Linux Process Management: Fork, Exec, and Beyond

The Heart of Linux: Process Management

Every program you run on Linux becomes a process - a living entity with its own memory space, resources, and lifecycle. From the moment you boot your system with PID 1 (init/systemd) to the thousands of processes running right now, understanding process management is key to mastering Linux.

Interactive Process Lifecycle

Watch every step of process creation, execution, and termination - from fork to zombie reaping:

The Process Tree

Every process on a Linux system is part of a hierarchical tree structure. PID 1 (systemd/init) sits at the root as the ancestor of all processes. Click any process to explore its relationships:

Process Fundamentals

What is a Process?

A process is more than just a running program. It's a container managed by the kernel that includes:

• Identity: PID (Process ID), PPID (Parent PID), UID/GID (owner)
• State: RUNNING, READY, WAITING, STOPPED, ZOMBIE
• Memory: Code, data, heap, stack (separate virtual address space)
• Resources: Open files, network connections, signals
• Scheduling: Priority, nice value, CPU time consumed

The kernel represents each process with a task_struct - a data structure containing all this metadata (about 10KB per process).

Process vs Thread

When Firefox runs with 47 threads, they all share memory and file descriptors but have separate stacks and registers.

The Fork-Exec Model

fork(): Cloning Processes

fork() creates a new process by duplicating the calling process:

1. Kernel creates child: New PID, copy of task_struct
2. Copy-on-Write (COW): Memory pages shared, not copied immediately
3. Returns twice: Returns 0 to child, child PID to parent
4. Identical but separate: Same code position, but two different processes

exec(): Transformation

exec() replaces the current process image with a new program:

1. Same PID: Process identity preserved
2. New program: Code, data, stack replaced from executable file
3. File descriptors preserved: Open files remain open (unless close-on-exec)
4. Common pattern: fork() followed by exec() in child

Copy-on-Write Deep Dive

Process States

Every process is always in one of these states. Click to explore:

State Transitions Summary

Zombies & Orphans

Zombie Processes

When a process terminates, it becomes a zombie - dead but not fully gone:

• Why exist? Must preserve exit status for parent to retrieve
• What's left? Only task_struct (process descriptor), no memory
• How to see? ps aux | grep defunct or state shows 'Z'
• How to kill? You can't! Already dead. Parent must call wait()
• Problem: If parent never calls wait(), zombie persists forever

Orphan Processes

When a parent dies before its children:

• Kernel re-parents: Orphans automatically adopted by init (PID 1)
• init reaps: init periodically calls wait() to clean up orphans
• No zombie accumulation: init ensures orphans don't become permanent zombies

This is why PID 1 (init/systemd) is special - it's the ultimate parent that never dies and always cleans up.

Sessions and Process Groups

Signal Delivery

Understanding why Ctrl+C kills an entire pipeline but leaves background jobs alone:

The Hierarchy

• Session: A collection of process groups, typically one per terminal/login
• Process Group: One or more processes treated as a unit for job control
• Foreground Group: The group receiving terminal signals (Ctrl+C, Ctrl+Z)

When you run cat file | grep pattern | wc -l, all three commands share the same PGID - that's why they all die together on Ctrl+C!

CPU Scheduling

Linux uses the Completely Fair Scheduler (CFS) for normal processes:

• Red-black tree: Processes sorted by virtual runtime
• Fairness: Each process gets fair share proportional to priority
• Time slices: Dynamic, based on number of runnable processes
• Real-time classes: SCHED_FIFO and SCHED_RR for critical tasks

Context Switch

When the scheduler switches from one process to another:

1. Save current process state (registers, PC) to memory
2. Load new process state from memory
3. Switch page tables (change memory view)
4. Jump to new process's program counter

Context switches are expensive (~microseconds) so minimize thrashing!

Nice Values

Process priority controlled by "nice" value (-20 to +19):

# Start with lower priority
nice -n 10 ./cpu-intensive-task

# Change priority of running process
renice -n 5 -p 1234

# Require root for negative nice
sudo renice -n -10 -p 1234

# Real-time priority (requires root)
chrt -f 99 ./realtime-app   # SCHED_FIFO priority 99

Process Inspection & Control

# View all processes
ps aux

# Process tree showing relationships
pstree -p

# Watch processes in real-time
htop

# View process memory map
cat /proc/1234/maps

# View process status
cat /proc/1234/status

# Send signals
kill -SIGTERM 1234   # Request termination (15)
kill -SIGKILL 1234   # Force kill (9)
kill -SIGSTOP 1234   # Suspend (19)
kill -SIGCONT 1234   # Resume (18)

# Job control
command &      # Run in background
jobs           # List jobs
fg %1          # Bring to foreground
bg %1          # Send to background

Common Patterns

Fork-Exec Pattern (Shell executing command)

pid = fork();
if (pid == 0) {
    // Child: replace with new program
    exec("/bin/ls", args);
} else {
    // Parent: wait for child
    wait(&status);
}

Daemon Process Pattern

1. fork() and parent exits (detach from terminal)
2. setsid() to create new session
3. Change directory to /
4. Close stdin/stdout/stderr
5. Write PID to /var/run/daemon.pid

Related Concepts

• System Calls: How user programs communicate with kernel
• Memory Management: Virtual memory and address spaces
• Kernel Architecture: How the kernel manages processes
• Init Systems: PID 1 and the process hierarchy
• Linux Namespaces: PID namespaces for container isolation
• Containers Under the Hood: How process isolation creates containers