What a process actually is
“What is a process, concretely? What does the kernel keep for it, and how is it different from the program on disk?”
What this tests
- Program vs process: a file vs a kernel object with state
- What the process control block contains
- The process state machine and why blocked processes cost nothing
- That a process is an address space plus at least one thread
Answers by level
Read the beginner answer first and notice what is missing.
The program is a file — /usr/bin/python3, an ELF or PE image with code and initial data. A process is the kernel object created when that file is loaded: a private virtual address space with the code mapped in, a stack, a heap, and a record the kernel keeps about it. Run python3 three times and you get three processes with three heaps, three sets of open files and three PIDs, all sharing the read-only code pages (Program versus Process).
That record — the process control block (task_struct on Linux, EPROCESS on Windows) — holds identity (PID, parent PID, user and group IDs), the memory map (page tables, the list of mapped regions), the open descriptor table, signal dispositions, working directory, resource limits, accounting (CPU time consumed, faults taken) and the scheduling state. Everything you see in ps, top and /proc/<pid>/ is read out of that structure (The Anatomy of a Process).
A process is always in a state: running on a core, runnable and waiting in the ready queue, or blocked waiting for something — a read() to complete, a lock, a timer, a child to exit. Blocked processes consume no CPU and are not the scheduler’s problem; they sit in a wait queue attached to the thing they wait for. When it exits, the process becomes a zombie until its parent collects the exit status, and only then is the PID released (Process States).
Since threads exist, the cleanest definition is: a process is an address space plus a set of resources plus one or more threads that execute inside it. The process is the unit of isolation and ownership; the thread is the unit of scheduling.
Green flags · Red flags
/proc, ps columns) for each part of the process.- Separates the file from the running instance and can name what the instance owns
- Describes the state machine: running, runnable, blocked, zombie
- Says blocked processes cost no CPU
- Knows a process is an address space plus threads
- Cannot say what differs between two instances of the same program
- Thinks a process in the blocked state is "using" the CPU
- Does not know what a zombie is or thinks it uses memory
Follow-up questions
ps state D mean and why does it matter?Scenario
ps on a host shows 400 processes but the CPU is 5% busy. A junior engineer wants to "reduce the number of processes to speed things up". Explain what those processes cost and when process count would matter.