Skip to content
Optimal Lab

DevOps · interactive

Processes, signals and the process tree

Every Linux process has a parent, back to PID 1. Stopping a process means sending it a signal, and what happens next depends on which signal and on whether parents clean up after their children.

$ ps -eo pid,ppid,stat,cmd --forest

  • 1ppid 0systemdrunning
  • 812ppid 1node server.jsrunning
  • 820ppid 812worker 1running
  • 821ppid 812worker 2running

systemd (PID 1) started the server, which forked two workers. Each process knows its parent (PPID).

What happens

step 1 of 4

Step 2 of 4

  1. 1

    fork, exec, wait

    A process forks a copy of itself, the copy execs a new program, and the parent waits to collect its exit code.

    pstree -p

  2. 2

    SIGTERM first, SIGKILL last

    SIGTERM can be handled: finish work and exit cleanly. SIGKILL can't: the process just disappears.

    Kubernetes waits 30 s between them.

  3. 3

    Orphans go to PID 1

    If a parent dies, init adopts the children and reaps them later.

    Containers need a real init for this.

  4. 4

    Zombies wait to be reaped

    A finished child stays as a zombie until its parent calls wait(). Harmless one at a time; a leak in bulk.

    STAT column shows Z.

In production

Tools and technologies

Every container and service manager works with these signals.

Not tied to one language — use these names when you search docs or design a system.