The Spring Ecosystem Map
Spring Boot is a container, a request pipeline and a set of auto-wired defaults. Once you can see how those three fit together, every annotation stops being magic. This page is the map; the 14 pages after it are the territory.
What Spring Actually Is
Spring Framework is, at its heart, one idea: an object-wiring container. You describe your objects (beans) and what each one needs; the container builds them, connects them, and manages their lifecycle. Everything else in Spring — MVC, Data, Security, Transactions, Caching — is built by adding behaviour to beans, mostly by wrapping them in proxies.
Spring Boot removes the assembly work. It reads your classpath, decides which framework features you probably want, registers the beans to make them work, and packages it all with an embedded web server. "Opinionated" means a sensible default for every choice, and a clean way to override each one.
Container
The ApplicationContext creates and wires beans. Dependency injection means your classes never call new on their collaborators.
Auto-configuration
Boot checks the classpath and existing beans with @Conditional rules, and registers defaults only where you haven't.
Embedded runtime
Tomcat (or Jetty/Undertow) lives inside your JAR. java -jar app.jar is the whole deployment.
Three Layers, One Container
Think of a running Boot application as three stacked layers. Your code sits on top and rarely touches the lower two directly, but every bug eventually traces to one of them.
| Concept | One-line definition | Deep dive |
|---|---|---|
| Bean | Any object whose creation and lifecycle the container manages | 01 · IoC & DI |
| ApplicationContext | The container: bean definitions, wiring, events, environment | 01 · IoC & DI |
| Scope / lifecycle | How many instances exist, and what happens at birth and death | 02 · Beans |
| Proxy | A stand-in object that adds behaviour (transactions, caching, security) around yours | 03 · AOP |
| Auto-configuration | Conditional bean registration based on classpath, properties and existing beans | 04 · Boot internals |
| Environment / profile | Property sources plus named configuration sets | 11 · Configuration |
The Journey of One HTTP Request
One request crosses most of the framework. If you can narrate this path, you can place any bug: a 401 is in the security filters, a 400 is in binding or validation, a 500 with a lazy-loading exception is in the persistence context, and so on. Each numbered step below is a page of this guide.
What Happens Before the First Request
Before any request, SpringApplication.run() builds the container. Knowing the order explains most startup failures such as NoSuchBeanDefinitionException, circular dependencies, and "my property wasn't picked up".
The Wider Ecosystem
IoC container, dependency injection, events, environment abstraction.
REST controllers, request mapping, message converters, exception handling.
Repository abstraction on top of Hibernate; derived queries; paging.
Servlet filter chain, authentication, method security, OAuth2 resource server.
Config server, gateway, service discovery, load balancing.
Chunked, restartable bulk jobs with reader/processor/writer steps.
Listener containers, templates, retry and dead-letter handling.
Reactive, non-blocking stack on Reactor/Netty. Different model, not "faster MVC".
Enterprise integration patterns: channels, routers, transformers.
LLM client abstractions; module boundaries enforced inside a monolith.
Proxies Everywhere
Many "magic" annotations are not special language features. They're a proxy around your bean that runs extra code before and after your method. This is the single most useful idea for debugging Spring.
this bypasses the proxy, so @Transactional, @Cacheable or @Async on the callee silently does nothing. You'll meet this in 03 · AOP and 08 · Transactions, and it is the most-asked Spring interview question.
Starter Cheatsheet
A starter carries no code of its own. It's a curated dependency set, whose versions are aligned by Boot's BOM. Adding one both pulls in the libraries and flips on the matching auto-configuration.
| Starter | Brings in | Page |
|---|---|---|
spring-boot-starter-web | Spring MVC, Jackson, embedded Tomcat | 05 |
spring-boot-starter-validation | Jakarta Bean Validation + Hibernate Validator | 06 |
spring-boot-starter-data-jpa | Hibernate, Spring Data JPA, HikariCP, transaction support | 07 |
spring-boot-starter-security | Spring Security filter chain and defaults | 09 |
spring-boot-starter-oauth2-resource-server | JWT/opaque token validation | 10 |
spring-boot-starter-actuator | Health, metrics, info endpoints; Micrometer | 12 |
spring-boot-starter-cache | @Cacheable abstraction (pair with Caffeine or Redis) | 13 |
spring-boot-starter-test | JUnit 5, Mockito, AssertJ, MockMvc, JSONPath | 14 |
How to Work Through This Guide
The four parts build on each other: the container first, then the web and data layers that run on it, then security, then everything that makes a service production-grade. If you're short on time, read 01 → 03 → 04 first; they unlock all the rest.
Bean definitions, constructor vs setter vs field injection, qualifiers, circular dependencies, and a mini container you build yourself.
Singleton vs prototype, scoped proxies, the complete lifecycle order, BeanPostProcessors.
JDK vs CGLIB proxies, pointcuts, advice ordering, the self-invocation trap, a hand-written proxy.
@Conditional rules, the startup sequence, writing your own starter, reading the conditions report.
DispatcherServlet internals, argument resolution, message converters, content negotiation, versioning.
Bean Validation, groups, custom constraints, @ControllerAdvice, RFC 9457 ProblemDetail.
Persistence context, mappings, query styles, projections, locking, and killing N+1.
Proxy mechanics, all seven propagation modes, isolation anomalies, rollback rules, the outbox pattern.
The filter chain, authentication flow, authorisation, CSRF, CORS, password hashing.
Token validation pitfalls, resource server, grant types with PKCE, scopes to authorities.
Property precedence, @ConfigurationProperties, profiles, secrets, 12-factor.
Health probes for Kubernetes, Micrometer metrics, tracing, structured logs.
Cache abstraction, stampedes, Resilience4j retry, circuit breaker, bulkhead.
Test slices, MockMvc, Testcontainers, context caching, security tests.