Frequently Asked Question

What is an orphan process and what happens to it?

An orphan is a process whose parent has exited while it was still alive. It is the mirror image of a zombie: an orphan is a running process with a dead parent, a zombie is a dead process with a living parent. The kernel does not leave orphans floating without an ancestor, because every process must have a PPID; instead it reparents them to PID 1, or to the nearest "subreaper" if one has been registered with prctl(PR_SET_CHILD_SUBREAPER).

Reparenting is essential because somebody has to call wait() when the orphan eventually exits, otherwise it would become an unreapable zombie. Systemd and most container init systems mark themselves as subreapers precisely so they can clean up after misbehaving services or container payloads. You can spot a reparented orphan easily: its PPID in ps will be 1 even though it was not started directly by init.