Start here

A zombie has exited but its row stays until a parent calls wait. An orphan has lost its parent while still alive, it is reparented, not deleted.

Zombies and orphans

On exit, the kernel converts a process to a zombie so the parent can read exit code and resource usage. If the parent never waits, zombies accumulate and can exhaust PID space. If the parent dies first, init (PID 1) or a subreaper adopts orphans and must reap them.

By the end of this page you should be able to

State what resource a zombie still holds.
Explain reparenting in one sentence.
Predict failure mode if PID1 stops reaping children.

Operating systems · Processes

Zombie and orphan processes

Reaping, adoption, and PID 1 duties

TL;DR

A zombie is a terminated child whose exit status has not been consumed, PCB slot remains. An orphan is a live child whose parent died; it is reparented (classically to init) which must reap it. Both are lifecycle bookkeeping, not “malware states.”

Summary

These states show how Unix ties parent/child relationships into resource reclamation. Supervisors (k8s kubelet, systemd) must handle SIGCHLD and wait loops correctly or nodes exhaust PIDs.

Deeper narrative

Zombies hold exit codes for parents; orphans are reparented, not freed. Init or a subreaper must reap to avoid PID exhaustion under fork-heavy workloads (web servers, CI).

Mechanism (step by step)

Treat each step as a sentence in the story you tell on a whiteboard.

Exit path

Set zombie state, notify parent with `SIGCHLD`, keep minimal PCB.

wait / waitid

Parent consumes status; kernel frees PID and final structures.

Orphan rule

Living parent gone → reparent to subreaper or PID1.

PID1 duty

Must reap in loop or delegate to threaded reaper, otherwise table fills.

Key insights

Each card is a compression of the lesson, use them as spaced-repetition prompts.

Kernel must keep exit code

Until `wait`, the parent contract requires the kernel to preserve termination metadata, hence zombies.

Init must reap loops

systemd and traditional init install SIGCHLD handlers that reap adopted children to avoid filling the process table.

Zombies are not running

They consume a PID slot and kernel struct, not user CPU, still a resource leak at scale.

Orphans keep running

Adoption changes parent pointer; it does not stop execution, signals policy may change (SIGHUP to session).

Did you know?

Trivia with teeth: the kind of fact that changes how you reason about a design.

Ignoring SIGCHLD with default disposition does not always reap children, you still need `wait` unless using special Linux behaviors.

Double-fork detaches daemons from controlling terminals and session leaders.

PID namespaces remap PIDs, zombie visibility depends on namespace membership.

Common pitfalls

Where smart people still trip, read slowly.

Ignoring SIGCHLD default

If not handled or ignored with correct semantics, zombies accumulate.

Double wait

Multiple threads waiting same child-`waitpid` with specific pid avoids races.

Comparison

Zombie vs orphan

	Zombie	Orphan
Alive?	No (terminated)	Yes
Parent alive?	Often yes (not waiting)	No (reparented)
Primary fix	Parent calls wait / fix signal handler	Init must reap / correct service code

Glossary

Zombie

Exited process awaiting parent `wait`: keeps PID and kernel slot.

Orphan

Live child whose parent died, reparented, not necessarily zombie.

Subreaper

Process designated to adopt orphaned descendants for service supervision.

Interview follow-ups

How does `PR_SET_CHILD_SUBREAPER` change orphan behavior?
Can a zombie consume significant RAM?
What breaks if PID1 stops calling `wait`?

Callouts

Outage pattern

“Cannot fork” on a healthy machine sometimes means zombie table exhaustion, not RAM.

Walkthrough & deep dive

Left: practical “how would I use this?” threads. Right: slower, code-leaning explanations, open one panel at a time so the page does not feel like a wall of sameness.

Walkthrough

Debug script

Given `ps` shows many `<defunct>` owned by your server PID, list concrete code changes to reap grandchildren if using double-fork.

Deep dive

SIGCHLD handler pattern

Non-blocking wait loop in handler avoids losing events; be careful with async-signal-safe functions only.

Spot zombies

Terminal

ps -eo pid,ppid,stat,cmd | awk '$3 ~ /Z/ {print}'

Self-check

Misses here are cheap; misses in an interview are not. Treat wrong answers as a patch list for tomorrow.

1A zombie process…

2An orphan is…

3Reaping clears…