Process Management — Trivia & Interesting Facts¶
Surprising, historical, and little-known facts about Linux process management.
fork() was invented in 1963 — before Unix existed¶
The fork system call was first described by Melvin Conway in 1963 for the L-language on the UNIVAC. Ken Thompson adopted fork for Unix in 1969 because it was the simplest way to create new processes. The fork/exec model — where fork copies the process and exec replaces it with a new program — remains Linux's primary process creation mechanism 60 years later.
PID 1 is special and cannot be killed¶
PID 1 (init/systemd) has unique kernel protections. The kernel ignores any signal sent to PID 1 unless PID 1 has explicitly registered a handler for that signal. Even kill -9 1 (SIGKILL) does nothing. If PID 1 exits or crashes, the kernel panics immediately. This protection exists because PID 1 is responsible for reaping orphaned processes and maintaining the process tree.
Zombie processes are dead but will not go away¶
A zombie (state "Z" in ps) is a process that has exited but whose parent has not yet called wait() to collect its exit status. The zombie consumes no CPU or memory — only a process table entry. A few zombies are harmless, but thousands can exhaust the PID space (default max: 32768, configurable to 4 million via kernel.pid_max). The only way to clear zombies is to kill their parent or wait for the parent to call wait().
The OOM killer has a scoring algorithm that favors killing memory hogs¶
The Linux Out-Of-Memory killer scores each process based on: percentage of physical memory used, whether it is privileged (root processes score lower), how long it has run, and the oom_score_adj hint. The highest-scored process is killed. You can see any process's current score in /proc/[pid]/oom_score. The maximum score is 1000 (0-based, with 1000 = guaranteed kill).
nice values range from -20 to 19, and the scale is confusing¶
A nice value of -20 is highest priority; 19 is lowest. The inverted scale confused generations of administrators. The term "nice" means "how nice this process is to others" — a high nice value means the process yields CPU to others. Only root can set negative nice values (higher priority). The renice command changes priority of running processes.
Linux can handle 4 million concurrent processes¶
The default maximum PID is 32768 (a 15-bit limit inherited from old Unix). Since Linux 2.6, kernel.pid_max can be set to 4,194,304 (2^22). Modern servers running containers often increase this because each container's processes consume PIDs from the host's space. A Kubernetes node running 100 pods with 50 processes each needs at least 5,000 PIDs.
cgroups v2 gives each container a kill switch¶
cgroups v2's cgroup.kill file (added in Linux 5.14) allows killing all processes in a cgroup atomically by writing "1" to it. Before this, killing a container required iterating over processes, which raced with fork() — new processes could appear between reads. The atomic kill feature made container cleanup reliable for the first time.
Signals have a surprising delivery order¶
When multiple signals are pending for a process, the kernel delivers the lowest-numbered signal first. This means SIGHUP (1) is delivered before SIGTERM (15), which is delivered before SIGKILL (9). Real-time signals (32-64) are queued and delivered in order, unlike standard signals which are merged — sending SIGTERM twice only delivers it once.
The /proc/[pid]/fd directory reveals every open file¶
ls -la /proc/[pid]/fd/ shows every file descriptor a process has open, as symbolic links to the actual files. This is invaluable for diagnosing "too many open files" errors, finding which log files a process writes to, or discovering unexpected network connections. lsof reads this information but adds significant overhead on systems with many processes.
Process namespaces make containers think they are alone¶
PID namespaces (Linux 3.8, 2013) give each container its own PID numbering starting from 1. The container's init process sees itself as PID 1, while the host sees it as a regular PID (e.g., 28431). This dual-view is visible in /proc/[pid]/status under NSpid:. A container process might be PID 1 inside and PID 28431 outside simultaneously.
nohup was invented because terminals killed their children¶
When a terminal session ends, the kernel sends SIGHUP (hangup) to all processes started from that terminal. nohup (no hangup) catches SIGHUP and lets the process continue. The name comes from telephone terminology — "hanging up" disconnected the modem. Modern alternatives include tmux, systemd services, and disown (a Bash builtin that removes a job from the shell's job table).
strace reveals that a simple "ls" makes over 100 syscalls¶
Running strace -c ls on a typical directory shows approximately 100-150 system calls: openat, fstat, read, write, close, getdents64, mmap, mprotect, and more. Most of these are dynamic library loading (ld-linux resolving shared libraries) and locale initialization. The actual directory listing (getdents64 + write) is fewer than 10 syscalls.