Process Details

A program is executable code and data stored in a file. A process is a live execution context: it includes mapped code, memory, credentials, open file descriptors, signal state, scheduling information, and one or more threads. The same program can have many independent process instances.

Program Instances and PIDs

For example, start cat without operands in two terminals. Each instance waits for input and has its own process ID:

$ pgrep -a cat
18420 cat
18457 cat

Both processes execute the same program, but they can have different input streams, memory contents, credentials, working directories, and lifetimes. A PID identifies one live process at a time and can later be reused after that process exits.

State Tracked by the Kernel

The kernel maintains the information required to schedule and control each process, including:

• process and parent identifiers
• user and group credentials
• virtual memory mappings
• open file descriptors and current directory
• signal dispositions and pending signals
• scheduling policy, priority, and execution state
• accounting data such as CPU time

Some underlying resources can be shared. Related processes may share mapped memory, and threads in one process share an address space and many process-wide resources. A process therefore provides isolation boundaries without implying that every byte or kernel object is physically private.

CPU Scheduling and Memory

Runnable threads compete for CPU time. The kernel scheduler chooses which thread runs on which CPU according to scheduling class, priority, CPU affinity, load, and policy. This is not a promise that every process receives an equal share.

Each process normally sees a virtual address space. The kernel and hardware map virtual addresses to physical memory or other backing storage, enforce protections, and can share pages where appropriate. A memory figure in ps or top is therefore not automatically the amount of unique physical RAM attributable to that process.

Process Exit and Resource Cleanup

When a process exits, the kernel releases most of its private resources, closes remaining descriptors, and records termination information for its parent. A small process-table record can remain as a zombie until the parent retrieves the exit status. This means “the process has finished executing” and “every trace has disappeared from the process table” are not always simultaneous.

Use the Manage and Monitor Linux Processes lab to start multiple instances and compare their PIDs and states. The Linux top Command lab provides a changing view of scheduling and resource metrics.

Summary

You can now describe a process as more than a program file.

1. Distinguish stored executable code from a live process instance.
2. Identify the state and resources tracked by the kernel.
3. Relate scheduling to runnable threads rather than equal shares.
4. Recognize that exit status can remain until the parent collects it.