Frequently Asked Question

What exactly is a process on Linux?

A process is an instance of a running program. The program itself is a passive lump of bytes on disk, an ELF executable, a script, a .pyc file, and only becomes a process once the kernel has loaded it into memory, given it an address space, opened standard input, output and error for it, and scheduled it onto a CPU. If three terminal windows are each running bash, there are three bash processes: same program, three independent sets of memory, file descriptors, and IDs.

Every process has a unique positive integer called the PID (process ID), the user and group it runs as, a working directory, a controlling terminal (or none, for daemons), a parent process, and a state. The kernel keeps all of this in a struct task_struct inside its own memory, and exposes a slice of it to user space through /proc/<PID>/. Tools like ps, top, and htop are essentially formatted readers over that directory.