Linux Processes — Understanding Running Programs¶

Every application, command, or service running on a Linux system is executed as a process. Whether you're opening a terminal, running a web server, starting Docker, or deploying applications to Kubernetes, Linux manages everything through processes. Understanding processes is one of the most important skills for Linux administrators, DevOps engineers, Cloud Architects, and Site Reliability Engineers (SREs).

Learning Path¶

Linux Mastery → Module 6: Process Management → Lesson 1

Difficulty: Beginner → Intermediate

Reading Time: 55 Minutes

Course Progress

Course: Linux Mastery

Module: Process Management

Lesson: 1 of 10

What You'll Learn¶

After completing this lesson, you'll be able to:

Understand what a process is
Differentiate programs and processes
Understand Process IDs (PIDs)
Learn parent and child processes
Identify process ownership
Understand process life cycles
Learn process states
Apply process concepts in production environments

Prerequisites¶

Complete:

Module 1 – Linux Fundamentals
Module 2 – Linux Command Line Essentials
Module 3 – Text Processing
Module 4 – File Management and Permissions
Module 5 – Users and Groups

Why Learn Processes?¶

Imagine you run:

firefox

or

python app.py

or

docker run nginx

How does Linux execute these programs?

The answer is Processes.

Every running application on Linux is represented by one or more processes.

What is a Process?¶

A process is a program in execution.

For example:

Program:

/bin/ls

When executed:

ls

Linux creates a process.

Program vs Process¶

Program	Process
Static file stored on disk	Running instance of a program
Passive	Active
Exists before execution	Exists while executing
Can have multiple running instances	Each instance has its own PID

Example:

Program

python

Running:

python app.py

becomes:

Process

PID 2456

Process Lifecycle¶

Program
    │
    ▼
Process Created
    │
    ▼
Running
    │
    ▼
Waiting / Sleeping
    │
    ▼
Running Again
    │
    ▼
Finished

Linux continuously creates, schedules, and terminates processes.

Process ID (PID)¶

Every process has a unique identifier called a Process ID (PID).

Example:

Display the current shell's PID.

echo $$

Example:

Parent and Child Processes¶

Processes often create other processes.

Example:

Terminal

↓

Bash

↓

Python

↓

Child Process

Parent Process:

Starts another process.

Child Process:

Created by the parent.

Parent Process ID (PPID)¶

Display process information.

ps -f

Example:

UID PID PPID CMD

basha 4312 4200 bash

Here:

PID

4312

Parent:

PPID

4200

The init/systemd Process¶

Every Linux process ultimately originates from:

PID 1

On modern Linux systems:

systemd

Earlier Linux systems commonly used:

init

Display PID 1.

ps -p 1

Example:

PID COMMAND

1 systemd

Process Ownership¶

Every process belongs to a user.

Display:

ps -ef

Example:

USER PID COMMAND

root 1 systemd

basha 4312 bash

mysql 900 mysqld

Ownership determines:

Permissions
Resource access
Security

Process States¶

A process can be in different states.

Common states:

State	Meaning
R	Running or ready to run
S	Sleeping (waiting for an event)
D	Uninterruptible sleep (usually waiting for disk I/O)
T	Stopped or traced
Z	Zombie (terminated but not yet reaped by its parent)

Display states.

ps -eo pid,state,comm

Zombie Processes¶

A zombie process:

Has finished execution
Still occupies an entry in the process table
Awaits cleanup by its parent process

Display zombies.

ps -el | grep Z

Normally, zombies disappear when the parent process collects the child's exit status.

Viewing Your Current Process¶

Current shell PID.

echo $$

Current shell name.

ps -p $$

Viewing Running Processes¶

Basic process list.

ps

Detailed list.

ps -ef

Tree view.

ps -ejH

or

pstree

(If installed.)

Process Hierarchy¶

Example:

systemd (PID 1)
│
├── sshd
│     └── bash
│           └── vim
│
├── nginx
│
└── docker
      └── containerd

Linux organizes processes in a parent-child hierarchy.

