Skip to content

Process vs program vs service

Mental model

Program = file on disk. Process = running instance. Service = managed process. Three different things at three different layers.

What it looks like

"Restart the program." "The service crashed." "Kill the process." Used interchangeably, but they refer to different things.

What it really is

  • Program: an executable file on disk. Static. Has no state. Example: /usr/sbin/nginx — just bytes in a file.
  • Process: a running instance of a program. Has a PID, memory space, open file descriptors, environment variables, a state (running/sleeping/zombie). Created by fork()+exec().
  • Service: a process (or set of processes) managed by an init system. Systemd tracks it via a unit file, handles start, stop, restart, and auto-restart on failure.

Why it seems confusing

People say "restart the program" when they mean "restart the service" which means "stop the old process, start a new one from the same program." The word "application" adds more ambiguity — it can mean any of the three.

What actually matters

  • A program can have zero processes (not running), one process, or many processes (e.g., Apache prefork workers).
  • A process has runtime state that the program doesn't: PID, memory contents, open sockets, environment.
  • A service adds lifecycle management: auto-start at boot, restart-on-failure, dependency ordering, logging.
  • Killing a process doesn't delete the program.
  • Deleting the program doesn't kill running processes (they already have the binary mapped in memory).

Common mistakes

  • Saying "the program is using port 80" — processes use ports, programs don't. The same program can run on different ports.
  • Thinking one program = one process. Worker pools, forking servers, and multi-process architectures break this.
  • Confusing systemctl enable (service boots) with systemctl start (process starts now). Enable creates a symlink; start creates a process.

Small examples

# Program: a file
file /usr/sbin/nginx        # ELF 64-bit executable

# Process: a running instance
pidof nginx                  # 1234 1235 1236 (multiple)
ls -l /proc/1234/exe         # link back to the program
cat /proc/1234/status        # runtime state: memory, threads

# Service: managed by systemd
systemctl status nginx       # shows unit state + PID
systemctl restart nginx      # kills old process, starts new one
# The program on disk never changed.

One program, many processes: 

/usr/sbin/nginx (program on disk)
  └── PID 1234 (master process)
      ├── PID 1235 (worker process)
      └── PID 1236 (worker process)
All managed as nginx.service by systemd.

One-line summary

Program = static file; process = running instance with state; service = process managed by init system.