Linux Processes

Process lifecycle, states, PID namespaces, fork/exec, zombie processes, and process trees.

Overview

Overview Every running program in Linux is a process — an instance of an executable with its own address space, file descriptors, and credentials. Processes are organised in a tree rooted at PID 1 (init or systemd). Each process has a parent (PPID); when a parent exits before its children, those children are re-parented to PID 1.

Process States

R (Running) — on a CPU or ready to run
S (Sleeping) — waiting for an event, interruptible
D (Disk sleep) — waiting for I/O, uninterruptible
T (Stopped) — frozen by SIGSTOP or a debugger
Z (Zombie) — exited but parent hasn't called wait() yet

Creating Processes

fork() duplicates the current process (copy-on-write pages). exec() replaces the process image with a new program. The shell uses fork then exec for every command. Threads are implemented as lightweight processes via clone().

Zombie Processes

Zombie processes accumulate when a parent ignores SIGCHLD or doesn't call wait(). The zombie holds its PID and exit status but no memory. A large number of zombies indicates a parent bug, not a resource leak, but it exhausts the PID namespace.

Key concepts

Process states: R (running), S (sleeping), D (uninterruptible disk sleep), T (stopped), Z (zombie). The D state is the main cause of high load with low CPU.
fork/exec: fork() duplicates the process (copy-on-write); exec() replaces the image. Shell runs every command via fork + exec.
Zombie: Exited but parent has not called wait(). Holds a PID slot but no memory. Fixed by repairing the parent or sending SIGCHLD.
PID namespace: Gives a container its own PID 1 and isolated PID space. The container sees PIDs 1-N; the host sees a different PID for the same process.
PPID / reparenting: Every process tracks its parent PID. If the parent dies, orphaned children are reparented to PID 1 (systemd).

When to use it

Diagnosing high load average when CPU% is low — D-state processes blocked on I/O
Explaining container isolation at the process level — PID namespaces give each container its own PID 1
Debugging zombie accumulation in a service that spawns child processes
Understanding why kill -9 on a zombie has no effect

Interview questions

Your server load average is 50 but CPU usage is only 5%. What is happening and how do you diagnose it?
What is the difference between a zombie process and an orphan process?