Common Commands¶

Display processes.

ps

Detailed processes.

ps -ef

Current shell PID.

echo $$

Display PID 1.

ps -p 1

Process tree.

pstree

Real Production Examples¶

View Kubernetes processes.

ps -ef | grep kube

View Docker daemon.

ps -ef | grep docker

View NGINX.

ps -ef | grep nginx

View PostgreSQL.

ps -ef | grep postgres

Production Perspective¶

Understanding processes is essential for:

Linux Administration
Docker
Kubernetes
Cloud Virtual Machines
Databases
CI/CD Servers
Monitoring
Troubleshooting
Performance Analysis

Every production workload ultimately runs as one or more Linux processes.

Hands-on Lab¶

Task 1¶

Display your current shell PID.

echo $$

Task 2¶

Display running processes.

ps

Task 3¶

Display all processes.

ps -ef

Task 4¶

Display PID 1.

ps -p 1

Task 5¶

Display process states.

ps -eo pid,state,comm

Task 6¶

Display the process tree.

pstree

(Install it if it is not available on your system.)

Task 7¶

Identify the parent process of your shell.

ps -f

Observe the PPID column.

Task 8¶

Search for a running process.

ps -ef | grep ssh

Command Deep Dive¶

Command	Purpose	Production Example
`ps`	Display running processes	Daily administration
`ps -ef`	Detailed process list	Troubleshooting
`echo $$`	Current shell PID	Shell scripting
`ps -p 1`	View systemd	System initialization
`pstree`	Process hierarchy	Debugging
`grep`	Filter process list	Service inspection

Production Troubleshooting Scenario¶

Scenario

A web application becomes unresponsive.

Investigation:

ps -ef | grep nginx

ps -ef | grep python

ps -ef | grep java

The administrator discovers:

The application process is no longer running.
The web server is still active.
Requests fail because the backend process exited unexpectedly.

The next step is to inspect logs, restart the application if appropriate, and determine why the process terminated.

Understanding process identification is the first step in resolving production incidents.

Best Practices¶

Learn to identify processes using their PID.
Avoid terminating processes without understanding their purpose.
Verify process ownership before taking action.
Monitor long-running applications regularly.
Understand parent-child relationships when troubleshooting.

Common Mistakes¶

❌ Assuming a program is running because it is installed.

✅ Verify using process inspection commands.

❌ Killing system processes without understanding their function.

✅ This can destabilize the operating system.

❌ Ignoring zombie processes during troubleshooting.

✅ Although usually harmless in small numbers, a large number of zombies may indicate an application bug.

Interview Questions¶

Beginner¶

What is a process?
What is the difference between a program and a process?
What is a PID?
Which command displays running processes?

Intermediate¶

What is the difference between a PID and a PPID?
What is a zombie process?
Why is systemd typically assigned PID 1?
How do you display the process hierarchy?

Architect Level¶

How would you investigate an application that has unexpectedly stopped running?
Why is understanding process ownership important in multi-user systems?
How do Linux processes relate to containers and Kubernetes Pods?

Summary¶

In this lesson, you learned:

What a process is
Programs vs processes
Process IDs (PID)
Parent and child processes
Process ownership
Process states
Process hierarchy
Production best practices

Processes are the foundation of Linux execution. Every application, service, and container ultimately runs as one or more Linux processes. Understanding how processes are created, managed, and organized is essential for effective system administration and troubleshooting.

Key Takeaways¶

A process is a program that is currently executing.
Every process has a unique Process ID (PID).
Every process has a parent process (PPID), except PID 1.
systemd is typically the first process started by the Linux kernel.
Use ps to inspect running processes.
Understanding processes is the foundation for process management and troubleshooting.

What's Next?¶

Foreground and Background Jobs — Running Multiple Tasks in Linux

You'll explore:

Foreground processes
Background processes
Job control
jobs
bg
fg
nohup
Running long-running tasks without interrupting your terminal

These concepts are essential for multitasking and managing processes efficiently from the Linux command line.