Mental model
In Linux, every process (except init / systemd PID 1) is created when a parent process clones itself via fork(), duplicating page tables with Copy-On-Write (COW) optimization, before loading a new executable image via execve().
Parent Process invokes fork()
Kernel duplicates Task Struct & Page Tables (COW)
Child Process invokes execve('/bin/app')
Kernel replaces Process Address Space
Child exits -> Parent reaps via waitpid()
Theory
- Copy-On-Write (COW):
fork()marks page table entries read-only for both parent and child. Physical memory pages are only duplicated when either process attempts to write to a page. - Inter-Process Communication (IPC):
- Unix Domain Sockets (
AF_UNIX): Fast local IPC bypassing network stack protocol overhead. - Shared Memory (
shmget/mmap): Fastest IPC; processes map the same physical RAM pages into their virtual address spaces.
- Unix Domain Sockets (
c(21 lines)
1// C example: Process Forking & Executive Execution
2#include <stdio.h>
3#include <unistd.h>
4#include <sys/types.h>
5#include <sys/wait.h>
6
7int main() {
8 pid_t pid = fork();
9 if (pid == 0) {
10 // Child Process
11 char *args[] = {"/bin/ls", "-l", NULL};
12 execve(args[0], args, NULL);
13 } else if (pid > 0) {
14 // Parent Process waits for child exit to prevent zombie process
15 int status;
16 waitpid(pid, &status, 0);
17 printf("Child process %d exited.\n", pid);
18 }
19 return 0;
20}
Alternatives and trade-offs
- Unix Domain Sockets: High speed, supports socket permissions and passing file descriptors (
SCM_RIGHTS). - Shared Memory (
mmap): Zero-copy performance; requires explicit locking mutexes (spinlocks / semaphores) to prevent memory corruption.
Failure modes and misconceptions
- Zombie Processes: If a parent process fails to invoke
wait()/waitpid()after a child exits, the child process entry remains in the kernel process table as a Zombie (Zstate), consuming PIDs. - COW Memory Spikes: Forking a process with 10GB allocated RAM causes a sudden memory spike if the child process mutates large memory arrays, triggering page duplications.
Reflect before revealing the guide
Decision scenario
Use Unix Domain Sockets (AF_UNIX) for high-throughput local IPC between containerized sidecar processes to avoid TCP network stack overhead.
Learning outcomes
- Trace Linux process creation using
fork()andexecve(). - Explain Copy-On-Write (COW) memory page mapping during process cloning.
- Prevent zombie processes by managing parent
waitpid()signals.
Trade-offs
fork() enables rapid process creation via Copy-On-Write page tables, but un-reaped terminated children accumulate as zombie processes in the kernel task list.