Plugins are modules the core loads to add routes or background work. A manifest (format depends on the release) names the entry point and declared permissions. Keep plugins stateless or persist through explicit APIs so you can scale out behind a load balancer.
Security
Only load code you trust. Plugins run with the same secrets as the parent process unless you implement isolation yourself.