What is a Process?

A process is a running program. Every command you type, every service in the background, every browser tab — each is a process. The kernel tracks them all in the process table, and every process gets a unique number: the PID.

PIDs and the Process Table

What is a PID? Process ID — a unique number the kernel assigns to every process. PID 1 is always systemd (or init). PIDs count up and wrap around when they hit the max (typically 32768 or 4194304 on modern kernels).

ps aux | head -5
# USER    PID  %CPU %MEM   VSZ   RSS TTY  STAT COMMAND
# root      1   0.0  0.1 168260 12340 ?   Ss   /sbin/init
# root      2   0.0  0.0      0     0 ?   S    [kthreadd]

# Show PID and Parent PID
ps -o pid,ppid,comm
# PID  PPID COMMAND
#   1     0 systemd
# 899     1 sshd      (parent is systemd)

fork() and exec() — How Processes Are Created

How does a new process come into existence? Through two system calls working together. fork() creates a clone of the calling process. exec() replaces that clone's memory with a new program. Together they're called the fork-exec pattern.

When you type "ls" in bash:

1. bash calls fork()
   - Creates exact copy of bash process
   - Returns child's PID to bash (parent)
   - Returns 0 to the child

2. Child process calls exec("/bin/ls")
   - Kernel replaces child's memory with ls binary
   - ls starts running from its main()

3. bash calls wait() — waits for child to finish
4. ls finishes, bash shows next prompt

What is copy-on-write in fork? fork() doesn't immediately copy all parent memory — that would be slow. Instead, parent and child share the same physical pages, marked read-only. Only when either process writes to a page does the kernel make a private copy. This makes fork() very fast.

The Process Tree

All processes form a tree — every process has one parent. You can visualize this:

pstree -p
# systemd(1)
# ├─sshd(899)
# │  └─sshd(1234)
# │     └─bash(1235)
# │        └─pstree(5678)
# ├─nginx(1100)
# │  ├─nginx(1101)
# │  └─nginx(1102)
# └─cron(950)

Viewing Processes

# All processes, detailed
ps aux

# Tree format
ps axjf

# Specific process
ps -p 1234 -o pid,ppid,user,comm,args

# Interactive view
top
htop   # if installed (better UI)