Linux

What Are Processes

Every program running on your system is a process. Your terminal? A process. The web browser? A process. Even ls becomes a process when you run it.

Programs vs Processes

  • Program: A file on disk (executable code)
  • Process: A running instance of a program
Terminal
$# This file is a program
$ls -l /bin/ls
-rwxr-xr-x 1 root root 138856 /bin/ls
$
$# When you run it, it becomes a process
$ls
(output appears, process ends)

You can run the same program multiple times - each creates a separate process.

Process IDs (PIDs)

Every process has a unique number: its PID.

Terminal
$echo $$
1234

$$ is your current shell's PID. Each terminal session has a different PID.

Parent and Child Processes

When a process creates another process:

  • Creator = parent
  • New process = child
Terminal
$echo "Shell PID: $$"
Shell PID: 1234
$bash -c 'echo "Child PID: $$"'
Child PID: 5678

The child remembers its parent's PID (PPID):

Terminal
$echo "My PPID: $PPID"
My PPID: 1234

Process Tree

All processes form a tree. At the top is PID 1 (init/systemd), the ancestor of everything.

Process States

A process can be in different states:

StateSymbolMeaning
RunningRActively using CPU
SleepingSWaiting for something (interruptible)
Disk SleepDWaiting for I/O (uninterruptible)
StoppedTPaused (e.g., Ctrl+Z)
ZombieZFinished but not cleaned up
                    ┌─────────────┐
                    │   Created   │
                    └──────┬──────┘
                           │
                           ▼
                    ┌─────────────┐
         ┌────────→│   Running   │←────────┐
         │         │     (R)     │         │
         │         └──────┬──────┘         │
         │                │                │
    Scheduled        I/O wait         Continues
         │                │                │
         │                ▼                │
         │         ┌─────────────┐         │
         └─────────│  Sleeping   │─────────┘
                   │   (S/D)     │
                   └──────┬──────┘
                          │
                    Ctrl+Z│         Exit
                          ▼          │
                   ┌─────────────┐   │
                   │   Stopped   │   │
                   │     (T)     │   │
                   └─────────────┘   ▼
                                ┌─────────────┐
                                │   Zombie    │
                                │     (Z)     │
                                └─────────────┘

Most processes are sleeping - waiting for input, network, etc.

The init Process

PID 1 is special. It's the first process started by the kernel.

Terminal
$ps -p 1
PID TTY TIME CMD 1 ? 00:00:02 systemd

On modern Linux, this is usually systemd. It manages all other services.

Lifecycle of a Process

  1. Created - fork() or similar system call
  2. Running/Sleeping - doing its job
  3. Terminated - finished or killed
  4. Zombie (brief) - waiting for parent to acknowledge
  5. Removed - fully cleaned up
Knowledge Check

What's the relationship between a program and a process?

Key Takeaways

  • A process is a running instance of a program
  • Every process has a unique PID
  • Processes form a tree with PID 1 at the root
  • Processes can be running, sleeping, stopped, or zombie
  • Your shell is a process that creates child processes for commands

Next: viewing processes with ps.