What a file descriptor really is

The descriptor is an index into a per-process table owned by the kernel. Each slot points to an open file description — a kernel object holding the current offset, the access mode and status flags (O_NONBLOCK, O_APPEND) — which in turn points to the actual thing: an inode for a regular file, a socket, a pipe, a device, an epoll instance, a timerfd. The number is meaningless outside the process; descriptor 3 in one process and descriptor 3 in another are unrelated (File Descriptors).

open() returns the lowest unused slot, and processes start with 0, 1, 2 wired by convention — so 3 is simply the next free index, which is why shell redirection works by closing and reopening low numbers. Two open() calls on the same file create two open file descriptions with independent offsets; dup()/dup2() and fork() create new slots pointing at the same description, so the offset is shared — a parent and child both writing to an inherited log descriptor interleave correctly instead of overwriting each other.

Sockets, pipes and everything else are descriptors because the kernel exposes one interface — read, write, close, poll — over anything that can produce or consume bytes or events. That uniformity is what makes epoll possible: one wait over sockets, pipes, timers and signals at once (Everything Is I/O, The Socket: A Descriptor With Two Kernel Buffers Behind It).

The table is bounded: the soft limit per process (ulimit -n, historically 1,024, commonly raised to 65,536) and a hard limit above it; system-wide fs.file-max. Exhausting the per-process table gives EMFILE, the system table ENFILE (label: Linux/Unix). A descriptor leak is the usual way to hit it: a socket never closed after the peer hung up (visible as CLOSE_WAIT in ss), a file opened in an error path without close, a child process that inherited everything. ls /proc/<pid>/fd | wc -l over time tells you whether the count is growing.