Processes and Signals

SIGTERM is a polite request: the process can catch it and shut down cleanly. SIGKILL is enforced by the kernel — the target never runs code for it, so buffers, lock files and in-flight work are abandoned as they are.

A zombie is a process that has already terminated but whose parent has not yet collected its exit status. The kernel keeps only its process-table entry, PID and exit code; it disappears as soon as the parent waits on it.

No. Linux spends otherwise-idle RAM on page cache for file data and reclaims it on demand, so near-zero free memory is normal and healthy. The number that matters is available, which estimates what a new process could still get.

A nice value biases how much CPU a Linux task gets when CPUs are contended. It runs from -20 (most favoured) to 19 (least favoured), default 0. Lowering it needs privilege, so an unprivileged renice is a one-way trip.

Linux counts both runnable tasks and tasks in uninterruptible sleep (D state) in its load average, unlike traditional Unix. High load with idle CPUs therefore means processes are blocked in the kernel waiting on storage or a hung mount, not competing for CPU.

The kernel scores every process by how much memory freeing it would recover — mainly resident plus swap usage, relative to total memory — and kills the highest scorer. oom_score_adj, from -1000 to 1000, biases that score, with -1000 exempting a process entirely.

memory.high is a throttle: the kernel reclaims hard and stalls the offending processes, but never kills them, so usage may sit above it. memory.max is a wall: when reclaim fails to get under it, the cgroup OOM killer kills a process inside.

SIGHUP kills it. When the SSH connection drops the kernel hangs up the controlling terminal and signals the session, and SIGHUP's default action is to terminate. Start the job under nohup or setsid, or inside a terminal multiplexer.

The program became an orphan and the kernel reparented it to PID 1 (or the nearest ancestor marked as a subreaper). It keeps running unchanged — same PID, same memory, same open files — and its exit status will be collected by its new parent.

Linux overcommits: an allocation only creates a mapping, and physical pages are committed on first touch. The kernel may promise more than it can back, so the shortage surfaces later as a fault it cannot satisfy. vm.overcommit_memory selects the policy.

VSZ is the size of the process's virtual address space — mappings it may use, most of which are never backed by RAM. RSS is the pages actually resident in physical memory. Only RSS consumes RAM, so 12 GB of address space on a 4 GB box is unremarkable.

Setting CPU affinity restricts where a task may run; it does not reserve anything. Every other task on the system can still be scheduled onto CPUs 2 and 3. Children inherit the mask across fork, and it survives exec.

Linux maps each nice value to a weight, roughly 1.25x per step with nice 0 at 1024, and hands every runnable task CPU time in proportion to its weight. Each nice step therefore shifts about 10% of the contested CPU.

cgroup v2 forbids a non-root cgroup from both holding processes and distributing resources to its children — the no-internal-processes rule. Processes belong in leaves; inner cgroups only enable controllers via cgroup.subtree_control. That is why systemd puts services in leaf units under slices.

A user namespace maps IDs inside it to different IDs outside, written once to /proc/PID/uid_map and gid_map. You hold a full capability set inside, but only over resources the kernel owns through that namespace; host files are still checked against your real, unprivileged outside UID.

The signal is recorded as pending, not lost. A task in state D is in uninterruptible sleep inside a kernel call — usually blocked on I/O — and signals are only acted on when a task heads back toward user space, which it never reaches.

The helper inherited the listening socket. File descriptors survive fork and survive exec unless marked close-on-exec, and a socket stays bound while any process still holds it. The fix is to create such descriptors with O_CLOEXEC or SOCK_CLOEXEC, or set FD_CLOEXEC before exec.

State D is uninterruptible sleep: the task is blocked inside a kernel operation that cannot be unwound safely, usually waiting on storage. SIGKILL is recorded as pending but only acted on when the task heads back to user space, which it cannot do until the operation finishes.

The kernel is reclaiming pages that are still in use and immediately faulting them back from disk — thrashing. The CPUs are idle because tasks are blocked on I/O. Swap buys time and absorbs cold pages; it does not add usable memory to a working set that exceeds RAM.

SCHED_FIFO and SCHED_RR give a thread a static priority of 1-99 that preempts every normal task; FIFO runs until it blocks or yields, RR adds a time slice between equal priorities. A runaway FIFO loop starves everything below it, which is why Linux throttles real-time tasks by default.

A namespace lives as long as something references it: a member process, an open file descriptor on /proc/PID/ns/*, a bind mount of that file, or a child namespace. ip netns add deliberately bind-mounts the namespace under /run/netns so it outlives the process that created it.

The status is a packed word describing how the child ended, not just what it returned. Decode it with the macros: WIFEXITED plus WEXITSTATUS for a normal exit, WIFSIGNALED plus WTERMSIG when a signal killed it.

Rlimits are per-process attributes, inherited across fork and kept across exec. A shell's ulimit changes only that shell and children it starts afterwards, never a running daemon. The soft limit is what is enforced; the hard limit is the ceiling the soft one may be raised to.

Mount propagation decides whether mount and unmount events travel between mount namespaces that share a peer group. Shared propagates both ways, private neither way, slave one way only — in from the master — and unbindable additionally refuses to be used as a bind source. One-way is slave.

Only async-signal-safe functions, listed in the signal-safety(7) manual page — chiefly write() and _exit() — plus setting a volatile sig_atomic_t flag. printf() takes locks the interrupted code may already hold, so re-entering it can deadlock.

ionice tags a process's block-layer requests with an I/O class and level, so a lower-priority job yields disk service to others. It only works if the active I/O scheduler honours those tags — with the none scheduler common on NVMe, the tag is simply ignored.