How Linux processes work: PID, parent, and lifecycle

Every Running Program Is a Process

A process is a running instance of a program. Every process has a unique PID (Process ID) and a PPID (Parent Process ID). Linux uses a fork-exec model: to launch a new program, the current process forks (copies itself), then exec replaces the copy with the new program.

Process States

A process can be: Running (actively executing), Sleeping (waiting for I/O or a signal), Stopped (paused via SIGSTOP), or Zombie (finished but parent has not collected its exit code). Zombie processes occupy a PID slot but no memory — they disappear when the parent calls wait().

# View all processes with full detail
ps aux

# Process tree showing parent-child relationships
pstree

# Your own processes
ps -u $USER

# Find a specific process
ps aux | grep nginx

# The PID of a process by name
pgrep nginx

# See process IDs and parent IDs
ps -eo pid,ppid,cmd | head -20

PID 1 and systemd

PID 1 is the init process — the first process the kernel starts. On modern Linux it is systemd. Every other process is a descendant of PID 1. When a parent process dies before its children, those orphaned children are adopted by systemd.