Start here

Start by separating three nouns: program (file on disk), process (running instance with kernel bookkeeping), and thread (schedulable CPU activity, often several per process). This page formalizes the process as the unit of accounting and protection.

Process (first principles)

A process is an instance of a program under execution together with everything the kernel must track so that execution can proceed, be paused, resumed, and cleaned up: a virtual address space, one or more threads, open file descriptors, credentials, signal state, and resource counters.

The kernel stores this in a process control block (PCB): on Linux, the central piece is task_struct. From the OS point of view, a process is not “your main() function”: it is the whole bundle the scheduler and memory manager reason about.

By the end of this page you should be able to

List at least five distinct resources the kernel associates with a process.
Explain why separate page tables give isolation between processes.
Relate zombies to the parent’s responsibility to reap exit status.
Contrast POSIX PID with Linux TID/TGID at a high level.

Why processes exist

Without this abstraction every program would fight over raw memory and devices.

Multiplexing

Many processes share CPUs and RAM as if they were alone; time slicing and virtual memory create that illusion.

Protection

User code cannot map arbitrary physical pages; the kernel validates every mapping and syscall.

Accounting

CPU time, memory high-water marks, and cgroup counters enable fairness and billing.

Lifecycle

Create → run → exit; the kernel must reclaim almost everything, except the tiny zombie slot until a parent acknowledges termination.

Reading order

Read the TL;DR next, then skim Key insights before the mechanism cards, those insights are what you should be able to say aloud in an interview without notes.

Operating systems · Processes

Process concept

The unit of execution and protection

TL;DR

A process is an instance of a program in execution: an address space, one or more threads of control, open file descriptors, credentials, signal state, and accounting, managed by the kernel as a first-class object.

Summary

Processes bundle resources so the OS can allocate, schedule, and reclaim them atomically from the outside. Interviews often probe whether you can separate “address space” from “thread of execution”: modern OSes decouple them while keeping the process as the administrative container.

Deeper narrative

A process is the unit of resource accounting: address space, credentials, file table, signal dispositions, and pending signals. Threads share most of these; lightweight processes blur lines, Linux models threads as tasks sharing `mm_struct`.

Mechanism (step by step)

Treat each step as a sentence in the story you tell on a whiteboard.

Kernel represents execution

`task_struct` tracks state, priority, pointers to mm and files.

Scheduler sees runnable set

Move between `TASK_RUNNING`, `TASK_INTERRUPTIBLE`, etc., driven by syscalls and I/O completion.

Resources attach by reference

File descriptors index `struct file`; mm points to VMAs and page tables.

Termination path

Exit syscalls, OOM, signals; zombies exist until parent reaps via `wait`.

Key insights

Each card is a compression of the lesson, use them as spaced-repetition prompts.

Isolation is the point

Separate page tables mean faults in one process cannot corrupt another’s memory, unless explicitly shared regions exist.

Lifecycle is finite

Create → run → terminate; zombies exist precisely because the kernel preserves exit metadata until another process acknowledges it.

Kernel vs user threads

A “process” may contain many schedulable entities; scheduling and signal delivery rules depend on thread model (POSIX threads, clone flags).

Accounting enables policy

CPU time, max RSS, and cgroup counters let the OS enforce fairness and capacity limits.

Did you know?

Trivia with teeth: the kind of fact that changes how you reason about a design.

On Linux, `task_struct` backs both processes and kernel threads, PID and thread group relationships encode “process vs thread”.

The OS never “runs a .exe file”; it runs an image mapped into memory with an entry point and ELF/auxv metadata.

Context switches are not free: saving/restoring SIMD/AMX state can dominate cost for HPC workloads.

Common pitfalls

Where smart people still trip, read slowly.

PID vs TGID confusion

Threads have unique TIDs but share PID (thread group leader) in userspace view-`gettid` vs `getpid`.

Orphan misconception

Orphaned children reparent to PID1 or subreaper, not “lost,” but must be reaped by someone.

Comparison

Process vs program (exam phrasing)

	Program	Process
Location	Disk artifact (binary, scripts)	Live kernel object + memory image
Count	One file, many copies	Many concurrent instances possible
State	Passive bytes	Registers, heap, stacks, fds, signals

Glossary

PCB / task_struct

Kernel structure holding process metadata and linkage into scheduler lists.

TGID

Thread group ID, POSIX PID for the whole group in Linux.

Zombie

Terminated process not yet reaped, retains slot for exit status.

Interview follow-ups

What lives in the PCB that threads do not duplicate?
How does vfork differ from fork in resource sharing?
Why can `clone` create what looks like a thread or a process?

Callouts

POSIX view

`fork`+`exec` historically defined process creation on Unix; Linux optimizes with `clone` and `posix_spawn` under the hood.

Walkthrough & deep dive

Left: practical “how would I use this?” threads. Right: slower, code-leaning explanations, open one panel at a time so the page does not feel like a wall of sameness.

Walkthrough

Explain to a junior

Without opening a book, define a process as: resources + at least one thread + kernel bookkeeping.

Deep dive

What lives in the PCB / task_struct?

Scheduling fields, pointers to mm_struct (memory descriptor), files_struct, signal_struct, credentials, namespaces, ptrace state, cgroups links, and audit fields, far more than “registers.”

Inspect a process

Terminal

cat /proc/self/status | egrep 'Name|Pid|PPid|Threads|VmRSS'

Self-check

Misses here are cheap; misses in an interview are not. Treat wrong answers as a patch list for tomorrow.

1Which is true of two unrelated running processes?

2A program is…

3Max RSS limits relate to…