Process Model, PIDs, Parents, and /proc

1. A process is a running execution context

A program is executable code stored on disk. A process is a live execution context created when the kernel loads or continues that code. The process carries an identity, virtual address space, open file descriptors, environment variables, scheduling state, resource limits, credentials, signal dispositions, and relationships to other processes.

DevOps tooling constantly creates processes: shells launch commands, CI runners execute build steps, service managers supervise daemons, containers start workload processes, and orchestration agents monitor child lifecycles. Understanding the process model gives you a common language for performance, reliability, deployment, and incident response.

2. PID, PPID, and process ancestry

Every process has a process identifier, or PID. Most processes also record a parent PID, or PPID, identifying the process that created them. The parent-child model is not merely historical metadata: shells wait for commands, supervisors restart services, pipelines connect siblings, and orphaned processes are adopted by a subreaper or the system's init process.

# Inspect this shell and its parent.
printf 'shell PID=%s parent PID=%s\n' "$$" "$PPID"
ps -o pid,ppid,pgid,sid,stat,comm,args -p "$$" -p "$PPID"

# Show an ancestry-oriented view when pstree is installed.
pstree -aps "$$" 2>/dev/null || true

# Launch a short child and inspect it before it exits.
sleep 30 &
child=$!
ps -o pid,ppid,pgid,sid,stat,comm,args -p "$child"
kill "$child"
wait "$child" 2>/dev/null || true

The shell variable $$ expands to the current shell's PID, while $! expands to the PID of the most recently started background pipeline. Record PIDs immediately; process IDs are eventually reused after a process exits.

3. Creation, replacement, waiting, and exit

flowchart TD
  P["Parent process"] -->|fork or clone| C["Child process"]
  C -->|exec| N["New program in same PID"]
  N --> R["Running or runnable"]
  R --> S["Sleeping while waiting"]
  S --> R
  R -->|exit| Z["Zombie status retained"]
  Z -->|parent waits| X["PID and status released"]
  P -->|does not wait yet| Z

Conceptually, a parent creates a child with a fork- or clone-family operation. The child often calls exec to replace its current program image while retaining the same PID. When it exits, the kernel retains a small status record until the parent collects it with a wait operation. That temporary record is a zombie.

4. Read process states without guessing

The STAT column from ps begins with a state code. Common values include R for running or runnable, S for interruptible sleep, D for uninterruptible sleep, T for stopped or traced, and Z for zombie. Additional characters describe properties such as session leadership or multithreading.

A sleeping process is not necessarily unhealthy. Servers spend much of their time sleeping while waiting for requests. Diagnose state together with duration, CPU, I/O, logs, parent behavior, and the service's expected workload.

5. /proc is a live view, not an ordinary disk directory

The proc filesystem exposes kernel and process information through file-like interfaces. For a process PID, /proc/PID contains status, command-line arguments, environment, open descriptors, memory maps, namespaces, cgroup membership, mount information, and links to the executable and current directory. Entries can disappear between listing and reading because processes exit concurrently.

pid=$$

# Identity and high-level state.
grep -E '^(Name|State|Pid|PPid|Uid|Gid|Threads|VmRSS):' "/proc/$pid/status"

# Arguments are NUL-separated; translate them for display.
tr '\0' ' ' < "/proc/$pid/cmdline"
printf '\n'

# Resolve selected process links.
readlink -f "/proc/$pid/exe"
readlink -f "/proc/$pid/cwd"

# Count and sample open file descriptors.
find "/proc/$pid/fd" -maxdepth 1 -type l -printf '%f -> %l\n' 2>/dev/null | sort -n | head

# Inspect namespace and cgroup attachments.
ls -l "/proc/$pid/ns"
cat "/proc/$pid/cgroup"

6. Hands-on lab: capture a process evidence bundle

Create a controlled background process, collect read-only evidence, then terminate and reap it. The lab uses your own process and requires no elevated privileges.

lab="$HOME/devops-academy/linux/chapter08/lesson01"
mkdir -p "$lab"

# Start a process whose identity and lifetime you control.
bash -c 'trap "exit 0" TERM; while :; do sleep 5; done' &
pid=$!
report="$lab/process-$pid.txt"

{
  printf 'captured_at=%s\n' "$(date --iso-8601=seconds)"
  printf 'observer_pid=%s\n' "$$"
  printf 'target_pid=%s\n\n' "$pid"

  printf '=== ps identity ===\n'
  ps -o user,pid,ppid,pgid,sid,lstart,etime,stat,comm,args -p "$pid"

  printf '\n=== proc status ===\n'
  grep -E '^(Name|State|Pid|PPid|Uid|Gid|Threads|VmRSS|voluntary_ctxt_switches|nonvoluntary_ctxt_switches):' "/proc/$pid/status"

  printf '\n=== process links ===\n'
  printf 'exe=%s\n' "$(readlink -f "/proc/$pid/exe")"
  printf 'cwd=%s\n' "$(readlink -f "/proc/$pid/cwd")"

  printf '\n=== cgroup ===\n'
  cat "/proc/$pid/cgroup"
} > "$report"

less "$report"
kill -TERM "$pid"
wait "$pid"

if [[ -e "/proc/$pid" ]]; then
  printf 'Target still exists; inspect before continuing.\n' >&2
else
  printf 'Target exited and its /proc directory disappeared.\n'
fi

7. Common mistakes

8. Knowledge check

9. Summary

A Linux process is a kernel-managed execution context, not merely a program name. PIDs, parents, groups, sessions, states, and the /proc filesystem expose its lifecycle and operating context. Reliable troubleshooting records identity and start time, observes state without assumption, collects only necessary evidence, and handles process exit with correct parent-child semantics.

10. Further reading

• proc(5), proc_pid_status(5), and ps(1).
• Linux kernel documentation for procfs and process accounting interfaces.
• fork(2), clone(2), execve(2), waitpid(2), and exit(3).