebSocket through Application Gateway, NGINX, Tomcat and Spring: the missing Upgrade headers, proxy_read_timeout's 60 seconds, the gateway's 20, and why the browser says 1006. Oct 7, 2026